WP_REST_Attachments_Controller::create_item_from_url( WP_REST_Request $request ): WP_REST_Response|WP_Error

654	protected function create_item_from_url( WP_REST_Request $request ) {655		// Sideloading downloads and stores a file, so require the upload capability.656		if ( ! current_user_can( 'upload_files' ) ) {657			return new WP_Error(658				'rest_cannot_create',659				__( 'Sorry, you are not allowed to upload media on this site.' ),660				array( 'status' => rest_authorization_required_code() )661			);662		}663 664		require_once ABSPATH . 'wp-admin/includes/file.php';665		require_once ABSPATH . 'wp-admin/includes/media.php';666		require_once ABSPATH . 'wp-admin/includes/image.php';667 668		$url     = $request['url'];669		$post_id = ! empty( $request['post'] ) ? (int) $request['post'] : 0;670 671		// Derive the filename from the URL path before downloading anything.672		$url_path = wp_parse_url( $url, PHP_URL_PATH );673		$filename = $url_path ? wp_basename( $url_path ) : '';674		if ( '' === $filename ) {675			return new WP_Error(676				'rest_invalid_url',677				__( 'Could not determine a filename from the provided URL.' ),678				array( 'status' => 400 )679			);680		}681 682		/*683		 * Only download URLs whose extension maps to an allowed image MIME type.684		 * The sideload handler would reject other types anyway (via685		 * wp_check_filetype_and_ext()), but checking first avoids downloading686		 * files that can never be accepted, such as PHP scripts.687		 */688		$filetype = wp_check_filetype( $filename );689		if ( ! $filetype['type'] || ! str_starts_with( $filetype['type'], 'image/' ) ) {690			return new WP_Error(691				'rest_invalid_url',692				__( 'The provided URL does not point to a supported image file.' ),693				array( 'status' => 400 )694			);695		}696 697		/*698		 * Cap the download at the same size the site would accept as a direct699		 * upload. check_upload_size() only applies on multisite, so without a700		 * ceiling here a single site has no limit at all on this path: the701		 * `upload_max_filesize` and `post_max_size` directives bound a request702		 * body, not a fetch the server makes itself.703		 *704		 * When `wp_max_upload_size` returns 0, no ceiling is applied.705		 */706		$max_size = (int) wp_max_upload_size();707 708		/*709		 * Download the remote file with WordPress's HTTP API, which validates710		 * the host and blocks requests to private or local addresses. This is711		 * the same primitive core's media_sideload_image() relies on.712		 *713		 * `limit_response_size` stops the transfer once the limit is passed,714		 * so an oversized remote file is never written to disk in full. One715		 * byte over the ceiling is enough to fail the size check below.716		 */717		$limit_response_size = static function ( $args ) use ( $max_size ) {718			$args['limit_response_size'] = $max_size + 1;719			return $args;720		};721 722		if ( $max_size > 0 ) {723			add_filter( 'http_request_args', $limit_response_size );724		}725 726		$tmp_file = download_url( $url );727 728		if ( $max_size > 0 ) {729			remove_filter( 'http_request_args', $limit_response_size );730		}731 732		if ( is_wp_error( $tmp_file ) ) {733			return $tmp_file;
PHP	Compiled	Executed	Branches	Notes
8.6-dev	211	6	16	1 fewer instruction than PHP 8.5
8.5	212	6	16
8.4	212	6	16	3 fewer instructions than PHP 8.3
8.3	215	6	16
8.2	215	6	16
8.1	215	6	16	4 more instructions than PHP 7.4
7.4	211	17–137	16