WP_REST_Attachments_Controller::upload_from_data( string $data, array $headers, string|null $time = null ): array|WP_Error

Compatibility

Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.

Parameters

$datastring

Supplied file data.

$headersarray

HTTP headers from the request.

$timestring|nulloptional

Time formatted in 'yyyy/mm'. Default null.Default: null

Return value

array|WP_Error

Data from wp_handle_sideload().

Performance profile

How much work a call to WP_REST_Attachments_Controller::upload_from_data() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.

Cost class

Heavy

Reads or writes the filesystem via fopen().

Scaling

Constant

No loop in the body: the same number of instructions runs whatever you pass in.

Instructions

14–92

Executed per call on PHP 8.5, depending on the branch taken. The body compiles to 148.

Plugin surface

None

Nothing here hands control to plugin code.

Called by

1

1 place in core call this, so the cost is paid more often than your own code shows.

What it touches

• filesystemfilesystem accessfopen()called directly
• hookthird-party callbacksdo_action()one call below WP_REST_Attachments_Controller::upload_from_data()

Further down the call graph this can also reach transient, cache, option, serialize and query. Those are the worst case, several calls deep and usually down an error path, not what a normal call pays.

What one call costs · 11 distinct outcomes

One number would be a lie: the work depends on which branch runs. These are every distinct cost WP_REST_Attachments_Controller::upload_from_data() can have, taken from its control-flow graph on PHP 8.5.

Uses · 7

• __()Retrieves the translation of $text.
• wp_tempnam()Returns a filename of a temporary unique file.
• is_wp_error()Checks whether the given variable is a WordPress Error.
• wp_handle_sideload()Wrapper for _wp_handle_upload().
• WP_Error::__construct()Initializes the error.
• WP_REST_Attachments_Controller::get_filename_from_disposition()Parses filename from a Content-Disposition header value.
• WP_REST_Attachments_Controller::check_upload_size()Determine if uploaded file exceeds space quota on multisite.

Used by · 1

• WP_REST_Attachments_Controller::insert_attachment()Inserts the attachment post in the database. Does not update the attachment meta.

Source code

View on Trac ↗View on GitHub ↗

1066	protected function upload_from_data( $data, $headers, $time = null ) {1067		if ( empty( $data ) ) {1068			return new WP_Error(1069				'rest_upload_no_data',1070				__( 'No data supplied.' ),1071				array( 'status' => 400 )1072			);1073		}1074 1075		if ( empty( $headers['content_type'] ) ) {1076			return new WP_Error(1077				'rest_upload_no_content_type',1078				__( 'No Content-Type supplied.' ),1079				array( 'status' => 400 )1080			);1081		}1082 1083		if ( empty( $headers['content_disposition'] ) ) {1084			return new WP_Error(1085				'rest_upload_no_content_disposition',1086				__( 'No Content-Disposition supplied.' ),1087				array( 'status' => 400 )1088			);1089		}1090 1091		$filename = self::get_filename_from_disposition( $headers['content_disposition'] );1092 1093		if ( empty( $filename ) ) {1094			return new WP_Error(1095				'rest_upload_invalid_disposition',1096				__( 'Invalid Content-Disposition supplied. Content-Disposition needs to be formatted as `attachment; filename="image.png"` or similar.' ),1097				array( 'status' => 400 )1098			);1099		}1100 1101		if ( ! empty( $headers['content_md5'] ) ) {1102			$content_md5 = array_shift( $headers['content_md5'] );1103			$expected    = trim( $content_md5 );1104			$actual      = md5( $data );1105 1106			if ( $expected !== $actual ) {1107				return new WP_Error(1108					'rest_upload_hash_mismatch',1109					__( 'Content hash did not match expected.' ),1110					array( 'status' => 412 )1111				);1112			}1113		}1114 1115		// Get the content-type.1116		$type = array_shift( $headers['content_type'] );1117 1118		// Include filesystem functions to get access to wp_tempnam() and wp_handle_sideload().1119		require_once ABSPATH . 'wp-admin/includes/file.php';1120 1121		// Save the file.1122		$tmpfname = wp_tempnam( $filename );1123 1124		$fp = fopen( $tmpfname, 'w+' );1125 1126		if ( ! $fp ) {1127			return new WP_Error(1128				'rest_upload_file_error',1129				__( 'Could not open file handle.' ),1130				array( 'status' => 500 )1131			);1132		}1133 1134		fwrite( $fp, $data );1135		fclose( $fp );1136 1137		// Now, sideload it in.1138		$file_data = array(1139			'error'    => null,1140			'tmp_name' => $tmpfname,1141			'name'     => $filename,1142			'type'     => $type,1143		);1144 1145		$size_check = self::check_upload_size( $file_data );

Changelog

Introduced in 4.7.0. One change between 6.7.7 and 7.1.0.

1. 6.7.7
2. 6.8.8
3. 6.9.7
4. 7.0.4
5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

About this page

Parsed data

Generated from the wordpress-develop 6.7.7 tag, from src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.

Corrections

Something wrong on this page? Report it and it gets fixed in the next regeneration.