From 362ef00fc44dbdbd118a630c6e632fde03984bfd Mon Sep 17 00:00:00 2001
From: Ryan Boren <ryan@git.wordpress.org>
Date: Mon, 13 Feb 2012 21:01:55 +0000
Subject: [PATCH] Disallow changing the post type in mw_editPost(). see #18429

git-svn-id: https://develop.svn.wordpress.org/trunk@19914 602fd350-edb4-49c9-b593-d223f7449a82
---
 wp-includes/class-wp-xmlrpc-server.php | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/wp-includes/class-wp-xmlrpc-server.php b/wp-includes/class-wp-xmlrpc-server.php
index 9bc70c808d..5fd31231fe 100644
--- a/wp-includes/class-wp-xmlrpc-server.php
+++ b/wp-includes/class-wp-xmlrpc-server.php
@@ -3168,6 +3168,14 @@ class wp_xmlrpc_server extends IXR_Server {
 		if ( ! current_user_can( 'edit_post', $post_ID ) )
 			return new IXR_Error( 401, __( 'Sorry, you do not have the right to edit this post.' ) );
 
+		// Use wp.editPost to edit post types other than post and page.
+		if ( ! in_array( $postdata[ 'post_type' ], array( 'post', 'page' ) ) )
+			return new IXR_Error( 401, __( 'Invalid post type.' ) );
+
+		// Thwart attempt to change the post type.
+		if ( ! empty( $content_struct[ 'post_type' ] ) && ( $content_struct['post_type'] != $postdata[ 'post_type' ] ) )
+			return new IXR_Error( 401, __( 'The post type may not be changed.' ) );
+
 		// Check for a valid post format if one was given
 		if ( isset( $content_struct['wp_post_format'] ) ) {
 			$content_struct['wp_post_format'] = sanitize_key( $content_struct['wp_post_format'] );
@@ -3197,6 +3205,9 @@ class wp_xmlrpc_server extends IXR_Server {
 		if ( isset($content_struct['wp_page_order']) )
 			$menu_order = $content_struct['wp_page_order'];
 
+		if ( ! empty( $content_struct['wp_page_template'] ) && 'page' == $post_type )
+			$page_template = $content_struct['wp_page_template']; 
+
 		$post_author = $postdata['post_author'];
 
 		// Only set the post_author if one is set.