REST API: Enforce multisite upload limits when sideloading media from a URL.

The attachments controller's URL-based creation path, `create_item_from_url()`, passed the downloaded file to `media_handle_sideload()` without running `check_upload_size()`. Unlike the multipart and raw-body upload paths, it did not enforce the multisite maximum file size or the site's upload space quota.

Run `check_upload_size()` on the downloaded file before sideloading it, for parity with the other upload paths, and remove the temporary file when the check fails.

Developed in: WordPress#12670

Follow-up to [62659].

Props andrewserong, ramonopoly.

Fixes #65517.



git-svn-id: https://develop.svn.wordpress.org/trunk@62841 602fd350-edb4-49c9-b593-d223f7449a82

Author: andrewserong

src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php

@@ -641,6 +641,14 @@ protected function create_item_from_url( $request ) {
 			'tmp_name' => $tmp_file,
 		);
 
+		$size_check = self::check_upload_size( $file_array );
+		if ( is_wp_error( $size_check ) ) {
+			if ( file_exists( $tmp_file ) ) {
+				wp_delete_file( $tmp_file );
+			}
+			return $size_check;
+		}
+
 		$attachment_id = media_handle_sideload( $file_array, $post_id );
 
 		if ( is_wp_error( $attachment_id ) ) {

tests/phpunit/tests/rest-api/rest-attachments-controller.php

@@ -5330,6 +5330,70 @@ public function test_create_item_from_url_returns_error_on_download_failure() {
 		$this->assertSame( 500, $response->get_status() );
 	}
 
+	/**
+	 * Verifies that the URL sideload path enforces the multisite maximum file
+	 * size, for parity with the multipart and raw-body upload paths.
+	 *
+	 * @ticket 65517
+	 * @group multisite
+	 * @group ms-required
+	 *
+	 * @covers WP_REST_Attachments_Controller::create_item_from_url
+	 * @covers WP_REST_Attachments_Controller::check_upload_size
+	 */
+	public function test_create_item_from_url_exceeds_multisite_max_filesize() {
+		$this->enable_client_side_media_processing();
+
+		wp_set_current_user( self::$superadmin_id );
+		update_site_option( 'fileupload_maxk', 1 );
+		update_site_option( 'upload_space_check_disabled', false );
+
+		// Ensure ample space is available so the file-size limit is what rejects it.
+		add_filter( 'pre_get_space_used', '__return_zero' );
+		add_filter( 'pre_http_request', array( $this, 'mock_image_download' ), 10, 3 );
+
+		$request = new WP_REST_Request( 'POST', '/wp/v2/media' );
+		$request->set_param( 'url', 'https://example.com/too-big.jpg' );
+		$request->set_param( 'generate_sub_sizes', false );
+
+		$response = rest_get_server()->dispatch( $request );
+
+		remove_filter( 'pre_http_request', array( $this, 'mock_image_download' ), 10 );
+
+		$this->assertErrorResponse( 'rest_upload_file_too_big', $response, 400 );
+	}
+
+	/**
+	 * Verifies that the URL sideload path enforces the multisite site upload
+	 * space quota, for parity with the multipart and raw-body upload paths.
+	 *
+	 * @ticket 65517
+	 * @group multisite
+	 * @group ms-required
+	 *
+	 * @covers WP_REST_Attachments_Controller::create_item_from_url
+	 * @covers WP_REST_Attachments_Controller::check_upload_size
+	 */
+	public function test_create_item_from_url_exceeds_multisite_site_upload_space() {
+		$this->enable_client_side_media_processing();
+
+		wp_set_current_user( self::$superadmin_id );
+		add_filter( 'get_space_allowed', '__return_zero' );
+		update_site_option( 'upload_space_check_disabled', false );
+
+		add_filter( 'pre_http_request', array( $this, 'mock_image_download' ), 10, 3 );
+
+		$request = new WP_REST_Request( 'POST', '/wp/v2/media' );
+		$request->set_param( 'url', 'https://example.com/no-space.jpg' );
+		$request->set_param( 'generate_sub_sizes', false );
+
+		$response = rest_get_server()->dispatch( $request );
+
+		remove_filter( 'pre_http_request', array( $this, 'mock_image_download' ), 10 );
+
+		$this->assertErrorResponse( 'rest_upload_limited_space', $response, 400 );
+	}
+
 	/**
 	 * Verifies that a URL with no usable path bails with a 400 before any
 	 * download is attempted, rather than handing an empty filename to the