Changeset 43589

Timestamp:

08/29/2018 03:22:14 AM (6 years ago)

Author:

rachelbaker

Message:

REST API: Limit the scope of wp-admin files required in WP_REST_Attachments_Controller methods.

Narrow the scope of the included wp-admin files loaded for wp_generate_attachment_metadata(), wp_handle_upload(), wp_tempnam(), and wp_handle_sideload(). Requires only wp-admin/includes/file.php and wp-admin/includes/image.php instead of wp-admin/includes/admin.php.

Props lonelyvegan, soulseekah, pratikthink.
Fixes #43757.

File:

• trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php (modified) (3 diffs)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php

@@ -170 +170 @@
         do_action( 'rest_insert_attachment', $attachment, $request, true );
 
-        // Include admin functions to get access to wp_generate_attachment_metadata().
-        require_once ABSPATH . 'wp-admin/includes/admin.php';
+        // Include admin function to get access to wp_generate_attachment_metadata().
+        require_once ABSPATH . 'wp-admin/includes/.php';
 
         wp_update_attachment_metadata( $id, wp_generate_attachment_metadata( $id, $file ) );
@@ -537 +537 @@
         $type = array_shift( $headers['content_type'] );
 
-        /** Include admin functions to get access to wp_tempnam() and wp_handle_sideload() */
-        require_once ABSPATH . 'wp-admin/includes/admin.php';
+        /** Include admin functions to get access to wp_tempnam() and wp_handle_sideload() */
+        require_once ABSPATH . 'wp-admin/includes/.php';
 
         // Save the file.
@@ -737 +737 @@
         }
 
-        /** Include admin functions to get access to wp_handle_upload() */
-        require_once ABSPATH . 'wp-admin/includes/admin.php';
+        /** Include admin function */
+        require_once ABSPATH . 'wp-admin/includes/.php';
 
         $file = wp_handle_upload( $files['file'], $overrides );