Merge pull request #165 from wordpress-mobile/feature/fix-publishing-private-xmlrpc-posts

Fix publishing private XML-RPC posts.

Author: jklausa

WordPressKit.podspec

@@ -1,6 +1,6 @@
 Pod::Spec.new do |s|
   s.name          = "WordPressKit"
-  s.version       = "4.2.0-beta.2"
+  s.version       = "4.2.0-beta.3"
   s.summary       = "WordPressKit offers a clean and simple WordPress.com and WordPress.org API."
 
   s.description   = <<-DESC

WordPressKit/PostServiceRemoteXMLRPC.m

@@ -418,10 +418,6 @@ - (NSDictionary *)parametersWithRemotePost:(RemotePost *)post
         postParams[@"custom_fields"] = post.metadata;
     }
 
-    if (post.isStickyPost != nil) {
-        postParams[@"sticky"] = post.isStickyPost.boolValue ? @"true" : @"false";
-    }
-
     postParams[@"wp_page_parent_id"] = post.parentID ? post.parentID.stringValue : @"0";
 
     // Scheduled posts need to sync with a status of 'publish'.
@@ -433,6 +429,21 @@ - (NSDictionary *)parametersWithRemotePost:(RemotePost *)post
         post.status = PostStatusPublish;
     }
 
+    // At least as of 5.2.2, Private and/or Password Protected posts can't be stickied.
+    // However, the code used on the backend doesn't check the value of the `sticky` field,
+    // instead doing a simple `! empty( $post_data['sticky'] )` check.
+    //
+    // This means we have to omit this field entirely for those posts from the payload we're sending
+    // to the XML-RPC sevices.
+    //
+    // https://github.com/WordPress/WordPress/blob/master/wp-includes/class-wp-xmlrpc-server.php
+    //
+    BOOL shouldIncludeStickyField = ![post.status isEqualToString:PostStatusPrivate] && post.password == nil;
+
+    if (post.isStickyPost != nil && shouldIncludeStickyField) {
+        postParams[@"sticky"] = post.isStickyPost.boolValue ? @"true" : @"false";
+    }
+
     if ([post.type isEqualToString:@"page"]) {
         [postParams setObject:post.status forKey:@"page_status"];
     }