Uh oh!
There was an error while loading. Please reload this page.
Media REST API: Update sideload from url path to include an upload size check - #12670
Conversation
…heck for parity with the multipart and raw-body upload paths
Test using WordPress PlaygroundThe changes in this pull request can previewed and tested using a WordPress Playground instance. WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser. Some things to be aware of
For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation. |
There was a problem hiding this comment.
Pull request overview
This PR updates the REST /wp/v2/media “sideload from url” upload path to enforce multisite upload size/quota limits by invoking the same check_upload_size() logic used by other upload paths, and adds PHPUnit coverage to prevent regressions.
Changes:
- Add a multisite upload-size/quota check to
WP_REST_Attachments_Controller::create_item_from_url()before sideloading. - Ensure the temporary downloaded file is deleted when the new size/quota check fails.
- Add multisite REST API tests asserting the correct 400 error codes for max-file-size and site quota exceedance on the
urlupload path.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| tests/phpunit/tests/rest-api/rest-attachments-controller.php | Adds multisite tests covering size/quota enforcement for URL-based media sideload. |
| src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php | Enforces multisite upload size/quota limits for the url sideload upload path and cleans up temp files on failure. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
ramonjd
left a comment
There was a problem hiding this comment.
I tested the happy path (in the pr desc) and also by setting multisite upload and storage limits.
LGTM
😄
😦
☹️
Also direct call using await wp.apiFetch
Should we backport to Gutenberg?
andrewserong
commented
Jul 24, 2026
Indeed we should! Backport here: WordPress/gutenberg#80659 |
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the Core Committers: Use this line as a base for the props when committing in SVN: To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
… a URL. The attachments controller's URL-based creation path, `create_item_from_url()`, passed the downloaded file to `media_handle_sideload()` without running `check_upload_size()`. Unlike the multipart and raw-body upload paths, it did not enforce the multisite maximum file size or the site's upload space quota. Run `check_upload_size()` on the downloaded file before sideloading it, for parity with the other upload paths, and remove the temporary file when the check fails. Developed in: #12670 Follow-up to [62659]. Props andrewserong, ramonopoly. Fixes #65517. git-svn-id: https://develop.svn.wordpress.org/trunk@62841 602fd350-edb4-49c9-b593-d223f7449a82
… a URL. The attachments controller's URL-based creation path, `create_item_from_url()`, passed the downloaded file to `media_handle_sideload()` without running `check_upload_size()`. Unlike the multipart and raw-body upload paths, it did not enforce the multisite maximum file size or the site's upload space quota. Run `check_upload_size()` on the downloaded file before sideloading it, for parity with the other upload paths, and remove the temporary file when the check fails. Developed in: WordPress/wordpress-develop#12670 Follow-up to [62659]. Props andrewserong, ramonopoly. Fixes #65517. Built from https://develop.svn.wordpress.org/trunk@62841 git-svn-id: http://core.svn.wordpress.org/trunk@62121 1a063a9b-81f0-0310-95a4-ce76da25c4cd
In WP 7.1, the
/wp/v2/mediaREST API endpoint supports aurlparam to allow sideloading media via a url, without requiring the browser to first download an image and upload via a standard media upload POST request.This PR adds a call to
check_upload_sizefor this upload path, to create parity with the other upload paths (e.g. the multipart and raw-body upload paths).To test manually that this doesn't regress the "upload to media library" feature, try adding an Image block to a post using an external url and click the "upload to media library button". It should work as on trunk. Here's what that button looks like:
And here's some test markup for you to try that out with:
Trac ticket: https://core.trac.wordpress.org/ticket/65517
Use of AI Tools
AI assistance: Yes
Tool(s): Claude Code
Model(s): Opus 4.8
Used for: Identifying the gap in upload paths; final implementation and tests were reviewed and edited by me.
This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.