WP_REST_Attachments_Controller::validate_sub_size_provenance( int $attachment_id, array $sub_sizes ): true|WP_Error

Source

protected function validate_sub_size_provenance( int $attachment_id, array $sub_sizes ) {
	$allowed = $this->get_sideloaded_file_names( $attachment_id );

	foreach ( $sub_sizes as $sub_size ) {
		foreach ( array( 'file', 'original_image' ) as $key ) {
			/*
			 * Every value that was sent is checked, no matter how unlikely
			 * a name it looks. A loose emptiness test would wave through
			 * '0', which is a valid one-character name as far as the schema
			 * is concerned and is stored like any other. A value the schema
			 * types as a string but which arrives as something else is
			 * rejected rather than skipped, so a subclass which widens the
			 * schema cannot pass an unchecked value on to the metadata.
			 */
			if ( ! isset( $sub_size[ $key ] ) ) {
				continue;
			}

			if ( ! is_string( $sub_size[ $key ] ) || ! in_array( $sub_size[ $key ], $allowed, true ) ) {
				return new WP_Error(
					'rest_invalid_sub_size_file',
					__( 'Invalid sub-size file name. File names must have been produced by a prior sideload for this attachment.' ),
					array( 'status' => 400 )
				);
			}
		}
	}

	return true;
}

View all references View on Trac View on GitHub