WordPress.org

Make WordPress Core

Opened 3 months ago

Closed 2 months ago

Last modified 2 months ago

#50565 closed defect (bug) (fixed)

Prevent attachment ID/image source mismatch when editing an image through the REST API

Reported by: azaozz Owned by: azaozz
Milestone: 5.5 Priority: normal
Severity: normal Version: 5.5
Component: REST API Keywords: has-patch commit
Focuses: Cc:

Description

When editing an image from the Image block, it is possible that the attachment ID stored there may have changed. May happen after exporting then importing all posts to another website.

A new (in 5.5) function wp_image_file_matches_image_meta() was introduced in [48329] to prevent this edge case. To be able to use it, the editor has to also pass the edited image src.

Attachments (3)

50565.diff (1022 bytes) - added by azaozz 3 months ago.
50565.1.diff (6.2 KB) - added by azaozz 3 months ago.
50565.2.diff (7.9 KB) - added by azaozz 3 months ago.

Download all attachments as: .zip

Change History (13)

@azaozz
3 months ago

#1 @azaozz
3 months ago

  • Keywords has-patch added

In 50565.diff:

  • Require the edited image src when editing an image through the API.
  • Use wp_image_file_matches_image_meta() to check if the attachment ID matches the image.

#2 @TimothyBlynJacobs
3 months ago

  • Keywords needs-unit-tests added

This looks right to me. We can add a format => uri to the src argument. This'll also require updating the tests in WP_Test_REST_Attachments_Controller.

@azaozz
3 months ago

#3 @azaozz
3 months ago

In 50565.1.diff:

  • Add format => uri.
  • Fix the tests.

Seems we'll have to create new attachment for every test, with image, meta and everything. Also need to add a test for mismatched attachment IDs.

This ticket was mentioned in Slack in #core-editor by azaozz. View the logs.


3 months ago

@azaozz
3 months ago

#5 @azaozz
3 months ago

  • Keywords needs-unit-tests removed

In 50565.2.diff: Also add tests for when the attachment ID points to a different attachment (another image or a file), and the src points to a sub-size.

This will have to be committed after updating the block editor that has https://github.com/WordPress/gutenberg/pull/23703 merged (as it adds a required attr to the REST request).

This ticket was mentioned in Slack in #core-editor by azaozz. View the logs.


3 months ago

This ticket was mentioned in Slack in #core-restapi by timothybjacobs. View the logs.


2 months ago

#8 @TimothyBlynJacobs
2 months ago

  • Keywords commit added

The Gutenberg PR has landed and those changes are in Beta 2 as I understand it, so it should be safe to merge this now.

#9 @azaozz
2 months ago

  • Owner set to azaozz
  • Resolution set to fixed
  • Status changed from new to closed

In 48498:

REST API: Prevent attachment ID/image source mismatch when editing an image.

Fixes #50565.

#10 @whyisjake
2 months ago

In 48499:

Code Formatting: Fix some formatting around WP_REST_Attachments_Controller tests.

See #50565.

Note: See TracTickets for help on using tickets.