WordPress.org

Make WordPress Core

Opened 5 months ago

Last modified 5 months ago

#53084 new defect (bug)

wp_delete_attachment deletes file even if $force_delete is false

Reported by: pubalacon Owned by:
Milestone: Awaiting Review Priority: normal
Severity: normal Version:
Component: Media Keywords: reporter-feedback
Focuses: Cc:

Description (last modified by mukesh27)

Around line 6085 in wp-includes/post.php

line 6085: wp_delete_attachment_files( $post_id, $meta, $backup_sizes, $file );

There is no test of $force_delete, so attachment file is physically removed from system file even if not wanted (or definitely not allowed)

Suggested patch:

if (!$force_delete) {
    wp_delete_attachment_files( $post_id, $meta, $backup_sizes, $file );
}

Change History (5)

#1 @mukesh27
5 months ago

  • Description modified (diff)

#2 @mukesh27
5 months ago

  • Component changed from General to Media
  • Version 5.7.1 deleted

Hi and welcome to WordPress Trac! Thanks for the ticket.

wp_delete_attachment_files( $post_id, $meta, $backup_sizes, $file ); called in wp_delete_attachment function at #L6125.

Removing version 5.7.1 and set component to Media

#3 @joyously
5 months ago

  • Severity changed from major to normal

Do you have a test case, or were you just reading the code?
The $force_delete variable is checked near the top of the function, and uses an early return, so it matches the description, which says

The attachment is moved to the Trash instead of permanently deleted unless Trash for media is disabled, item is already in the Trash, or $force_delete is true.

  if ( ! $force_delete && EMPTY_TRASH_DAYS && MEDIA_TRASH && 'trash' !== $post->post_status ) {
        return wp_trash_post( $post_id );
  }

#4 @SergeyBiryukov
5 months ago

  • Keywords reporter-feedback added; needs-patch removed

#5 @SergeyBiryukov
5 months ago

Just noting that code similar to the fragment above can be found not only in wp_delete_attachment(), but also in wp_delete_comment() and wp_delete_post(). Perhaps the $force_delete argument in these functions needs better documentation?

Note: See TracTickets for help on using tickets.