Bulk delete media attachments doesn't pass integer values to wp_delete_attachment

[eherman24]

When selecting multiple images in the media table on /wp-admin/upload.php and using the bulk delete dropdown to delete images passes a string value to wp_delete_attachment(). This could cause some issues for methods hooked into into deleted_post.

The documentation for the deleted_post hook indicates the first parameter is an integer.

​https://developer.wordpress.org/reference/hooks/deleted_post/

<?php
do_action( 'deleted_post', int $postid, WP_Post $post );

To confirm that the $postid value is a string I ran the following test code to hook into deleted_post and update an option in the database based on the value of $postid.

<?php
add_action( 'deleted_post', function( $post_id ) {
        update_option( 'test_post_integer_value', is_int( $post_id ) );
}, PHP_INT_MAX, 2 );

Deleting a single image, using the 'Delete Permanently' button on either the media list table or the media grid will update the test_post_integer_value option value to 1 (true).

Switching over to the media list table view, and using the checkboxes to select 1 or more images, and then using the bulk delete dropdown to delete the images results in a false value. The option value is empty in the database.

So it's worth noting this only happens using the bulk delete actions dropdown on the media list table. Even when selecting a single image.

[eherman24]

Updated diff.

[eherman24]

I added an updated patch, the first one included an unnecessary typecast of $post_id_del to current_user_can()

[eherman24]

This was on PHP 8.0.20

[joedolson]

Updated patch with alternate method

[joedolson]

The provided patch fixes the immediate issue, but doesn't cover the same issue with wp_trash_post and wp_untrash_post earlier in the same function, which also expect int arguments.

Alternate version of patch ensures that $post_ids is an array of integers from the beginning of the function, simplifying the code by making the (array) and (int) casting unnecessary.

Ensure that post IDs passed to wp_trash_post, wp_untrash_post, and wp_delete_attachment are always of type int.

Trac ticket: https://core.trac.wordpress.org/ticket/56170

[joedolson]

In 55183:

Media: Ensure media IDs are type int in bulk editing.

Cast all array values to integers using array_map so functions like wp_delete_attachment receiving the expected variable type.

Props eherman24, joedolson.
Fixes #56170.

Fixed in r55183