From b9316d1e80d6267d60c83c1e0fc8b405ec63a39a Mon Sep 17 00:00:00 2001
From: ryan <ryan@1a063a9b-81f0-0310-95a4-ce76da25c4cd>
Date: Mon, 4 Feb 2008 18:35:05 +0000
Subject: [PATCH] More cap checks from josephscott. see #5313

git-svn-id: http://svn.automattic.com/wordpress/trunk@6714 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 xmlrpc.php | 64 +++++++++++++++++++++++++++++++++---------------------
 1 file changed, 39 insertions(+), 25 deletions(-)

diff --git a/xmlrpc.php b/xmlrpc.php
index e1834ab06c..9e918ef10e 100644
--- a/xmlrpc.php
+++ b/xmlrpc.php
@@ -1128,21 +1128,30 @@ class wp_xmlrpc_server extends IXR_Server {
 		if (!$this->login_pass_ok($user_login, $user_pass)) {
 			return $this->error;
 		}
+		$user = set_current_user(0, $user_login);
 
 		do_action('xmlrpc_call', 'metaWeblog.newPost');
 
-		$cap = ($publish) ? 'publish_posts' : 'edit_posts';
-		$user = set_current_user(0, $user_login);
-		if ( !current_user_can($cap) )
-			return new IXR_Error(401, __('Sorry, you are not allowed to post on this blog.'));
+		$cap = ( $publish ) ? 'publish_posts' : 'edit_posts';
+		$error_message = __( 'Sorry, you are not allowed to publish posts on this blog.' );
+		$post_type = 'post';
+		if( !empty( $content_struct['post_type'] ) ) {
+			if( $content_struct['post_type'] == 'page' ) {
+				$cap = ( $publish ) ? 'publish_pages' : 'edit_pages';
+				$error_message = __( 'Sorry, you are not allowed to publish pages on this blog.' );
+				$post_type = 'page';
+			}
+			elseif( $content_type['post_type'] == 'post' ) {
+				// This is the default, no changes needed
+			}
+			else {
+				// No other post_type values are allowed here
+				return new IXR_Error( 401, __( 'Invalid post type.' ) );
+			}
+		}
 
-		// The post_type defaults to post, but could also be page.
-		$post_type = "post";
-		if(
-			!empty($content_struct["post_type"])
-			&& ($content_struct["post_type"] == "page")
-		) {
-			$post_type = "page";
+		if( !current_user_can( $cap ) ) {
+			return new IXR_Error( 401, $error_message );
 		}
 
 		// Let WordPress generate the post_name (slug) unless
@@ -1368,26 +1377,31 @@ class wp_xmlrpc_server extends IXR_Server {
 		if (!$this->login_pass_ok($user_login, $user_pass)) {
 			return $this->error;
 		}
+		$user = set_current_user(0, $user_login);
 
 		do_action('xmlrpc_call', 'metaWeblog.editPost');
 
-		$user = set_current_user(0, $user_login);
-
-		// The post_type defaults to post, but could also be page.
-		$post_type = "post";
-		if(
-			!empty($content_struct["post_type"])
-			&& ($content_struct["post_type"] == "page")
-		) {
-			if( !current_user_can( 'edit_page', $post_ID ) ) {
-				return(new IXR_Error(401, __("Sorry, you do not have the right to edit this page.")));
+		$cap = ( $publish ) ? 'publish_posts' : 'edit_posts';
+		$error_message = __( 'Sorry, you are not allowed to publish posts on this blog.' );
+		$post_type = 'post';
+		if( !empty( $content_struct['post_type'] ) ) {
+			if( $content_struct['post_type'] == 'page' ) {
+				$cap = ( $publish ) ? 'publish_pages' : 'edit_pages';
+				$error_message = __( 'Sorry, you are not allowed to publish pages on this blog.' );
+				$post_type = 'page';
+			}
+			elseif( $content_type['post_type'] == 'post' ) {
+				// This is the default, no changes needed
+			}
+			else {
+				// No other post_type values are allowed here
+				return new IXR_Error( 401, __( 'Invalid post type.' ) );
 			}
-
-			$post_type = "page";
 		}
 
-		if ( ( 'post' == $post_type ) && !current_user_can('edit_post', $post_ID) )
-			return new IXR_Error(401, __('Sorry, you can not edit this post.'));
+		if( !current_user_can( $cap ) ) {
+			return new IXR_Error( 401, $error_message );
+		}
 
 		$postdata = wp_get_single_post($post_ID, ARRAY_A);