| @@ -264,25 +264,13 @@ | ||
| 264 | 264 | 'name' => $original_name, |
| 265 | 265 | 'tmp_name' => $tmp_file, |
| 266 | 266 | ); |
| 267 | 267 | |
| 268 | - // Remote JSON can hand us an array where a string was expected. | |
| 269 | - $name = $attachment_data['name'] ?? ''; | |
| 270 | - $plain_name = \is_string( $name ) ? \wp_strip_all_tags( $name ) : ''; | |
| 271 | - | |
| 272 | 268 | // Prepare attachment post data. |
| 273 | 269 | // Let WordPress auto-detect the mime type from the file. |
| 274 | 270 | $post_data = array( |
| 275 | - | |
| 276 | - /* | |
| 277 | - * `name` comes from the remote object or an uploaded archive, and callers can run | |
| 278 | - * as a user with `unfiltered_html`, for which `kses_init()` installs no filters: | |
| 279 | - * `media_handle_sideload()` would store whatever it was given. Attachment pages | |
| 280 | - * are public, and `post_content` renders through `the_content` there, so it gets | |
| 281 | - * the same treatment as remote post content. | |
| 282 | - */ | |
| 283 | - 'post_title' => \wp_slash( $plain_name ), | |
| 284 | - 'post_content' => \wp_slash( $plain_name ), | |
| 271 | + 'post_title' => $attachment_data['name'] ?? '', | |
| 272 | + 'post_content' => $attachment_data['name'] ?? '', | |
| 285 | 273 | 'post_author' => $author_id, |
| 286 | 274 | 'meta_input' => array( |
| 287 | 275 | '_source_url' => $attachment_data['url'], |
| 288 | 276 | ), |
| @@ -288,18 +276,12 @@ | ||
| 288 | 276 | ), |
| 289 | 277 | ); |
| 290 | 278 | |
| 291 | 279 | // Add alt text for images. |
| 292 | - if ( '' !== $plain_name ) { | |
| 280 | + if ( ! empty( $attachment_data['name'] ) ) { | |
| 293 | 281 | $original_mime = $attachment_data['mediaType'] ?? ''; |
| 294 | 282 | if ( 'image' === \strtok( $original_mime, '/' ) ) { |
| 295 | - /* | |
| 296 | - * The same plain-text value as the title. Core does not sanitize this meta | |
| 297 | - * on write -- it only strips tags in the media-modal AJAX handler --. `Transformer\Attachment` federates it straight back | |
| 298 | - * out as the ActivityPub `name`, and consumers expect it to be plain text. | |
| 299 | - */ | |
| 300 | - // Slashed like the columns above: update_metadata() unslashes what it is given. | |
| 301 | - $post_data['meta_input']['_wp_attachment_image_alt'] = \wp_slash( $plain_name ); | |
| 283 | + $post_data['meta_input']['_wp_attachment_image_alt'] = $attachment_data['name']; | |
| 302 | 284 | } |
| 303 | 285 | } |
| 304 | 286 | |
| 305 | 287 | // Sideload the attachment into WordPress. |
