WordPress-C
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

REST API: Limit the scope of wp-admin files required in WP_REST_Attachments_Controller methods. 

Narrow the scope of the included wp-admin files loaded for `wp_generate_attachment_metadata()`, `wp_handle_upload()`, `wp_tempnam()`, and `wp_handle_sideload()`. Requires only `wp-admin/includes/file.php` and `wp-admin/includes/image.php` instead of `wp-admin/includes/admin.php`.

Props ocean90, lonelyvegan, soulseekah, pratikthink.
Merges [43589], [43604] to the 5.0 branch.
Fixes #43757.

Built from https://develop.svn.wordpress.org/branches/5.0@43773


git-svn-id: http://core.svn.wordpress.org/branches/5.0@43602 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
danielbachhuber 2018-10-19 18:53:41 +00:00
parent 5a627786bf
commit 0a3bb63b8f
2 changed files with 10 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
View File

@ -122,6 +122,9 @@ class WP_REST_Attachments_Controller extends WP_REST_Posts_Controller {
$type = $file['type'];
$file = $file['file'];
// Include image functions to get access to wp_read_image_metadata().
require_once ABSPATH . 'wp-admin/includes/image.php';
// use image exif/iptc data for title and caption defaults if possible
$image_meta = wp_read_image_metadata( $file );
@ -169,8 +172,8 @@ class WP_REST_Attachments_Controller extends WP_REST_Posts_Controller {
*/
do_action( 'rest_insert_attachment', $attachment, $request, true );
// Include admin functions to get access to wp_generate_attachment_metadata().
require_once ABSPATH . 'wp-admin/includes/admin.php';
// Include admin function to get access to wp_generate_attachment_metadata().
require_once ABSPATH . 'wp-admin/includes/image.php';
wp_update_attachment_metadata( $id, wp_generate_attachment_metadata( $id, $file ) );
@ -557,8 +560,8 @@ class WP_REST_Attachments_Controller extends WP_REST_Posts_Controller {
// Get the content-type.
$type = array_shift( $headers['content_type'] );
/** Include admin functions to get access to wp_tempnam() and wp_handle_sideload() */
require_once ABSPATH . 'wp-admin/includes/admin.php';
/** Include admin functions to get access to wp_tempnam() and wp_handle_sideload(). */
require_once ABSPATH . 'wp-admin/includes/file.php';
// Save the file.
$tmpfname = wp_tempnam( $filename );
@ -757,8 +760,8 @@ class WP_REST_Attachments_Controller extends WP_REST_Posts_Controller {
return $size_check;
}
/** Include admin functions to get access to wp_handle_upload() */
require_once ABSPATH . 'wp-admin/includes/admin.php';
/** Include admin function to get access to wp_handle_upload(). */
require_once ABSPATH . 'wp-admin/includes/file.php';
$file = wp_handle_upload( $files['file'], $overrides );

2
wp-includes/version.php
View File

@ -4,7 +4,7 @@
*
* @global string $wp_version
*/
$wp_version = '5.0-alpha-43772';
$wp_version = '5.0-alpha-43773';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.