I am sanitizing uploaded SVG files with wp_handle_upload_prefilter
, example:
// Example code
add_filter( 'wp_handle_upload_prefilter', function($file) {
if ( $file['type'] === 'image/svg+xml' ) {
$this->sanitize( $file['tmp_name'] );
}
} );
It works fine for files uploaded through the Media Library, however, if the file is uploaded programatically, it doesn't go through the filter.
The reason I want to programatically upload an image is for testing purposes. I am uploading the file with wp_upload_bits
function:
$upload = wp_upload_bits( 'xss.svg', null, file_get_contents( $this->svg_path ) );
$uploaded_svg_contents = file_get_contents( $upload['file'] );
$this->assertFalse( $upload['error'] );
$this->assertNotContains( '<script', $uploaded_svg_contents );
How can I upload a media file programatically, that goes through the wp_handle_upload_prefilter
filter?
image/svg+xml
, they can betext/xml
orimage/svg
and a few others. Also, why usewp_upload_bits
? There are much higher level functions for sideloading files into attachments taht take all the work out of it – Tom J Nowell♦ Apr 2 '19 at 13:38image/svg+xml
is the mime specified in theupload_mimes
filter:add_filter( 'upload_mimes', function($mimes) { $mimes['svg'] = 'image/svg+xml'; return $mimes }
– Lucas Bustamante Apr 2 '19 at 14:13functions.php
. I've reviewed that plugins code myself, it's already quite lean and fast – Tom J Nowell♦ Apr 2 '19 at 14:22