I'm writing a plugin that modifies the default behavior when uploading a file for a post or to the media library. I'm setting $overrides in wp_handle_upload() with a custom $unique_filename_callback.
Once I added that, it tripped the following check inside wp_handle_upload(), because $_POST['action'] wasn't set. (I'm not sure why it wasn't, but it wasn't).
if ( $test_form && (!isset( $_POST['action'] ) || ($_POST['action'] != $action ) ) ) return call_user_func($upload_error_handler, $file, __( 'Invalid form submission.' ));
So, I set $overrides['test_form'] = false, and now it's working. I'm wondering if that could be a potential security issue, though. Would that allow someone to post a form from a remote source or something?
It seems like it's normal to disable it when you're creating your own upload fields, but I'm using the built-in post upload form, so I want to make sure.