diff --git a/wp-includes/class-wp-xmlrpc-server.php b/wp-includes/class-wp-xmlrpc-server.php index d65de1a435..181f98402e 100644 --- a/wp-includes/class-wp-xmlrpc-server.php +++ b/wp-includes/class-wp-xmlrpc-server.php @@ -490,6 +490,24 @@ class wp_xmlrpc_server extends IXR_Server { return $struct; } + /** + * Checks if the method received at least the minimum number of arguments. + * + * @since 3.4 + * + * @param string|array $args Sanitize single string or array of strings. + * @param int $count Minimum number of arguments. + * @return boolean if $args contains at least $count arguments. + */ + protected function minimum_args( $args, $count ) { + if ( count( $args ) < $count ) { + $this->error = new IXR_Error( 400, __( 'Insufficient arguments passed to this XML-RPC method.' ) ); + return false; + } + + return true; + } + /** * Prepares taxonomy data for return in an XML-RPC object. * @@ -766,6 +784,9 @@ class wp_xmlrpc_server extends IXR_Server { * @return string post_id */ function wp_newPost( $args ) { + if ( ! $this->minimum_args( $args, 4 ) ) + return $this->error; + $this->escape( $args ); $blog_id = (int) $args[0]; @@ -1038,6 +1059,9 @@ class wp_xmlrpc_server extends IXR_Server { * @return true on success */ function wp_editPost( $args ) { + if ( ! $this->minimum_args( $args, 5 ) ) + return $this->error; + $this->escape( $args ); $blog_id = (int) $args[0]; @@ -1090,6 +1114,9 @@ class wp_xmlrpc_server extends IXR_Server { * @return true on success */ function wp_deletePost( $args ) { + if ( ! $this->minimum_args( $args, 4 ) ) + return $this->error; + $this->escape( $args ); $blog_id = (int) $args[0]; @@ -1163,6 +1190,9 @@ class wp_xmlrpc_server extends IXR_Server { * - 'enclosure' */ function wp_getPost( $args ) { + if ( ! $this->minimum_args( $args, 4 ) ) + return $this->error; + $this->escape( $args ); $blog_id = (int) $args[0]; @@ -1217,6 +1247,9 @@ class wp_xmlrpc_server extends IXR_Server { * @return array contains a collection of posts. */ function wp_getPosts( $args ) { + if ( ! $this->minimum_args( $args, 3 ) ) + return $this->error; + $this->escape( $args ); $blog_id = (int) $args[0]; @@ -1303,6 +1336,9 @@ class wp_xmlrpc_server extends IXR_Server { * @return string term_id */ function wp_newTerm( $args ) { + if ( ! $this->minimum_args( $args, 4 ) ) + return $this->error; + $this->escape( $args ); $blog_id = (int) $args[0]; @@ -1387,6 +1423,9 @@ class wp_xmlrpc_server extends IXR_Server { * @return bool True, on success. */ function wp_editTerm( $args ) { + if ( ! $this->minimum_args( $args, 5 ) ) + return $this->error; + $this->escape( $args ); $blog_id = (int) $args[0]; @@ -1476,6 +1515,9 @@ class wp_xmlrpc_server extends IXR_Server { * @return boolean|IXR_Error If it suceeded true else a reason why not */ function wp_deleteTerm( $args ) { + if ( ! $this->minimum_args( $args, 5 ) ) + return $this->error; + $this->escape( $args ); $blog_id = (int) $args[0]; @@ -1540,6 +1582,9 @@ class wp_xmlrpc_server extends IXR_Server { * - 'count' */ function wp_getTerm( $args ) { + if ( ! $this->minimum_args( $args, 5 ) ) + return $this->error; + $this->escape( $args ); $blog_id = (int) $args[0]; @@ -1590,6 +1635,9 @@ class wp_xmlrpc_server extends IXR_Server { * @return array terms */ function wp_getTerms( $args ) { + if ( ! $this->minimum_args( $args, 4 ) ) + return $this->error; + $this->escape( $args ); $blog_id = (int) $args[0]; @@ -1662,6 +1710,9 @@ class wp_xmlrpc_server extends IXR_Server { * @return array (@see get_taxonomy()) */ function wp_getTaxonomy( $args ) { + if ( ! $this->minimum_args( $args, 4 ) ) + return $this->error; + $this->escape( $args ); $blog_id = (int) $args[0]; @@ -1703,6 +1754,9 @@ class wp_xmlrpc_server extends IXR_Server { * @return array taxonomies */ function wp_getTaxonomies( $args ) { + if ( ! $this->minimum_args( $args, 3 ) ) + return $this->error; + $this->escape( $args ); $blog_id = (int) $args[0]; @@ -3009,6 +3063,9 @@ class wp_xmlrpc_server extends IXR_Server { * - 'supports' */ function wp_getPostType( $args ) { + if ( ! $this->minimum_args( $args, 4 ) ) + return $this->error; + $this->escape( $args ); $blog_id = (int) $args[0]; @@ -3052,6 +3109,9 @@ class wp_xmlrpc_server extends IXR_Server { * @return array */ function wp_getPostTypes( $args ) { + if ( ! $this->minimum_args( $args, 3 ) ) + return $this->error; + $this->escape( $args ); $blog_id = (int) $args[0];