Changeset 43773

Timestamp:

10/19/2018 06:52:31 PM (6 years ago)

Author:

danielbachhuber

Message:

REST API: Limit the scope of wp-admin files required in WP_REST_Attachments_Controller methods.

Narrow the scope of the included wp-admin files loaded for wp_generate_attachment_metadata(), wp_handle_upload(), wp_tempnam(), and wp_handle_sideload(). Requires only wp-admin/includes/file.php and wp-admin/includes/image.php instead of wp-admin/includes/admin.php.

Props ocean90, lonelyvegan, soulseekah, pratikthink.
Merges [43589], [43604] to the 5.0 branch.
Fixes #43757.

Location:

branches/5.0

Files:

• . (modified) (1 prop)
• src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php (modified) (4 diffs)

branches/5.0/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php

@@ -122 +122 @@
         $type    = $file['type'];
         $file    = $file['file'];
+
+        // Include image functions to get access to wp_read_image_metadata().
+        require_once ABSPATH . 'wp-admin/includes/image.php';
 
         // use image exif/iptc data for title and caption defaults if possible
@@ -170 +173 @@
         do_action( 'rest_insert_attachment', $attachment, $request, true );
 
-        // Include admin functions to get access to wp_generate_attachment_metadata().
-        require_once ABSPATH . 'wp-admin/includes/admin.php';
+        // Include admin function to get access to wp_generate_attachment_metadata().
+        require_once ABSPATH . 'wp-admin/includes/image.php';
 
         wp_update_attachment_metadata( $id, wp_generate_attachment_metadata( $id, $file ) );
@@ -558 +561 @@
         $type = array_shift( $headers['content_type'] );
 
-        /** Include admin functions to get access to wp_tempnam() and wp_handle_sideload() */
-        require_once ABSPATH . 'wp-admin/includes/admin.php';
+        /** Include admin functions to get access to wp_tempnam() and wp_handle_sideload(). */
+        require_once ABSPATH . 'wp-admin/includes/file.php';
 
         // Save the file.
@@ -758 +761 @@
         }
 
-        /** Include admin functions to get access to wp_handle_upload() */
-        require_once ABSPATH . 'wp-admin/includes/admin.php';
+        /** Include admin function to get access to wp_handle_upload(). */
+        require_once ABSPATH . 'wp-admin/includes/file.php';
 
         $file = wp_handle_upload( $files['file'], $overrides );