From ea0d28db292bbdb21b22f627fc5b6180e110e65e Mon Sep 17 00:00:00 2001
From: Ryan Boren <ryan@boren.nu>
Date: Wed, 28 Nov 2012 20:17:57 +0000
Subject: [PATCH] Route uploads through async-upload.php instead of
 admin-ajax.php.

Props nacin, koopersmith
fixes #22622


git-svn-id: http://core.svn.wordpress.org/trunk@22902 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-admin/async-upload.php | 34 ++++++++++++++++++++++++----------
 wp-includes/media.php     |  2 +-
 2 files changed, 25 insertions(+), 11 deletions(-)

diff --git a/wp-admin/async-upload.php b/wp-admin/async-upload.php
index 64514c64e5..51143909fd 100644
--- a/wp-admin/async-upload.php
+++ b/wp-admin/async-upload.php
@@ -13,21 +13,35 @@ if ( defined('ABSPATH') )
 else
 	require_once('../wp-load.php');
 
-// Flash often fails to send cookies with the POST or upload, so we need to pass it in GET or POST instead
-if ( is_ssl() && empty($_COOKIE[SECURE_AUTH_COOKIE]) && !empty($_REQUEST['auth_cookie']) )
-	$_COOKIE[SECURE_AUTH_COOKIE] = $_REQUEST['auth_cookie'];
-elseif ( empty($_COOKIE[AUTH_COOKIE]) && !empty($_REQUEST['auth_cookie']) )
-	$_COOKIE[AUTH_COOKIE] = $_REQUEST['auth_cookie'];
-if ( empty($_COOKIE[LOGGED_IN_COOKIE]) && !empty($_REQUEST['logged_in_cookie']) )
-	$_COOKIE[LOGGED_IN_COOKIE] = $_REQUEST['logged_in_cookie'];
-unset($current_user);
-require_once('./admin.php');
+if ( ! ( isset( $_REQUEST['action'] ) && 'upload-attachment' == $_REQUEST['action'] ) ) {
+	// Flash often fails to send cookies with the POST or upload, so we need to pass it in GET or POST instead
+	if ( is_ssl() && empty($_COOKIE[SECURE_AUTH_COOKIE]) && !empty($_REQUEST['auth_cookie']) )
+		$_COOKIE[SECURE_AUTH_COOKIE] = $_REQUEST['auth_cookie'];
+	elseif ( empty($_COOKIE[AUTH_COOKIE]) && !empty($_REQUEST['auth_cookie']) )
+		$_COOKIE[AUTH_COOKIE] = $_REQUEST['auth_cookie'];
+	if ( empty($_COOKIE[LOGGED_IN_COOKIE]) && !empty($_REQUEST['logged_in_cookie']) )
+		$_COOKIE[LOGGED_IN_COOKIE] = $_REQUEST['logged_in_cookie'];
+	unset($current_user);
+}
 
-header('Content-Type: text/html; charset=' . get_option('blog_charset'));
+require_once('./admin.php');
 
 if ( !current_user_can('upload_files') )
 	wp_die(__('You do not have permission to upload files.'));
 
+header('Content-Type: text/html; charset=' . get_option('blog_charset'));
+
+if ( isset( $_REQUEST['action'] ) && 'upload-attachment' === $_REQUEST['action'] ) {
+	define( 'DOING_AJAX', true );
+	include ABSPATH . 'wp-admin/includes/ajax-actions.php';
+
+	send_nosniff_header();
+	nocache_headers();
+
+	wp_ajax_upload_attachment();
+	die( '0' );
+}
+
 // just fetch the detail form for that attachment
 if ( isset($_REQUEST['attachment_id']) && ($id = intval($_REQUEST['attachment_id'])) && $_REQUEST['fetch'] ) {
 	$post = get_post( $id );
diff --git a/wp-includes/media.php b/wp-includes/media.php
index 15db624da1..661909ead9 100644
--- a/wp-includes/media.php
+++ b/wp-includes/media.php
@@ -1246,7 +1246,7 @@ function wp_plupload_default_settings() {
 		'file_data_name'      => 'async-upload', // key passed to $_FILE.
 		'multiple_queues'     => true,
 		'max_file_size'       => $max_upload_size . 'b',
-		'url'                 => admin_url( 'admin-ajax.php', 'relative' ),
+		'url'                 => admin_url( 'async-upload.php', 'relative' ),
 		'flash_swf_url'       => includes_url( 'js/plupload/plupload.flash.swf' ),
 		'silverlight_xap_url' => includes_url( 'js/plupload/plupload.silverlight.xap' ),
 		'filters'             => array( array( 'title' => __( 'Allowed Files' ), 'extensions' => '*') ),