Changeset 754

Timestamp:

12/13/06 21:44:05 (2 years ago)

Author:

misja

Message:

small blogger API fix, plus additional validation routine

Files:

• devel/units/rpc/lib/class_post.php (modified) (5 diffs)
• devel/units/rpc/xmlrpc/library_blogger_xmlrpc.php (modified) (4 diffs)

devel/units/rpc/lib/class_post.php

@@ -240 +240 @@
-        }
-
+        function validate($action = null)
+        {
+            // $action parameter currently not used
+        
+            // Get the weblog object
+            if (!isset($this->weblog))
+            {
+                // Get the weblog context
+                $this->weblog = run('weblogs:instance', array('user_id' => $this->owner,
+                                                              'blog_id' => $this->blog_id));
+            }
+
+            // Always post to your own blog :)
+            if ($this->weblog->community == false && $this->owner == $this->blog_id)
+            {
+                return true;
+            }
+
+            // A community can't post to itself
+            if ($this->weblog->community == true && $this->owner == $this->blog_id)
+            {
+                return false;
+            }
+
+            // Only a member or community owner can post to a community
+            if ($this->weblog->community == true)
+            {
+                if ($this->weblog->owner != $this->owner)
+                {
+                    // Not community owner, is it a member? 
+                    if ($result = get_records_sql('SELECT DISTINCT u.ident, 1 
+                                                   FROM elggfriends f JOIN elggusers u 
+                                                   ON u.ident = f.owner WHERE f.friend = ? 
+                                                   AND u.ident = ? ', 
+                                                   array($this->blog_id,$this->owner)))
+                    {
+                        // Memberships found
+                        return true;                        
+                    }
+                    else
+                    {
+                        // Not a friend, nor owner, deny this save
+                        return false;
+                    }
+                }
+                else
+                {
+                    return true;
+                }
+            }
+        }
+
-        /**
-         *
@@ -245 +297 @@
-        function delete()
-        {
+            if (!this->validate('delete'))
+            {
+                return false;
+            }
+
-            if ($this->exists)
-            {
@@ -275 +332 @@
-        function save()
-        {
+            if (!$this->validate('save'))
+            {
+                return false;
+            }
+            
-            $wp = new StdClass;
-            $wp->title = $this->title;
@@ -280 +342 @@
-            $wp->access = $this->access;
-            $wp->ident = $this->ident;
+
-            if ($this->exists == true)
-            {
-                // Check ownership
-                if ($this->weblog->isOwner() != true)
-                {
-                    // Not weblog owner, check at post level
-                    if ($this->owner != $this->weblog->getOwner())
-                    {
-                        return false;
-                    }
-                }
-
-                if (update_record('weblog_posts',$wp)) {
-                    $rssresult = run("weblogs:rss:publish", array($this->owner, false));
@@ -301 +354 @@
-            else
-            {
+                // Post doesn't exist
+
-                $wp->weblog = $this->blog_id;
-                $wp->posted = time();
-                $wp->owner = $this->owner;
+
-                if ($this->ident = insert_record('weblog_posts',$wp)) {
-                    $this->exists = true;

devel/units/rpc/xmlrpc/library_blogger_xmlrpc.php

@@ -8 +8 @@
-    {
-        // Number of parameters
-
+            // Raise an XML-RPC error
-        
-        if ($method == "blogger.newPost")
@@ -46 +46 @@
-        }
-       
+        // Exit if no blogid provided
+        if ($blogid == "")
+        {
+            // Raise an XML-RPC error
+            return new IXR_Error(-32602, "No blog ID provided");
+        }
+
-        // Check credentials
-        $auth = run('rpc:auth', array("username" => $username,
-                                      "password" => $password));
-       
-        if ($auth['status'] == true)
-        {
@@ -84 +90 @@
-                //   (Boolean) mt_allow_comments (Elgg only handles this as a global and not per post option)
-                $post->setTitle($content['title']);
-               
+
-            }
-
@@ -90 +96 @@
-            $post->save();
-            
-
-
+ if request is metaWeblog
+$api != "blogger" && 
-            {
-                $keywords =  $content['mt_keywords'];