Skip to content

Commit 3767a6c

Browse files
adamsilversteinadamsilverstein
committed
REST API: Bind finalize sub-size file names to their sideload.
Fix an issue where the finalize endpoint stored the sub-size file names a client sent without confirming a sideloaded image had produced them for that attachment. Those names are later resolved against the attachment's upload directory and read or deleted, so finalize could record a file the upload never created. To address this, the sideload endpoint now records each name it generates under a `_wp_sideloaded_file` post meta key, and the finalize endpoint accepts a name only when: 1. a prior sideload recorded it in post meta, 2. it is the attachment's own attached file, or 3. it is already stored in the attachment's metadata. Anything else returns a `rest_invalid_sub_size_file` error (HTTP 400) before any metadata is written. Sideloads are also pinned to the attachment's own subdirectory via the `upload_dir` filter, so names are in the directory they later resolve against. Finalize stays safe to repeat: a name already in the attachment's metadata is accepted again. Follow-up to r61982, r62609. Reviewed by westonruter. Props westonruter. See #64804. git-svn-id: https://develop.svn.wordpress.org/trunk@63200 602fd350-edb4-49c9-b593-d223f7449a82
1 parent 193824c commit 3767a6c

3 files changed

Lines changed: 590 additions & 117 deletions

File tree

0 commit comments

Comments
 (0)