Prevent attachment ID/image source mismatch when editing an image through the REST API

[azaozz]

When editing an image from the Image block, it is possible that the attachment ID stored there may have changed. May happen after exporting then importing all posts to another website.

A new (in 5.5) function wp_image_file_matches_image_meta() was introduced in [48329] to prevent this edge case. To be able to use it, the editor has to also pass the edited image src.

[azaozz]

In 50565.diff:

• Require the edited image src when editing an image through the API.
• Use wp_image_file_matches_image_meta() to check if the attachment ID matches the image.

[TimothyBlynJacobs]

This looks right to me. We can add a format => uri to the src argument. This'll also require updating the tests in WP_Test_REST_Attachments_Controller.

[azaozz]

In 50565.1.diff:

• Add format => uri.
• Fix the tests.

Seems we'll have to create new attachment for every test, with image, meta and everything. Also need to add a test for mismatched attachment IDs.

[azaozz]

In 50565.2.diff: Also add tests for when the attachment ID points to a different attachment (another image or a file), and the src points to a sub-size.

This will have to be committed after updating the block editor that has ​https://github.com/WordPress/gutenberg/pull/23703 merged (as it adds a required attr to the REST request).

[TimothyBlynJacobs]

The Gutenberg PR has landed and those changes are in Beta 2 as I understand it, so it should be safe to merge this now.

[azaozz]

In 48498:

REST API: Prevent attachment ID/image source mismatch when editing an image.

Fixes #50565.

[whyisjake]

In 48499:

Code Formatting: Fix some formatting around WP_REST_Attachments_Controller tests.

See #50565.