A thing you should know when deleting posts using the Tumblr API

Like every curious developer out there, I like playing with APIs: Google Maps’, Facebook’s, Twitter’s and, currently, Tumblr’s. I’m trying to write a decent importer from WordPress to Tumblr so I spend a lot of time with the Tumblr API and its docs.
I stumbled upon a peculiar problem with the delete method from the API, which I want to share with you.

You can read how to delete posts by going here – http://www.tumblr.com/docs/en/api#deleting_posts. It says (to save you from clicking and reading):

Deleting posts

To edit a post, create the authenticated /api/write request as described above, but POST to http://www.tumblr.com/api/delete instead, and pass an additional POST parameter:

  • post-id – The integer ID of the post you wish to delete.

All content-related parameters will be ignored and can be omitted. Only the authentication parameters and post-id are required.

It has a typo (the first sentence should be “To delete a post…”), but that’s not the problem. I went ahead and implemented it, naming the file delete.php. Here it is:

$request_data = http_build_query(
  array(
    'email' => $email,
    'password' => $pass,
    'post-id' => $post_id,
  )
);
// Send the POST request (with cURL)
$c = curl_init('http://www.tumblr.com/api/delete');
curl_setopt($c, CURLOPT_POST, true);
curl_setopt($c, CURLOPT_POSTFIELDS, $request_data);
curl_setopt($c, CURLOPT_RETURNTRANSFER, true);
$result = curl_exec($c);
$status = curl_getinfo($c, CURLINFO_HTTP_CODE);
curl_close($c);
echo "<br/>$result";

Where the $email and $pass variables hold my credentials for the Tumblr blog and $post_id is the id of the post I wanted to delete (a test one). And when I opened wp2t.dev.jiapps.com/delete.php (don’t try it – it won’t work) it really deleted my post. But that was not all it did. It also created 2 new ones. They just appeared out of nowhere. At least that’s what I thought then.

I kept the delete.php file in the same folder as the importer I was working on. Its “main” file is named index.php. Other than residing in the same folder, the delete.php file and the importer have nothing else in common.

So long story short, it seems that after the API method deletes a post, it calls the script residing in the folder which contains your script (the one using the delete method from the API) instead of calling the script itself. In other words, if your script name is *not* index.php and you do have a script called index.php in the same folder, it gets called instead of your script. I tested it by creating an index.php file containing just this:

<?php
file_put_contents('log.txt', "test...\n", FILE_APPEND);

And after I ran delete.php, I got a “test…” line in my log.txt file. Every time. The good news is – my importer works (to some extent) and creates posts. Mistery solved.

The moral of the story? Be careful where you put the call to the delete method, or it might bite you on the ass.

 

P.S. Please note that the above bug or whatever you wanna call it may be fixed or changed anytime, so don’t depend on it in your projects. I am currently waiting for a response from Tumblr support about a ticket on this subject, so it may get resolved quickly making this article obsolete. That would only make me happy – I would be glad if I am the reason one of my favorite services improves!