Ticket #40153: 40153.2.diff

src/wp-admin/includes/file.php

@@ -978 +978 @@
  *
  * @since 2.5.0
  * @since 5.2.0 Signature Verification with SoftFail was added.
+ * @since 5.3.0 Introduced `download_url_remote_get_args` filter.
  *
  * @param string $url                    The URL of the file to download.
  * @param int    $timeout                The timeout for the request to download the file. Default 300 seconds.
@@ -997 +998 @@
                 return new WP_Error( 'http_no_file', __( 'Could not create Temporary file.' ) );
         }
 
-        $response = wp_safe_remote_get(
-                $url,
-                array(
-                        'timeout'  => $timeout,
-                        'stream'   => true,
-                        'filename' => $tmpfname,
-                )
+        /**
+         * Filters the HTTP request arguments in `download_url`.
+         * 
+         * @since 5.3.0
+         * 
+         * @see wp_safe_remote_get()
+         * 
+         * @param array  $upload                 Array of HTTP request arguments. `timeout`, `stream`, and `filename` cant be overridden.
+         * @param string $url                    The URL of the file to download.
+         * @param bool   $signature_verification Whether to perform Signature Verification. Default false.
+         * */
+        $remote_get_args = apply_filters( 'download_url_remote_get_args', array(), $url, $signature_verification );
+
+        $default_remote_get_args = array(
+                'timeout'  => $timeout,
+                'stream'   => true,
+                'filename' => $tmpfname,
         );
 
+        // Prevent the {@see 'download_url_remote_get_args'} to override default arguments.
+        foreach( $default_remote_get_args as $default_arg_key => $default_arg_value ) {
+                if ( isset( $remote_get_args[$default_arg_key] ) ) {
+                        unset( $remote_get_args[$default_arg_key] );
+                }
+        }
+
+        $remote_get_args = array_merge( $default_remote_get_args, $remote_get_args );
+
+        $response = wp_safe_remote_get( $url, $remote_get_args );
+
         if ( is_wp_error( $response ) ) {
                 unlink( $tmpfname );
                 return $response;