diff --git a/wp-includes/kses.php b/wp-includes/kses.php index 97ffe0cc3d..a0bdf2c8da 100644 --- a/wp-includes/kses.php +++ b/wp-includes/kses.php @@ -530,9 +530,17 @@ function kses_init_filters() { function kses_init() { global $current_user; - get_currentuserinfo(); // set $current_user + remove_filter('pre_comment_author', 'wp_filter_kses'); + remove_filter('pre_comment_content', 'wp_filter_kses'); + remove_filter('content_save_pre', 'wp_filter_post_kses'); + remove_filter('title_save_pre', 'wp_filter_kses'); + + if (! defined('XMLRPC_REQUEST') ) + get_currentuserinfo(); + if (current_user_can('unfiltered_html') == false) kses_init_filters(); } add_action('init', 'kses_init'); +add_action('set_current_user', 'kses_init'); ?> diff --git a/wp-includes/pluggable-functions.php b/wp-includes/pluggable-functions.php index a75984f02f..dfe3f51ffa 100644 --- a/wp-includes/pluggable-functions.php +++ b/wp-includes/pluggable-functions.php @@ -3,11 +3,38 @@ /* These functions can be replaced via plugins. They are loaded after plugins are loaded. */ +if ( !function_exists('set_current_user') ) : +function set_current_user($id, $name = '') { + global $user_login, $userdata, $user_level, $user_ID, $user_email, $user_url, $user_pass_md5, $user_identity, $current_user; + + $current_user = ''; + + $current_user = new WP_User($id, $name); + + $userdata = get_userdatabylogin($user_login); + + $user_login = $userdata->user_login; + $user_level = $userdata->user_level; + $user_ID = $userdata->ID; + $user_email = $userdata->user_email; + $user_url = $userdata->user_url; + $user_pass_md5 = md5($userdata->user_pass); + $user_identity = $userdata->display_name; + + do_action('set_current_user'); + + return $current_user; +} +endif; + if ( !function_exists('get_currentuserinfo') ) : function get_currentuserinfo() { global $user_login, $userdata, $user_level, $user_ID, $user_email, $user_url, $user_pass_md5, $user_identity, $current_user; + if ( defined('XMLRPC_REQUEST') && XMLRPC_REQUEST ) + return false; + if ( empty($_COOKIE[USER_COOKIE]) || empty($_COOKIE[PASS_COOKIE]) || !wp_login($_COOKIE[USER_COOKIE], $_COOKIE[PASS_COOKIE], true) ) { $current_user = new WP_User(0); diff --git a/xmlrpc.php b/xmlrpc.php index f3edb64430..bf10b10643 100644 --- a/xmlrpc.php +++ b/xmlrpc.php @@ -1,5 +1,10 @@ error; } - $user = new WP_User(0, $user_login); - $is_admin = $user->has_cap('level_8'); + set_current_user(0, $user_login); + $is_admin = current_user_can('level_8'); $struct = array( 'isAdmin' => $is_admin, @@ -188,7 +193,7 @@ class wp_xmlrpc_server extends IXR_Server { 'blogid' => '1', 'blogName' => get_settings('blogname') ); - +error_log(print_r($struct,1), 3, '/tmp/xmlrpc'); return array($struct); } @@ -317,8 +322,8 @@ class wp_xmlrpc_server extends IXR_Server { return $this->error; } - $user = new WP_User(0, $user_login); - if ( !$user->has_cap('edit_themes') ) { + set_current_user(0, $user_login); + if ( !current_user_can('edit_themes') ) { return new IXR_Error(401, 'Sorry, this user can not edit the template.'); } @@ -352,8 +357,8 @@ class wp_xmlrpc_server extends IXR_Server { return $this->error; } - $user = new WP_User(0, $user_login); - if ( !$user->has_cap('edit_themes') ) { + set_current_user(0, $user_login); + if ( !current_user_can('edit_themes') ) { return new IXR_Error(401, 'Sorry, this user can not edit the template.'); } @@ -390,9 +395,8 @@ class wp_xmlrpc_server extends IXR_Server { } $cap = ($publish) ? 'publish_posts' : 'edit_posts'; - - $user = new WP_User(0, $user_login); - if ( !$user->has_cap($cap) ) + $user = set_current_user(0, $user_login); + if ( !current_user_can($cap) ) return new IXR_Error(401, 'Sorry, you can not post on this weblog or category.'); $post_status = ($publish) ? 'publish' : 'draft'; @@ -445,8 +449,8 @@ class wp_xmlrpc_server extends IXR_Server { $this->escape($actual_post); - $user = new WP_User(0, $user_login); - if ( !$user->has_cap('edit_post', $post_ID) ) + set_current_user(0, $user_login); + if ( !current_user_can('edit_post', $post_ID) ) return new IXR_Error(401, 'Sorry, you do not have the right to edit this post.'); extract($actual_post); @@ -489,8 +493,8 @@ class wp_xmlrpc_server extends IXR_Server { return new IXR_Error(404, 'Sorry, no such post.'); } - $user = new WP_User(0, $user_login); - if ( !$user->has_cap('edit_post', $post_ID) ) + set_current_user(0, $user_login); + if ( !current_user_can('edit_post', $post_ID) ) return new IXR_Error(401, 'Sorry, you do not have the right to delete this post.'); $result = wp_delete_post($post_ID); @@ -525,8 +529,8 @@ class wp_xmlrpc_server extends IXR_Server { return $this->error; } - $user = new WP_User(0, $user_login); - if ( !$user->has_cap('publish_posts') ) + $user = set_current_user(0, $user_login); + if ( !current_user_can('publish_posts') ) return new IXR_Error(401, 'Sorry, you can not post on this weblog or category.'); $post_author = $user->ID; @@ -605,8 +609,8 @@ class wp_xmlrpc_server extends IXR_Server { return $this->error; } - $user = new WP_User(0, $user_login); - if ( !$user->has_cap('edit_post', $post_ID) ) + set_current_user(0, $user_login); + if ( !current_user_can('edit_post', $post_ID) ) return new IXR_Error(401, 'Sorry, you can not edit this post.'); $postdata = wp_get_single_post($post_ID, ARRAY_A); @@ -844,9 +848,8 @@ class wp_xmlrpc_server extends IXR_Server { if ( !$this->login_pass_ok($user_login, $user_pass) ) return $this->error; - $user = new WP_User(0, $user_login); - - if ( !$user->has_cap('upload_files') ) { + set_current_user(0, $user_login); + if ( !current_user_can('upload_files') ) { logIO('O', '(MW) User does not have upload_files capability'); $this->error = new IXR_Error(401, 'You are not allowed to upload files to this site.'); return $this->error; @@ -984,8 +987,8 @@ class wp_xmlrpc_server extends IXR_Server { return $this->error; } - $user = new WP_User(0, $user_login); - if ( !$user->has_cap('edit_post', $post_ID) ) + set_current_user(0, $user_login); + if ( !current_user_can('edit_post', $post_ID) ) return new IXR_Error(401, 'Sorry, you can not edit this post.'); foreach($categories as $cat) { @@ -1066,8 +1069,8 @@ class wp_xmlrpc_server extends IXR_Server { return $this->error; } - $user = new WP_User(0, $user_login); - if ( !$user->has_cap('edit_post', $post_ID) ) + set_current_user(0, $user_login); + if ( !current_user_can('edit_post', $post_ID) ) return new IXR_Error(401, 'Sorry, you can not edit this post.'); $postdata = wp_get_single_post($post_ID,ARRAY_A); @@ -1282,4 +1285,4 @@ class wp_xmlrpc_server extends IXR_Server { $wp_xmlrpc_server = new wp_xmlrpc_server(); -?> \ No newline at end of file +?>