Add fix for broken publishing of private posts when using XML-RPC

Author: jklausa

WordPressKit/PostServiceRemoteXMLRPC.m

@@ -418,10 +418,6 @@ - (NSDictionary *)parametersWithRemotePost:(RemotePost *)post
         postParams[@"custom_fields"] = post.metadata;
     }
 
-    if (post.isStickyPost != nil) {
-        postParams[@"sticky"] = post.isStickyPost.boolValue ? @"true" : @"false";
-    }
-
     postParams[@"wp_page_parent_id"] = post.parentID ? post.parentID.stringValue : @"0";
 
     // Scheduled posts need to sync with a status of 'publish'.
@@ -433,6 +429,21 @@ - (NSDictionary *)parametersWithRemotePost:(RemotePost *)post
         post.status = PostStatusPublish;
     }
 
+    // At least as of 5.2.2, Private and/or Password Protected posts can't be stickied.
+    // However, the code used on the backend doesn't check the value of the `sticky` field,
+    // instead doing a simple `! empty( $post_data['sticky'] )` check.
+    //
+    // This means we have to omit this field entirely for those posts from the payload we're sending
+    // to the XML-RPC sevices.
+    //
+    // https://github.com/WordPress/WordPress/blob/master/wp-includes/class-wp-xmlrpc-server.php
+    //
+    BOOL shouldIncludeStickyField = ![post.status isEqualToString:PostStatusPrivate] && post.password == nil;
+
+    if (post.isStickyPost != nil && shouldIncludeStickyField) {
+        postParams[@"sticky"] = post.isStickyPost.boolValue ? @"true" : @"false";
+    }
+
     if ([post.type isEqualToString:@"page"]) {
         [postParams setObject:post.status forKey:@"page_status"];
     }