Posts from the xml-rpc blogapi get whatever is the default input format, which in a typical case is the same as for anonymous users - making it the most restrictive. At the same time, blogapi posting is typically performed by trusted users. Bad combination.
This patch produces a new option in the blogapi configuration, allowing adminstrators to select an input filter format for blogapi postings. This format will be checked against user's permissions at posting time, and the default format used if permission is not granted.
| Comment | File | Size | Author |
|---|---|---|---|
| #15 | blogapi-input-format-72414-15.patch | 3.89 KB | lifepillar |
| #9 | blogapi-input-format-72414-9.patch | 3.24 KB | lifepillar |
| #6 | blogapi-input-format-72414-6.patch | 2.75 KB | lifepillar |
| blogapi-format.patch | 3.24 KB | arru@boombox.se |
Comments
Comment #1
drummThe added for loop in the 5th hunk needs some work. Proper indentation, always use {}, and it looks like it should be a foreach.
The comments might need some work too. As a general rule, they should all be full sentences and properly capitalized.
The ternary in the first hunk is a bit hard to read, maybe it should be a a full if statement.
It looks like a choice of filter formats is removed in blogapi_mt_supported_text_filters(), I'm not sure that is the right thing to do.
Comment #2
drummIt looks like it is filters usable by anonymous only because the XML-RPC call (http://www.movabletype.org/siteuk/docs/mtmanual_programmatic.html#item_m...) doesn't contain any identifying information about the user, so permissions cannot be chacked at that time.
Comment #3
arru@boombox.se commentedBlogapi-clients format text a certain way, which has to be dealt with. Basically 3 options listed in increasing order of "goodness":
Note that 3. would take us back to square one with blogapi clients that do not support filter selection (Flock, Dashboard widgets to name just two). So the optimal solution would be combining 2. and 3. Actually I'm curious if there is even one single drupal admin running both blogapi and anonymous comments with the way it's working now. I'll check the comments on the code when time permits.
Comment #4
magico commentedComment #5
magico commentedI cannot test this. I'm moving to this queue so it an get some attention, and confirmation if this bug exists in the current development version.
Comment #6
lifepillar commentedPatch re-rolled for Drupal 6.x-dev. Please review.
Comment #7
john franklin commentedI love the Drupal community. More often than not, whenever I identify an issue with one of my Drupal sites, a quick search finds a module or a patch to fix it.
The input format madness was the latest. I've got the patch in #6 working on my site. (D6.19+PGSQL8.4) It applied cleanly and worked flawlessly.
Thanks for the patch!
Comment #9
lifepillar commentedMoving this issue to the Blog API project, as this module has been removed from core. Attached you find the (untested) patch for the latest dev code. Please review.
Comment #11
cweagans#9: blogapi-input-format-72414-9.patch queued for re-testing.
Comment #13
shane birley commentedI just noticed this and it is very annoying. Every post accepts the default input filter without any checks to other modules, settings, etc. It should have some sort of check against Better Formats or other related modules.
Comment #14
damienmckennatag.
Comment #15
lifepillar commentedPatch re-rolled for the latest dev code. There is some (new?) code in blogapi_mt_blogapi_post_alter() related to input formats, which this patch does not affect. That code seems fine for me, but it should be checked more carefully.
Comment #16
shane birley commentedDoes this module respect defaults established by non-core modules such as default modules (re: better_formats.module)?
Comment #17
cweagansFixing issue metadata. This will be included in the 2.x rewrite.
Comment #18
shane birley commented