From brad8711 at gmail.com  Sun Dec 23 22:41:02 2012
From: brad8711 at gmail.com (Bradly Swart)
Date: Mon, 24 Dec 2012 09:41:02 +1100
Subject: [wp-xmlrpc] Hidden Custom Fields - Ruby
Message-ID: <CACcBMOMRVvBozc619BA3K_48UR7B4yU8pBCAmZE0gf=mP433zg@mail.gmail.com>

Hi List,

I've been putting around the net over the past few days figuring out how to
get xmlrpc working with ruby. I'm trying to do some programmatic insertion
of products into a WooCommerce site. Running the latest version of
Wordpress. I've read some stuff on add_post_meta() but hasnt helped.

I've managed to get the posting working, as well as custom fields, the
problem has come in with hidden fields. In the snippet bellow product_url
works fine, _sku doesn't

snippet as part of the post content:
-------------------------------------------------------------------------------------------------------------------------
'custom_fields' => [{'key' => 'product_url', 'value' => '
http://mysite.com?rsid=9999'},
                      {'key' => "_sku", 'value' =>  '9999'}]
-------------------------------------------------------------------------------------------------------------------------

XMLRPC Call:
-------------------------------------------------------------------------------------------------------------------------
post_id = connection.call(
  'metaWeblog.newPost',
  1,
  'user',
  'password',
  post,
  true
)
-------------------------------------------------------------------------------------------------------------------------

Hoping someone can help me out.

Bradly Swart

Mobile: +61447068962
Skype: bradly.swart
Twitter: @brad8711 <http://twitter.com/brad8711>
linkedIn: http://za.linkedin.com/in/bradlyswart
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.automattic.com/pipermail/wp-xmlrpc/attachments/20121224/c0cd8e21/attachment.htm>

From mailing at markoheijnen.nl  Sun Dec 23 22:54:49 2012
From: mailing at markoheijnen.nl (Marko Heijnen)
Date: Sun, 23 Dec 2012 23:54:49 +0100
Subject: [wp-xmlrpc] Hidden Custom Fields - Ruby
In-Reply-To: <CACcBMOMRVvBozc619BA3K_48UR7B4yU8pBCAmZE0gf=mP433zg@mail.gmail.com>
References: <CACcBMOMRVvBozc619BA3K_48UR7B4yU8pBCAmZE0gf=mP433zg@mail.gmail.com>
Message-ID: <40E81CE1-CAD9-4DBA-B0FA-58B34449FF99@markoheijnen.nl>

Hey Bradly,

You can't modify hidden fields trough the XMLRPC. Since it is considered protected. You can however whitelist those fields by using register_meta().
I never used it myself and there isn't a codex page for, so you do need to look in the core for how it works. Some information can be found on trac: http://core.trac.wordpress.org/ticket/19919

Marko

Op 23 dec. 2012, om 23:41 heeft Bradly Swart <brad8711 at gmail.com> het volgende geschreven:

> Hi List,
> 
> I've been putting around the net over the past few days figuring out how to get xmlrpc working with ruby. I'm trying to do some programmatic insertion of products into a WooCommerce site. Running the latest version of Wordpress. I've read some stuff on add_post_meta() but hasnt helped.
> 
> I've managed to get the posting working, as well as custom fields, the problem has come in with hidden fields. In the snippet bellow product_url works fine, _sku doesn't
> 
> snippet as part of the post content:
> -------------------------------------------------------------------------------------------------------------------------
> 'custom_fields' => [{'key' => 'product_url', 'value' => 'http://mysite.com?rsid=9999'},
>                       {'key' => "_sku", 'value' =>  '9999'}]
> -------------------------------------------------------------------------------------------------------------------------
> 
> XMLRPC Call:
> -------------------------------------------------------------------------------------------------------------------------
> post_id = connection.call(
>   'metaWeblog.newPost',
>   1,
>   'user',
>   'password',
>   post,
>   true
> )
> -------------------------------------------------------------------------------------------------------------------------
> 
> Hoping someone can help me out.
> 
> Bradly Swart
> 
> Mobile: +61447068962
> Skype: bradly.swart
> Twitter: @brad8711
> linkedIn: http://za.linkedin.com/in/bradlyswart
> _______________________________________________
> wp-xmlrpc mailing list
> wp-xmlrpc at lists.automattic.com
> http://lists.automattic.com/mailman/listinfo/wp-xmlrpc

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.automattic.com/pipermail/wp-xmlrpc/attachments/20121223/6e2a2616/attachment.htm>

From wp at andrewnacin.com  Sun Dec 23 22:58:37 2012
From: wp at andrewnacin.com (Andrew Nacin)
Date: Sun, 23 Dec 2012 17:58:37 -0500
Subject: [wp-xmlrpc] Hidden Custom Fields - Ruby
In-Reply-To: <40E81CE1-CAD9-4DBA-B0FA-58B34449FF99@markoheijnen.nl>
References: <CACcBMOMRVvBozc619BA3K_48UR7B4yU8pBCAmZE0gf=mP433zg@mail.gmail.com>
	<40E81CE1-CAD9-4DBA-B0FA-58B34449FF99@markoheijnen.nl>
Message-ID: <CAP29PvjEjDcs02CSe4+KCAteKo6PmFkWTYxAs9R5RtzC4K=3Vw@mail.gmail.com>

On Sun, Dec 23, 2012 at 5:54 PM, Marko Heijnen <mailing at markoheijnen.nl>wrote:

> Hey Bradly,
>
> You can't modify hidden fields trough the XMLRPC. Since it is considered
> protected. You can however whitelist those fields by using register_meta().
> I never used it myself and there isn't a codex page for, so you do need to
> look in the core for how it works. Some information can be found on trac:
> http://core.trac.wordpress.org/ticket/19919
>

Rather, you can modify any fields that are not considered "protected". The
default rule for this is whether it starts with an underscore.

You can adjust this by, as Marko says, using register_meta() with an
auth_callback, or by simply using the is_protected_meta filter.

Nacin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.automattic.com/pipermail/wp-xmlrpc/attachments/20121223/72939944/attachment.htm>

From brad8711 at gmail.com  Sun Dec 23 22:59:18 2012
From: brad8711 at gmail.com (Bradly Swart)
Date: Mon, 24 Dec 2012 09:59:18 +1100
Subject: [wp-xmlrpc] Hidden Custom Fields - Ruby
In-Reply-To: <40E81CE1-CAD9-4DBA-B0FA-58B34449FF99@markoheijnen.nl>
References: <CACcBMOMRVvBozc619BA3K_48UR7B4yU8pBCAmZE0gf=mP433zg@mail.gmail.com>
	<40E81CE1-CAD9-4DBA-B0FA-58B34449FF99@markoheijnen.nl>
Message-ID: <CACcBMOPKy8FUW87s1kvcA6FNj-ofgj6QMd-Uj2P8ZASUqigvtg@mail.gmail.com>

Yea, I had a look at that, I couldn't figure out how to call it from a Ruby
xmlrpc call though :/

Bradly Swart

Mobile: +61447068962
Skype: bradly.swart
Twitter: @brad8711 <http://twitter.com/brad8711>
linkedIn: http://za.linkedin.com/in/bradlyswart


On Mon, Dec 24, 2012 at 9:54 AM, Marko Heijnen <mailing at markoheijnen.nl>wrote:

> Hey Bradly,
>
> You can't modify hidden fields trough the XMLRPC. Since it is considered
> protected. You can however whitelist those fields by using register_meta().
> I never used it myself and there isn't a codex page for, so you do need to
> look in the core for how it works. Some information can be found on trac:
> http://core.trac.wordpress.org/ticket/19919
>
> Marko
>
> Op 23 dec. 2012, om 23:41 heeft Bradly Swart <brad8711 at gmail.com> het
> volgende geschreven:
>
> Hi List,
>
> I've been putting around the net over the past few days figuring out how
> to get xmlrpc working with ruby. I'm trying to do
> some programmatic insertion of products into a WooCommerce site. Running
> the latest version of Wordpress. I've read some stuff on add_post_meta()
> but hasnt helped.
>
> I've managed to get the posting working, as well as custom fields, the
> problem has come in with hidden fields. In the snippet bellow product_url
> works fine, _sku doesn't
>
> snippet as part of the post content:
>
> -------------------------------------------------------------------------------------------------------------------------
> 'custom_fields' => [{'key' => 'product_url', 'value' => '
> http://mysite.com?rsid=9999' <http://mysite.com/?rsid=9999'>},
>                       {'key' => "_sku", 'value' =>  '9999'}]
>
> -------------------------------------------------------------------------------------------------------------------------
>
> XMLRPC Call:
>
> -------------------------------------------------------------------------------------------------------------------------
> post_id = connection.call(
>   'metaWeblog.newPost',
>   1,
>   'user',
>   'password',
>   post,
>   true
> )
>
> -------------------------------------------------------------------------------------------------------------------------
>
> Hoping someone can help me out.
>
> Bradly Swart
>
> Mobile: +61447068962
> Skype: bradly.swart
> Twitter: @brad8711 <http://twitter.com/brad8711>
> linkedIn: http://za.linkedin.com/in/bradlyswart
>  _______________________________________________
> wp-xmlrpc mailing list
> wp-xmlrpc at lists.automattic.com
> http://lists.automattic.com/mailman/listinfo/wp-xmlrpc
>
>
>
> _______________________________________________
> wp-xmlrpc mailing list
> wp-xmlrpc at lists.automattic.com
> http://lists.automattic.com/mailman/listinfo/wp-xmlrpc
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.automattic.com/pipermail/wp-xmlrpc/attachments/20121224/3063658c/attachment.htm>

From wp at andrewnacin.com  Sun Dec 23 23:01:08 2012
From: wp at andrewnacin.com (Andrew Nacin)
Date: Sun, 23 Dec 2012 18:01:08 -0500
Subject: [wp-xmlrpc] Hidden Custom Fields - Ruby
In-Reply-To: <CACcBMOPKy8FUW87s1kvcA6FNj-ofgj6QMd-Uj2P8ZASUqigvtg@mail.gmail.com>
References: <CACcBMOMRVvBozc619BA3K_48UR7B4yU8pBCAmZE0gf=mP433zg@mail.gmail.com>
	<40E81CE1-CAD9-4DBA-B0FA-58B34449FF99@markoheijnen.nl>
	<CACcBMOPKy8FUW87s1kvcA6FNj-ofgj6QMd-Uj2P8ZASUqigvtg@mail.gmail.com>
Message-ID: <CAP29PvgqmCDgL_xc=QnvrJoJ+syPH5mvGbsydqMQh_rbdo2F9g@mail.gmail.com>

On Sun, Dec 23, 2012 at 5:59 PM, Bradly Swart <brad8711 at gmail.com> wrote:

> Yea, I had a look at that, I couldn't figure out how to call it from a
> Ruby xmlrpc call though :/
>

Right, you won't be able to. The point of protecting underscored meta
values was to prevent privilege escalation via XML-RPC ? basically, prevent
users from editing keys that they wouldn't be able to edit through the
admin.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.automattic.com/pipermail/wp-xmlrpc/attachments/20121223/20abafdc/attachment-0001.htm>

From brad8711 at gmail.com  Sun Dec 23 23:03:21 2012
From: brad8711 at gmail.com (Bradly Swart)
Date: Mon, 24 Dec 2012 10:03:21 +1100
Subject: [wp-xmlrpc] Hidden Custom Fields - Ruby
In-Reply-To: <CAP29PvgqmCDgL_xc=QnvrJoJ+syPH5mvGbsydqMQh_rbdo2F9g@mail.gmail.com>
References: <CACcBMOMRVvBozc619BA3K_48UR7B4yU8pBCAmZE0gf=mP433zg@mail.gmail.com>
	<40E81CE1-CAD9-4DBA-B0FA-58B34449FF99@markoheijnen.nl>
	<CACcBMOPKy8FUW87s1kvcA6FNj-ofgj6QMd-Uj2P8ZASUqigvtg@mail.gmail.com>
	<CAP29PvgqmCDgL_xc=QnvrJoJ+syPH5mvGbsydqMQh_rbdo2F9g@mail.gmail.com>
Message-ID: <CACcBMONj=Ps4iYpRorg0mkZqgp3cPwPOoroHjdFbsjYyW9-HPw@mail.gmail.com>

Well, that being said I'm kind of at the point of just writing to the table
manually through MySQL connection.

@Andrew, how can I add that filter to a xmlrpc request ?

Bradly Swart

Mobile: +61447068962
Skype: bradly.swart
Twitter: @brad8711 <http://twitter.com/brad8711>
linkedIn: http://za.linkedin.com/in/bradlyswart


On Mon, Dec 24, 2012 at 10:01 AM, Andrew Nacin <wp at andrewnacin.com> wrote:

> On Sun, Dec 23, 2012 at 5:59 PM, Bradly Swart <brad8711 at gmail.com> wrote:
>
>> Yea, I had a look at that, I couldn't figure out how to call it from a
>> Ruby xmlrpc call though :/
>>
>
> Right, you won't be able to. The point of protecting underscored meta
> values was to prevent privilege escalation via XML-RPC ? basically, prevent
> users from editing keys that they wouldn't be able to edit through the
> admin.
>
> _______________________________________________
> wp-xmlrpc mailing list
> wp-xmlrpc at lists.automattic.com
> http://lists.automattic.com/mailman/listinfo/wp-xmlrpc
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.automattic.com/pipermail/wp-xmlrpc/attachments/20121224/d5fa5106/attachment.htm>

From wp at andrewnacin.com  Sun Dec 23 23:08:28 2012
From: wp at andrewnacin.com (Andrew Nacin)
Date: Sun, 23 Dec 2012 18:08:28 -0500
Subject: [wp-xmlrpc] Hidden Custom Fields - Ruby
In-Reply-To: <CACcBMONj=Ps4iYpRorg0mkZqgp3cPwPOoroHjdFbsjYyW9-HPw@mail.gmail.com>
References: <CACcBMOMRVvBozc619BA3K_48UR7B4yU8pBCAmZE0gf=mP433zg@mail.gmail.com>
	<40E81CE1-CAD9-4DBA-B0FA-58B34449FF99@markoheijnen.nl>
	<CACcBMOPKy8FUW87s1kvcA6FNj-ofgj6QMd-Uj2P8ZASUqigvtg@mail.gmail.com>
	<CAP29PvgqmCDgL_xc=QnvrJoJ+syPH5mvGbsydqMQh_rbdo2F9g@mail.gmail.com>
	<CACcBMONj=Ps4iYpRorg0mkZqgp3cPwPOoroHjdFbsjYyW9-HPw@mail.gmail.com>
Message-ID: <CAP29Pvh01aFGgnzKC2LVaP8EQZ4tZy6j_NzLw6H=u=6DhU1=aA@mail.gmail.com>

On Sun, Dec 23, 2012 at 6:03 PM, Bradly Swart <brad8711 at gmail.com> wrote:

> Well, that being said I'm kind of at the point of just writing to the
> table manually through MySQL connection.
>
> @Andrew, how can I add that filter to a xmlrpc request ?
>

You can't. The whole point is to prevent an XML-RPC client from modify
content that a user may not be allowed to modify.

You can, however, just add a plugin. It'd be a very short plugin:

add_filter( 'is_protected_meta', function( $protected, $meta_key,
$meta_type ) {
    if ( 'post' == $meta_type && '_some_key' == $meta_key )
        return false;
    return $protected;
}, 10, 3 );
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.automattic.com/pipermail/wp-xmlrpc/attachments/20121223/5c90a2f8/attachment.htm>

From brad8711 at gmail.com  Sun Dec 23 23:20:03 2012
From: brad8711 at gmail.com (Bradly Swart)
Date: Mon, 24 Dec 2012 10:20:03 +1100
Subject: [wp-xmlrpc] Hidden Custom Fields - Ruby
In-Reply-To: <CAP29Pvh01aFGgnzKC2LVaP8EQZ4tZy6j_NzLw6H=u=6DhU1=aA@mail.gmail.com>
References: <CACcBMOMRVvBozc619BA3K_48UR7B4yU8pBCAmZE0gf=mP433zg@mail.gmail.com>
	<40E81CE1-CAD9-4DBA-B0FA-58B34449FF99@markoheijnen.nl>
	<CACcBMOPKy8FUW87s1kvcA6FNj-ofgj6QMd-Uj2P8ZASUqigvtg@mail.gmail.com>
	<CAP29PvgqmCDgL_xc=QnvrJoJ+syPH5mvGbsydqMQh_rbdo2F9g@mail.gmail.com>
	<CACcBMONj=Ps4iYpRorg0mkZqgp3cPwPOoroHjdFbsjYyW9-HPw@mail.gmail.com>
	<CAP29Pvh01aFGgnzKC2LVaP8EQZ4tZy6j_NzLw6H=u=6DhU1=aA@mail.gmail.com>
Message-ID: <CACcBMOMxKmCF+72-MbnsB2fu301DN=MuJXK-oyEYUKOH50zhTA@mail.gmail.com>

Right, looks like I have some work ahead of me :)

Thanks for the pointers guys :)

Bradly Swart

Mobile: +61447068962
Skype: bradly.swart
Twitter: @brad8711 <http://twitter.com/brad8711>
linkedIn: http://za.linkedin.com/in/bradlyswart


On Mon, Dec 24, 2012 at 10:08 AM, Andrew Nacin <wp at andrewnacin.com> wrote:

> On Sun, Dec 23, 2012 at 6:03 PM, Bradly Swart <brad8711 at gmail.com> wrote:
>
>> Well, that being said I'm kind of at the point of just writing to the
>> table manually through MySQL connection.
>>
>> @Andrew, how can I add that filter to a xmlrpc request ?
>>
>
> You can't. The whole point is to prevent an XML-RPC client from modify
> content that a user may not be allowed to modify.
>
> You can, however, just add a plugin. It'd be a very short plugin:
>
> add_filter( 'is_protected_meta', function( $protected, $meta_key,
> $meta_type ) {
>     if ( 'post' == $meta_type && '_some_key' == $meta_key )
>         return false;
>     return $protected;
> }, 10, 3 );
>
> _______________________________________________
> wp-xmlrpc mailing list
> wp-xmlrpc at lists.automattic.com
> http://lists.automattic.com/mailman/listinfo/wp-xmlrpc
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.automattic.com/pipermail/wp-xmlrpc/attachments/20121224/f3800db2/attachment.htm>