wp_xmlrpc_server::mw_newMediaObject( array $args ): array|IXR_Error

Description

Compatibility

Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.

Parameters

$argsarray

Method arguments. Note: top-level arguments must be ordered as documented.

• $0int

  Blog ID (unused).

• $1string

  Username.

• $2string

  Password.

• $3array

  { Data for the file to upload.

• $namestring

  File name. Sanitized with sanitize_file_name().

• $typestringdefault: empty string

  Optional. File MIME type, stored as the attachment's post MIME type.

• $bitsstringdefault: empty string

  Optional. File contents.

• $post_idintdefault: 0. }

  Optional. ID of the post to attach the file to.

Return value

array|IXR_Error

Performance profile

How much work a call to wp_xmlrpc_server::mw_newMediaObject() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.

Cost class

Heavy

Reaches the database via get_post().

Scaling

Constant

No loop in the body: the same number of instructions runs whatever you pass in.

Instructions

8–148

Executed per call on PHP 8.5, depending on the branch taken. The body compiles to 229.

Plugin surface

3 hooks

Third-party callbacks on 'xmlrpc_call', 'pre_upload_error', 'xmlrpc_call_success_mw_newMediaObject' run inside this call, and their cost is not bounded by anything here.

Called by

0

Nothing in core calls this; the cost is only what you spend yourself.

What it touches

• hookthird-party callbacksdo_action()called directly
• querycontent queryget_post()called directly
• optionnetwork optionget_site_option()one call below wp_xmlrpc_server::mw_newMediaObject()

Further down the call graph this can also reach cache, serialize and transient. Those are the worst case, several calls deep and usually down an error path, not what a normal call pays.

What one call costs · 15 distinct outcomes

One number would be a lie: the work depends on which branch runs. These are every distinct cost wp_xmlrpc_server::mw_newMediaObject() can have, taken from its control-flow graph on PHP 8.5.

Hooks and filters fired · 3

3 hooks fire while wp_xmlrpc_server::mw_newMediaObject() runs, in this order:

1. 1
   do_action( xmlrpc_call )actionline 6476 (+15 into the body)

   Fires after the XML-RPC user has been authenticated but before the rest of the method logic begins.

2. 2
   apply_filters( pre_upload_error )filterline 6524 (+63 into the body)

   Filters whether to preempt the XML-RPC media upload.

3. 3
   do_action( xmlrpc_call_success_mw_newMediaObject )actionline 6567 (+106 into the body)

   Fires after a new attachment has been added via the XML-RPC MovableType API.

Uses · 19

• do_action()Calls the callback functions that have been added to an action hook.
• current_user_can()Returns whether the current user has the specified capability.
• __()Retrieves the translation of $text.
• sanitize_file_name()Sanitizes a filename, replacing whitespace with dashes.
• is_multisite()Determines whether Multisite is enabled.
• upload_is_user_over_quota()Checks whether a site has used its allotted upload space.
• size_format()Converts a number of bytes to the largest unit the bytes will fit into.
• get_space_allowed()Returns the upload quota for the current blog.
• apply_filters()Calls the callback functions that have been added to a filter hook.
• wp_upload_bits()Creates a file in the upload folder with given content.
• wp_insert_attachment()Inserts an attachment.
• wp_update_attachment_metadata()Updates metadata for an attachment.

Source code

View on Trac ↗View on GitHub ↗

6461	public function mw_newMediaObject( $args ) {6462		if ( ! $this->minimum_args( $args, 4 ) ) {6463			return $this->error;6464		}6465 6466		$username = $this->escape( $args[1] );6467		$password = $this->escape( $args[2] );6468		$data     = $args[3];6469 6470		$user = $this->login( $username, $password );6471		if ( ! $user ) {6472			return $this->error;6473		}6474 6475		/** This action is documented in wp-includes/class-wp-xmlrpc-server.php */6476		do_action( 'xmlrpc_call', 'metaWeblog.newMediaObject', $args, $this );6477 6478		if ( ! current_user_can( 'upload_files' ) ) {6479			$this->error = new IXR_Error( 401, __( 'Sorry, you are not allowed to upload files.' ) );6480			return $this->error;6481		}6482 6483		if (6484			! is_array( $data ) ||6485			! is_string( $data['name'] ?? null ) ||6486			! is_string( $data['type'] ?? '' ) ||6487			! is_string( $data['bits'] ?? '' )6488		) {6489			return new IXR_Error( 400, __( 'Invalid attachment data.' ) );6490		}6491 6492		$name = sanitize_file_name( $data['name'] );6493 6494		// A name consisting only of characters the sanitizer strips leaves nothing to write to.6495		if ( '' === $name ) {6496			return new IXR_Error( 400, __( 'Invalid attachment data.' ) );6497		}6498 6499		$type = $data['type'] ?? '';6500		$bits = $data['bits'] ?? '';6501 6502		if ( is_multisite() && upload_is_user_over_quota( false ) ) {6503			$this->error = new IXR_Error(6504				401,6505				sprintf(6506					/* translators: %s: Allowed space allocation. */6507					__( 'Sorry, you have used your space allocation of %s. Please delete some files to upload more files.' ),6508					size_format( get_space_allowed() * MB_IN_BYTES )6509				)6510			);6511			return $this->error;6512		}6513 6514		/**6515		 * Filters whether to preempt the XML-RPC media upload.6516		 *6517		 * Returning a truthy value will effectively short-circuit the media upload,6518		 * returning that value as a 500 error instead.6519		 *6520		 * @since 2.1.06521		 *6522		 * @param bool $error Whether to pre-empt the media upload. Default false.6523		 */6524		$upload_err = apply_filters( 'pre_upload_error', false );6525		if ( $upload_err ) {6526			return new IXR_Error( 500, $upload_err );6527		}6528 6529		$upload = wp_upload_bits( $name, null, $bits );6530		if ( ! empty( $upload['error'] ) ) {6531			/* translators: 1: File name, 2: Error message. */6532			$error_string = sprintf( __( 'Could not write file %1$s (%2$s).' ), $name, $upload['error'] );6533			return new IXR_Error( 500, $error_string );6534		}6535 6536		// Construct the attachment array.6537		$post_id = 0;6538		if ( ! empty( $data['post_id'] ) ) {6539			$post_id = (int) $data['post_id'];6540

Changelog

Introduced in 1.5.0. Unchanged from 6.7.7 through 7.1.0.

1. 6.7.7
2. 6.8.8
3. 6.9.7
4. 7.0.4
5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

About this page

Parsed data

Generated from the wordpress-develop 7.1.0 tag, from src/wp-includes/class-wp-xmlrpc-server.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.

Corrections

Something wrong on this page? Report it and it gets fixed in the next regeneration.