WP_REST_Attachments_Controller::validate_sub_size_provenance │ protected │ WP 7.1.0

Validates the sub_sizes file names against what this attachment produced.

The {@see self::finalize_item()} method stores the client-supplied file and original_image values in the attachment metadata, where they are later resolved within the attachment's upload directory and read or deleted (for example by wp_get_original_image_path(), wp_getimagesize(), and wp_delete_attachment_files()).

Every file the sideload endpoint creates is recorded under {@see self::META_KEY_SIDELOAD_FILE_NAME} as it is produced, using server-generated names. finalize accepts a file or original_image value only when it matches one of those recorded names (or the attachment's own attached file, which it definitionally owns).

Method of the class: WP_REST_Attachments_Controller{}

No Hooks.

Returns

true|WP_Error. True if every file name was produced here, WP_Error otherwise.

Usage

// protected - for code of main (parent) or child class
$result = $this->validate_sub_size_provenance( $attachment_id, $sub_sizes );

$attachment_id(int) (required)

The attachment being finalized.

$sub_sizes(array) (required)

Sub-size metadata collected from sideloads.

Changelog

WP_REST_Attachments_Controller::validate_sub_size_provenance() WP REST Attachments Controller::validate sub size provenance code ^{WP 7.1}

protected function validate_sub_size_provenance( int $attachment_id, array $sub_sizes ) {
	$allowed = $this->get_sideloaded_file_names( $attachment_id );

	foreach ( $sub_sizes as $sub_size ) {
		foreach ( array( 'file', 'original_image' ) as $key ) {
			/*
			 * Every value that was sent is checked, no matter how unlikely
			 * a name it looks. A loose emptiness test would wave through
			 * '0', which is a valid one-character name as far as the schema
			 * is concerned and is stored like any other. A value the schema
			 * types as a string but which arrives as something else is
			 * rejected rather than skipped, so a subclass which widens the
			 * schema cannot pass an unchecked value on to the metadata.
			 */
			if ( ! isset( $sub_size[ $key ] ) ) {
				continue;
			}

			if ( ! is_string( $sub_size[ $key ] ) || ! in_array( $sub_size[ $key ], $allowed, true ) ) {
				return new WP_Error(
					'rest_invalid_sub_size_file',
					__( 'Invalid sub-size file name. File names must have been produced by a prior sideload for this attachment.' ),
					array( 'status' => 400 )
				);
			}
		}
	}

	return true;
}