| @@ -48,9 +48,9 @@ | ||
| 48 | 48 | public static function import( $attachments, $post_id, $author_id = 0 ) { |
| 49 | 49 | // First, import inline images from the post content. |
| 50 | 50 | $inline_mappings = self::import_inline_images( $post_id, $author_id ); |
| 51 | 51 | |
| 52 | - if ( empty( $attachments ) || ! \is_array( $attachments ) ) { | |
| 52 | + if ( empty( $attachments ) || ! is_array( $attachments ) ) { | |
| 53 | 53 | return array(); |
| 54 | 54 | } |
| 55 | 55 | |
| 56 | 56 | $attachment_ids = array(); |
| @@ -113,9 +113,9 @@ | ||
| 113 | 113 | return array(); |
| 114 | 114 | } |
| 115 | 115 | |
| 116 | 116 | // Find all img tags in the content. |
| 117 | - \preg_match_all( '/<img[^>]+src=["\']([^"\']+)["\'][^>]*>/i', $post->post_content, $matches ); | |
| 117 | + preg_match_all( '/<img[^>]+src=["\']([^"\']+)["\'][^>]*>/i', $post->post_content, $matches ); | |
| 118 | 118 | |
| 119 | 119 | if ( empty( $matches[1] ) ) { |
| 120 | 120 | return array(); |
| 121 | 121 | } |
| @@ -171,9 +171,9 @@ | ||
| 171 | 171 | if ( \is_object( $attachment ) ) { |
| 172 | 172 | $attachment = \get_object_vars( $attachment ); |
| 173 | 173 | } |
| 174 | 174 | |
| 175 | - if ( ! \is_array( $attachment ) || empty( $attachment['url'] ) ) { | |
| 175 | + if ( ! is_array( $attachment ) || empty( $attachment['url'] ) ) { | |
| 176 | 176 | return false; |
| 177 | 177 | } |
| 178 | 178 | |
| 179 | 179 | return array( |
| @@ -206,9 +206,9 @@ | ||
| 206 | 206 | require_once ABSPATH . 'wp-admin/includes/class-wp-filesystem-direct.php'; |
| 207 | 207 | |
| 208 | 208 | $filesystem = new \WP_Filesystem_Direct( null ); |
| 209 | 209 | |
| 210 | - $is_local = ! \preg_match( '#^https?://#i', $attachment_data['url'] ); | |
| 210 | + $is_local = ! preg_match( '#^https?://#i', $attachment_data['url'] ); | |
| 211 | 211 | |
| 212 | 212 | if ( $is_local ) { |
| 213 | 213 | // Validate local path is within allowed directories to prevent file disclosure. |
| 214 | 214 | $allowed = self::is_allowed_local_path( $attachment_data['url'] ); |
| @@ -218,9 +218,9 @@ | ||
| 218 | 218 | |
| 219 | 219 | // Read local file from disk. |
| 220 | 220 | if ( ! $filesystem->exists( $attachment_data['url'] ) ) { |
| 221 | 221 | /* translators: %s: file path */ |
| 222 | - return new \WP_Error( 'file_not_found', \sprintf( \__( 'File not found: %s', 'activitypub' ), $attachment_data['url'] ) ); | |
| 222 | + return new \WP_Error( 'file_not_found', sprintf( \__( 'File not found: %s', 'activitypub' ), $attachment_data['url'] ) ); | |
| 223 | 223 | } |
| 224 | 224 | |
| 225 | 225 | // Copy to temp file so media_handle_sideload doesn't move the original. |
| 226 | 226 | $tmp_file = \wp_tempnam( \basename( $attachment_data['url'] ) ); |
| @@ -264,25 +264,13 @@ | ||
| 264 | 264 | 'name' => $original_name, |
| 265 | 265 | 'tmp_name' => $tmp_file, |
| 266 | 266 | ); |
| 267 | 267 | |
| 268 | - // Remote JSON can hand us an array where a string was expected. | |
| 269 | - $name = $attachment_data['name'] ?? ''; | |
| 270 | - $plain_name = \is_string( $name ) ? \wp_strip_all_tags( $name ) : ''; | |
| 271 | - | |
| 272 | 268 | // Prepare attachment post data. |
| 273 | 269 | // Let WordPress auto-detect the mime type from the file. |
| 274 | 270 | $post_data = array( |
| 275 | - | |
| 276 | - /* | |
| 277 | - * `name` comes from the remote object or an uploaded archive, and callers can run | |
| 278 | - * as a user with `unfiltered_html`, for which `kses_init()` installs no filters: | |
| 279 | - * `media_handle_sideload()` would store whatever it was given. Attachment pages | |
| 280 | - * are public, and `post_content` renders through `the_content` there, so it gets | |
| 281 | - * the same treatment as remote post content. | |
| 282 | - */ | |
| 283 | - 'post_title' => \wp_slash( $plain_name ), | |
| 284 | - 'post_content' => \wp_slash( $plain_name ), | |
| 271 | + 'post_title' => $attachment_data['name'] ?? '', | |
| 272 | + 'post_content' => $attachment_data['name'] ?? '', | |
| 285 | 273 | 'post_author' => $author_id, |
| 286 | 274 | 'meta_input' => array( |
| 287 | 275 | '_source_url' => $attachment_data['url'], |
| 288 | 276 | ), |
| @@ -288,18 +276,12 @@ | ||
| 288 | 276 | ), |
| 289 | 277 | ); |
| 290 | 278 | |
| 291 | 279 | // Add alt text for images. |
| 292 | - if ( '' !== $plain_name ) { | |
| 280 | + if ( ! empty( $attachment_data['name'] ) ) { | |
| 293 | 281 | $original_mime = $attachment_data['mediaType'] ?? ''; |
| 294 | - if ( 'image' === \strtok( $original_mime, '/' ) ) { | |
| 295 | - /* | |
| 296 | - * The same plain-text value as the title. Core does not sanitize this meta | |
| 297 | - * on write -- it only strips tags in the media-modal AJAX handler --. `Transformer\Attachment` federates it straight back | |
| 298 | - * out as the ActivityPub `name`, and consumers expect it to be plain text. | |
| 299 | - */ | |
| 300 | - // Slashed like the columns above: update_metadata() unslashes what it is given. | |
| 301 | - $post_data['meta_input']['_wp_attachment_image_alt'] = \wp_slash( $plain_name ); | |
| 282 | + if ( 'image' === strtok( $original_mime, '/' ) ) { | |
| 283 | + $post_data['meta_input']['_wp_attachment_image_alt'] = $attachment_data['name']; | |
| 302 | 284 | } |
| 303 | 285 | } |
| 304 | 286 | |
| 305 | 287 | // Sideload the attachment into WordPress. |
| @@ -476,9 +458,9 @@ | ||
| 476 | 458 | return; |
| 477 | 459 | } |
| 478 | 460 | |
| 479 | 461 | $media = self::generate_media_markup( $attachment_ids ); |
| 480 | - $separator = empty( \trim( $post->post_content ) ) ? '' : "\n\n"; | |
| 462 | + $separator = empty( trim( $post->post_content ) ) ? '' : "\n\n"; | |
| 481 | 463 | |
| 482 | 464 | \wp_update_post( |
| 483 | 465 | array( |
| 484 | 466 | 'ID' => $post_id, |
| @@ -515,13 +497,13 @@ | ||
| 515 | 497 | return $custom_markup; |
| 516 | 498 | } |
| 517 | 499 | |
| 518 | 500 | // Default to block markup. |
| 519 | - $type = \strtok( \get_post_mime_type( $attachment_ids[0] ), '/' ); | |
| 501 | + $type = strtok( \get_post_mime_type( $attachment_ids[0] ), '/' ); | |
| 520 | 502 | |
| 521 | 503 | // Single video or audio file. |
| 522 | 504 | if ( 1 === \count( $attachment_ids ) && ( 'video' === $type || 'audio' === $type ) ) { |
| 523 | - return \sprintf( | |
| 505 | + return sprintf( | |
| 524 | 506 | '<!-- wp:%1$s {"id":"%2$s"} --><figure class="wp-block-%1$s"><%1$s controls src="%3$s"></%1$s></figure><!-- /wp:%1$s -->', |
| 525 | 507 | \esc_attr( $type ), |
| 526 | 508 | \esc_attr( $attachment_ids[0] ), |
| 527 | 509 | \esc_url( \wp_get_attachment_url( $attachment_ids[0] ) ) |
| @@ -657,9 +639,9 @@ | ||
| 657 | 639 | return; |
| 658 | 640 | } |
| 659 | 641 | |
| 660 | 642 | $media = self::generate_files_markup( $files ); |
| 661 | - $separator = empty( \trim( $content ) ) ? '' : "\n\n"; | |
| 643 | + $separator = empty( trim( $content ) ) ? '' : "\n\n"; | |
| 662 | 644 | |
| 663 | 645 | self::update_object_content( $object_id, $object_type, $content . $separator . $media ); |
| 664 | 646 | } |
| 665 | 647 | |
| @@ -700,13 +682,13 @@ | ||
| 700 | 682 | return $custom_markup; |
| 701 | 683 | } |
| 702 | 684 | |
| 703 | 685 | // Default to block markup. |
| 704 | - $type = \strtok( $files[0]['mime_type'], '/' ); | |
| 686 | + $type = strtok( $files[0]['mime_type'], '/' ); | |
| 705 | 687 | |
| 706 | 688 | // Single video or audio file. |
| 707 | 689 | if ( 1 === \count( $files ) && ( 'video' === $type || 'audio' === $type ) ) { |
| 708 | - return \sprintf( | |
| 690 | + return sprintf( | |
| 709 | 691 | '<!-- wp:%1$s --><figure class="wp-block-%1$s"><%1$s controls src="%2$s"></%1$s></figure><!-- /wp:%1$s -->', |
| 710 | 692 | \esc_attr( $type ), |
| 711 | 693 | \esc_url( $files[0]['url'] ) |
| 712 | 694 | ); |
