Changeset 48498 for trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php

Timestamp:

07/16/2020 09:54:37 PM (5 years ago)

Author:

azaozz

Message:

REST API: Prevent attachment ID/image source mismatch when editing an image.

Fixes #50565.

File:

• trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php (modified) (2 diffs)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php

@@ -422 +422 @@
         $image_meta = wp_get_attachment_metadata( $attachment_id );
 
-        if ( ! $image_meta || ! $image_file ) {
+        if (
+            ! $image_meta ||
+            ! $image_file ||
+            ! wp_image_file_matches_image_meta( $request['src'], $image_meta )
+        ) {
             return new WP_Error(
                 'rest_unknown_attachment',
@@ -1290 +1294 @@
                 'maximum'     => 100,
             ),
+            'src'      => array(
+                'description' => __( 'URL to the edited image file.' ),
+                'type'        => 'string',
+                'format'      => 'uri',
+                'required'    => true,
+            ),
         );
     }