WP_REST_Attachments_Controller::get_endpoint_args_for_item_schema( string $method = WP_REST_Server::CREATABLE ): array<string,

Source

public function get_endpoint_args_for_item_schema( $method = WP_REST_Server::CREATABLE ) {
	$args = parent::get_endpoint_args_for_item_schema( $method );

	if ( WP_REST_Server::CREATABLE !== $method ) {
		return $args;
	}

	$args['generate_sub_sizes'] = array(
		'type'        => 'boolean',
		'default'     => true,
		'description' => __( 'Whether to generate image sub sizes.' ),
	);

	$args['convert_format'] = array(
		'type'        => 'boolean',
		'default'     => true,
		'description' => __( 'Whether to convert image formats.' ),
	);

	$args['url'] = array(
		'type'              => 'string',
		'format'            => 'uri',
		'description'       => __( 'URL of an external image to sideload into the media library, instead of uploading a file.' ),
		'sanitize_callback' => 'sanitize_url',
		'validate_callback' => static function ( $url, $request, $param ) {
			/*
			 * A custom validate_callback replaces the default
			 * rest_validate_request_arg(), so re-apply it first to keep
			 * the schema checks (string type, uri format) enforced.
			 */
			$valid = rest_validate_request_arg( $url, $request, $param );
			if ( is_wp_error( $valid ) ) {
				return $valid;
			}

			/*
			 * Reject URLs that are not safe to request server-side. wp_http_validate_url()
			 * enforces an HTTP(S) scheme and blocks private, local, and otherwise
			 * disallowed hosts, guarding the sideload against SSRF.
			 */
			if ( false === wp_http_validate_url( $url ) ) {
				return new WP_Error(
					'rest_invalid_url',
					__( 'Invalid URL. Provide a valid, publicly reachable HTTP or HTTPS image URL.' ),
					array( 'status' => 400 )
				);
			}

			return true;
		},
	);

	return $args;
}

View all references View on Trac View on GitHub