Admin Ajax actions should pass relevant global variables

[filosofo]

The wp_ajax_* action hooks should pass the global $_REQUEST variable so that callbacks can reduce the number of global objects they have to be aware of and so that they can get the data in a state prior to being modified by anything else.

[filosofo]

Why not 2.9. It's simple and there are no backwards-compatibility issues. :-)

[azaozz]

-1. Don't see the benefit in doing this. If you have a function that accepts data from different contexts, you would always want to filter what comes from $_REQUEST.

[filosofo]

Replying to azaozz:

-1. Don't see the benefit in doing this.

The benefit is

• You don't have to access global objects in your callback
• You can be agnostic about whether the "action" is from POST or GET.
• Testing is more straightforward.
• There's no harm.

This helps avoid having to check whether "action" is set in POST or GET, and it allows code reuse: I can use the same callback in different places.

[westi]

Strong -1

It should be obvious inside a function when you are accessing a superglobal.

Passing $_REQUEST as a argument hides the use of the superglobal in the function.

That makes it much easier to audit code and identify where user supplied data is/isnt being trusted.

## Summary

Builds on #11015. Adds dimension validation to the sideload endpoint.

• Adds validate_image_dimensions() private method to WP_REST_Attachments_Controller
• Validates uploaded image dimensions against expected size constraints in the wp/v2/media/<id>/sideload endpoint
• Moves wp_getimagesize() call earlier in sideload_item() to validate before metadata handling

### Validation rules:

• 'original' size: must match original attachment dimensions exactly
• 'full' and 'scaled' sizes: requires positive dimensions only
• Regular sizes: dimensions must not exceed registered size maximums (with 1px tolerance for rounding differences)

## Test plan

• [x] test_sideload_item_rejects_oversized_dimensions — uploads 640x480 image as thumbnail (150x150), expects 400 with rest_upload_dimension_mismatch
• [x] test_sideload_item_accepts_valid_dimensions — uploads 50x50 image as thumbnail, expects 200

Corresponding Gutenberg PR: ​https://github.com/WordPress/gutenberg/pull/74903

🤖 Generated with ​Claude Code

This worked well in my manual testing.