wp-includes/class-wp-xmlrpc-server.php:6461Uploads a file, following your settings.
$argsarray$0int
$1string
$2string
$3array
$namestring
$typestringdefault: empty string
$bitsstringdefault: empty string
$post_idintdefault: 0. }
array|IXR_Error3 hooks fire while wp_xmlrpc_server::mw_newMediaObject() runs, in this order:
Fires after the XML-RPC user has been authenticated but before the rest of the method logic begins.
Filters whether to preempt the XML-RPC media upload.
Fires after a new attachment has been added via the XML-RPC MovableType API.
public function mw_newMediaObject( $args ) { if ( ! $this->minimum_args( $args, 4 ) ) { return $this->error; } $username = $this->escape( $args[1] ); $password = $this->escape( $args[2] ); $data = $args[3]; $user = $this->login( $username, $password ); if ( ! $user ) { return $this->error; } /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */ do_action( 'xmlrpc_call', 'metaWeblog.newMediaObject', $args, $this ); if ( ! current_user_can( 'upload_files' ) ) { $this->error = new IXR_Error( 401, __( 'Sorry, you are not allowed to upload files.' ) ); return $this->error; } if ( ! is_array( $data ) || ! is_string( $data['name'] ?? null ) || ! is_string( $data['type'] ?? '' ) || ! is_string( $data['bits'] ?? '' ) ) { return new IXR_Error( 400, __( 'Invalid attachment data.' ) ); } $name = sanitize_file_name( $data['name'] ); // A name consisting only of characters the sanitizer strips leaves nothing to write to. if ( '' === $name ) { return new IXR_Error( 400, __( 'Invalid attachment data.' ) ); } $type = $data['type'] ?? ''; $bits = $data['bits'] ?? ''; if ( is_multisite() && upload_is_user_over_quota( false ) ) { $this->error = new IXR_Error( 401, sprintf( /* translators: %s: Allowed space allocation. */ __( 'Sorry, you have used your space allocation of %s. Please delete some files to upload more files.' ), size_format( get_space_allowed() * MB_IN_BYTES ) ) ); return $this->error; } /** * Filters whether to preempt the XML-RPC media upload. * * Returning a truthy value will effectively short-circuit the media upload, * returning that value as a 500 error instead. * * @since 2.1.0 * * @param bool $error Whether to pre-empt the media upload. Default false. */ $upload_err = apply_filters( 'pre_upload_error', false ); if ( $upload_err ) { return new IXR_Error( 500, $upload_err ); } $upload = wp_upload_bits( $name, null, $bits ); if ( ! empty( $upload['error'] ) ) { /* translators: 1: File name, 2: Error message. */ $error_string = sprintf( __( 'Could not write file %1$s (%2$s).' ), $name, $upload['error'] ); return new IXR_Error( 500, $error_string ); } // Construct the attachment array. $post_id = 0; if ( ! empty( $data['post_id'] ) ) { $post_id = (int) $data['post_id'];Introduced in 1.5.0. Unchanged from 6.7.7 through 7.1.0.
Signature, return type and hooks compared across 5 parsed releases.
src/wp-includes/class-wp-xmlrpc-server.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.