Changeset 3747070 for hivepress/trunk/includes/controllers/class-attachment.php

Timestamp:

10/14/2026 08:02:34 PM (7 days ago)

Author:

hivepress

Message:

Release 1.8.0

File:

• hivepress/trunk/includes/controllers/class-attachment.php (modified) (1 diff)

hivepress/trunk/includes/controllers/class-attachment.php

@@ -173 +173 @@
 
                 // Check file.
-                if ( ! isset( $_FILES['file'] ) ) {
+                if ( ! isset( $_FILES['file'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing -- REST API request; WordPress requires a valid REST nonce for cookie authentication, otherwise the user is not logged in.
                         return hp\rest_error( 400 );
                 }
 
                 // Check file format.
-                if ( $parent_field->get_formats() && ! hivepress()->attachment->is_valid_file( $_FILES['file']['tmp_name'], $_FILES['file']['name'], $parent_field->get_formats() ) ) {
+                if ( $parent_field->get_formats() && ! hivepress()->attachment->is_valid_file( $_FILES['file']['tmp_name'], $_FILES['file']['name'], $parent_field->get_formats() ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotValidated, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- REST API request with WordPress REST nonce check; the file type is validated by wp_check_filetype_and_ext() in is_valid_file() and by media_handle_upload().
 
                         /* translators: %s: file extensions. */