Changeset 61703

Timestamp:

02/20/2026 11:49:50 AM (5 weeks ago)

Author:

adamsilverstein

Message:

Editor: backport client side media PHP changes to core.

Bring over the changes required to implement client side media in core. This feature recently graduated from experiments and is ready for testing in beta.

Props adamsilverstein, westonruter, mamaduka, mukesh27, swissspidy, andrewserong, ellatrix, ramonjd.
Fixes #62243.

Location:

trunk

Files:

• package.json (modified) (1 diff)
• src/wp-admin/edit-form-blocks.php (modified) (1 diff)
• src/wp-admin/site-editor.php (modified) (1 diff)
• src/wp-includes/default-filters.php (modified) (1 diff)
• src/wp-includes/media-template.php (modified) (2 diffs)
• src/wp-includes/media.php (modified) (1 diff)
• src/wp-includes/rest-api/class-wp-rest-server.php (modified) (1 diff)
• src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php (modified) (12 diffs)
• src/wp-includes/script-loader.php (modified) (1 diff)
• tests/phpunit/tests/rest-api/rest-attachments-controller.php (modified) (1 diff)
• tests/phpunit/tests/rest-api/rest-schema-setup.php (modified) (1 diff)
• tests/qunit/fixtures/wp-api-generated.js (modified) (5 diffs)
• tools/gutenberg/copy-gutenberg-build.js (modified) (2 diffs)

trunk/package.json

@@ -8 +8 @@
     },
     "gutenberg": {
-        "ref": "7a11a53377a95cba4d3786d71cadd4c2f0c5ac52"
+        "ref": "b441348bb7e05af351c250b74283f253acaf9138"
     },
     "engines": {

trunk/src/wp-admin/edit-form-blocks.php

@@ -93 +93 @@
             'gmt_offset',
             'home',
+            'image_sizes',
+            'image_size_threshold',
+            'image_output_formats',
+            'jpeg_interlaced',
+            'png_interlaced',
+            'gif_interlaced',
             'name',
             'site_icon',

trunk/src/wp-admin/site-editor.php

@@ -219 +219 @@
             'gmt_offset',
             'home',
+            'image_sizes',
+            'image_size_threshold',
+            'image_output_formats',
+            'jpeg_interlaced',
+            'png_interlaced',
+            'gif_interlaced',
             'name',
             'site_icon',

trunk/src/wp-includes/default-filters.php

@@ -676 +676 @@
 add_filter( 'plupload_default_settings', 'wp_show_heic_upload_error' );
 
+// Client-side media processing.
+add_action( 'admin_init', 'wp_set_client_side_media_processing_flag' );
+// Cross-origin isolation for client-side media processing.
+add_action( 'load-post.php', 'wp_set_up_cross_origin_isolation' );
+add_action( 'load-post-new.php', 'wp_set_up_cross_origin_isolation' );
+add_action( 'load-site-editor.php', 'wp_set_up_cross_origin_isolation' );
+add_action( 'load-widgets.php', 'wp_set_up_cross_origin_isolation' );
 // Nav menu.
 add_filter( 'nav_menu_item_id', '_nav_menu_item_id_use_once', 10, 2 );

trunk/src/wp-includes/media-template.php

@@ -157 +157 @@
     $class = 'media-modal wp-core-ui';
 
+    $is_cross_origin_isolation_enabled = wp_is_client_side_media_processing_enabled();
+
+    if ( $is_cross_origin_isolation_enabled ) {
+        ob_start();
+    }
+
     $alt_text_description = sprintf(
         /* translators: 1: Link to tutorial, 2: Additional link attributes, 3: Accessibility text. */
@@ -1583 +1589 @@
      */
     do_action( 'print_media_templates' );
+
+    if ( $is_cross_origin_isolation_enabled ) {
+        $html = (string) ob_get_clean();
+
+        /*
+         * The media templates are inside <script type="text/html"> tags,
+         * whose content is treated as raw text by the HTML Tag Processor.
+         * Extract each script block's content, process it separately,
+         * then reassemble the full output.
+         */
+        $script_processor = new WP_HTML_Tag_Processor( $html );
+        while ( $script_processor->next_tag( 'SCRIPT' ) ) {
+            if ( 'text/html' !== $script_processor->get_attribute( 'type' ) ) {
+                continue;
+            }
+            /*
+             * Unlike wp_add_crossorigin_attributes(), this does not check whether
+             * URLs are actually cross-origin. Media templates use Underscore.js
+             * template expressions (e.g. {{ data.url }}) as placeholder URLs,
+             * so actual URLs are not available at parse time.
+             * The crossorigin attribute is added unconditionally to all relevant
+             * media tags to ensure cross-origin isolation works regardless of
+             * the final URL value at render time.
+             */
+            $template_processor = new WP_HTML_Tag_Processor( $script_processor->get_modifiable_text() );
+            while ( $template_processor->next_tag() ) {
+                if (
+                    in_array( $template_processor->get_tag(), array( 'AUDIO', 'IMG', 'VIDEO' ), true )
+                    && ! is_string( $template_processor->get_attribute( 'crossorigin' ) )
+                ) {
+                    $template_processor->set_attribute( 'crossorigin', 'anonymous' );
+                }
+            }
+            $script_processor->set_modifiable_text( $template_processor->get_updated_html() );
+        }
+
+        echo $script_processor->get_updated_html();
+    }
 }

trunk/src/wp-includes/media.php

@@ -6360 +6360 @@
     return apply_filters( 'image_editor_output_format', $output_format, $filename, $mime_type );
 }
+
+/**
+ * Checks whether client-side media processing is enabled.
+ *
+ * Client-side media processing uses the browser's capabilities to handle
+ * tasks like image resizing and compression before uploading to the server.
+ *
+ * @since 7.0.0
+ *
+ * @return bool Whether client-side media processing is enabled.
+ */
+function wp_is_client_side_media_processing_enabled(): bool {
+    /**
+     * Filters whether client-side media processing is enabled.
+     *
+     * @since 7.0.0
+     *
+     * @param bool $enabled Whether client-side media processing is enabled. Default true.
+     */
+    return (bool) apply_filters( 'wp_client_side_media_processing_enabled', true );
+}
+
+/**
+ * Sets a global JS variable to indicate that client-side media processing is enabled.
+ *
+ * @since 7.0.0
+ */
+function wp_set_client_side_media_processing_flag(): void {
+    if ( ! wp_is_client_side_media_processing_enabled() ) {
+        return;
+    }
+
+    wp_add_inline_script( 'wp-block-editor', 'window.__clientSideMediaProcessing = true', 'before' );
+
+    /*
+     * Register the @wordpress/vips/worker script module as a dynamic dependency
+     * of the wp-upload-media classic script. This ensures it is included in the
+     * import map so that the dynamic import() in upload-media.js can resolve it.
+     */
+    wp_scripts()->add_data(
+        'wp-upload-media',
+        'module_dependencies',
+        array( '@wordpress/vips/worker' )
+    );
+}
+
+/**
+ * Enables cross-origin isolation in the block editor.
+ *
+ * Required for enabling SharedArrayBuffer for WebAssembly-based
+ * media processing in the editor.
+ *
+ * @since 7.0.0
+ *
+ * @link https://web.dev/coop-coep/
+ */
+function wp_set_up_cross_origin_isolation(): void {
+    if ( ! wp_is_client_side_media_processing_enabled() ) {
+        return;
+    }
+
+    $screen = get_current_screen();
+
+    if ( ! $screen ) {
+        return;
+    }
+
+    if ( ! $screen->is_block_editor() && 'site-editor' !== $screen->id && ! ( 'widgets' === $screen->id && wp_use_widgets_block_editor() ) ) {
+        return;
+    }
+
+    // Cross-origin isolation is not needed if users can't upload files anyway.
+    if ( ! current_user_can( 'upload_files' ) ) {
+        return;
+    }
+
+    wp_start_cross_origin_isolation_output_buffer();
+}
+
+/**
+ * Starts an output buffer to send cross-origin isolation headers.
+ *
+ * Sends headers and uses an output buffer to add crossorigin="anonymous"
+ * attributes where needed.
+ *
+ * @since 7.0.0
+ *
+ * @link https://web.dev/coop-coep/
+ *
+ * @global bool $is_safari
+ */
+function wp_start_cross_origin_isolation_output_buffer(): void {
+    global $is_safari;
+
+    $coep = $is_safari ? 'require-corp' : 'credentialless';
+
+    ob_start(
+        static function ( string $output ) use ( $coep ): string {
+            header( 'Cross-Origin-Opener-Policy: same-origin' );
+            header( "Cross-Origin-Embedder-Policy: $coep" );
+
+            return wp_add_crossorigin_attributes( $output );
+        }
+    );
+}
+
+/**
+ * Adds crossorigin="anonymous" to relevant tags in the given HTML string.
+ *
+ * @since 7.0.0
+ *
+ * @param string $html HTML input.
+ * @return string Modified HTML.
+ */
+function wp_add_crossorigin_attributes( string $html ): string {
+    $site_url = site_url();
+
+    $processor = new WP_HTML_Tag_Processor( $html );
+
+    // See https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/crossorigin.
+    $cross_origin_tag_attributes = array(
+        'AUDIO'  => array( 'src' => false ),
+        'IMG'    => array(
+            'src'    => false,
+            'srcset' => true,
+        ),
+        'LINK'   => array(
+            'href'        => false,
+            'imagesrcset' => true,
+        ),
+        'SCRIPT' => array( 'src' => false ),
+        'VIDEO'  => array(
+            'src'    => false,
+            'poster' => false,
+        ),
+        'SOURCE' => array( 'src' => false ),
+    );
+
+    while ( $processor->next_tag() ) {
+        $tag = $processor->get_tag();
+
+        if ( ! isset( $cross_origin_tag_attributes[ $tag ] ) ) {
+            continue;
+        }
+
+        if ( 'AUDIO' === $tag || 'VIDEO' === $tag ) {
+            $processor->set_bookmark( 'audio-video-parent' );
+        }
+
+        $processor->set_bookmark( 'resume' );
+
+        $sought = false;
+
+        $crossorigin = $processor->get_attribute( 'crossorigin' );
+
+        $is_cross_origin = false;
+
+        foreach ( $cross_origin_tag_attributes[ $tag ] as $attr => $is_srcset ) {
+            if ( $is_srcset ) {
+                $srcset = $processor->get_attribute( $attr );
+                if ( is_string( $srcset ) ) {
+                    foreach ( explode( ',', $srcset ) as $candidate ) {
+                        $candidate_url = strtok( trim( $candidate ), ' ' );
+                        if ( is_string( $candidate_url ) && '' !== $candidate_url && ! str_starts_with( $candidate_url, $site_url ) && ! str_starts_with( $candidate_url, '/' ) ) {
+                            $is_cross_origin = true;
+                            break;
+                        }
+                    }
+                }
+            } else {
+                $url = $processor->get_attribute( $attr );
+                if ( is_string( $url ) && ! str_starts_with( $url, $site_url ) && ! str_starts_with( $url, '/' ) ) {
+                    $is_cross_origin = true;
+                }
+            }
+
+            if ( $is_cross_origin ) {
+                break;
+            }
+        }
+
+        if ( $is_cross_origin && ! is_string( $crossorigin ) ) {
+            if ( 'SOURCE' === $tag ) {
+                $sought = $processor->seek( 'audio-video-parent' );
+
+                if ( $sought ) {
+                    $processor->set_attribute( 'crossorigin', 'anonymous' );
+                }
+            } else {
+                $processor->set_attribute( 'crossorigin', 'anonymous' );
+            }
+
+            if ( $sought ) {
+                $processor->seek( 'resume' );
+                $processor->release_bookmark( 'audio-video-parent' );
+            }
+        }
+    }
+
+    return $processor->get_updated_html();
+}
+

trunk/src/wp-includes/rest-api/class-wp-rest-server.php

@@ -1369 +1369 @@
         );
 
+        // Add media processing settings for users who can upload files.
+        if ( wp_is_client_side_media_processing_enabled() && current_user_can( 'upload_files' ) ) {
+            // Image sizes keyed by name for client-side media processing.
+            $available['image_sizes'] = array();
+            foreach ( wp_get_registered_image_subsizes() as $name => $size ) {
+                $available['image_sizes'][ $name ] = $size;
+            }
+
+            /** This filter is documented in wp-admin/includes/image.php */
+            $available['image_size_threshold'] = (int) apply_filters( 'big_image_size_threshold', 2560, array( 0, 0 ), '', 0 );
+
+            // Image output formats.
+            $input_formats  = array( 'image/jpeg', 'image/png', 'image/gif', 'image/webp', 'image/avif', 'image/heic' );
+            $output_formats = array();
+            foreach ( $input_formats as $mime_type ) {
+                /** This filter is documented in wp-includes/class-wp-image-editor.php */
+                $output_formats = apply_filters( 'image_editor_output_format', $output_formats, '', $mime_type );
+            }
+            $available['image_output_formats'] = (object) $output_formats;
+
+            /** This filter is documented in wp-includes/class-wp-image-editor-imagick.php */
+            $available['jpeg_interlaced'] = (bool) apply_filters( 'image_save_progressive', false, 'image/jpeg' );
+            /** This filter is documented in wp-includes/class-wp-image-editor-imagick.php */
+            $available['png_interlaced']  = (bool) apply_filters( 'image_save_progressive', false, 'image/png' );
+            /** This filter is documented in wp-includes/class-wp-image-editor-imagick.php */
+            $available['gif_interlaced']  = (bool) apply_filters( 'image_save_progressive', false, 'image/gif' );
+        }
+
         $response = new WP_REST_Response( $available );
 

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php

@@ -64 +64 @@
             )
         );
+
+        if ( wp_is_client_side_media_processing_enabled() ) {
+            $valid_image_sizes = array_keys( wp_get_registered_image_subsizes() );
+            // Special case to set 'original_image' in attachment metadata.
+            $valid_image_sizes[] = 'original';
+            // Used for PDF thumbnails.
+            $valid_image_sizes[] = 'full';
+
+            register_rest_route(
+                $this->namespace,
+                '/' . $this->rest_base . '/(?P<id>[\d]+)/sideload',
+                array(
+                    array(
+                        'methods'             => WP_REST_Server::CREATABLE,
+                        'callback'            => array( $this, 'sideload_item' ),
+                        'permission_callback' => array( $this, 'sideload_item_permissions_check' ),
+                        'args'                => array(
+                            'id'             => array(
+                                'description' => __( 'Unique identifier for the attachment.' ),
+                                'type'        => 'integer',
+                            ),
+                            'image_size'     => array(
+                                'description' => __( 'Image size.' ),
+                                'type'        => 'string',
+                                'enum'        => $valid_image_sizes,
+                                'required'    => true,
+                            ),
+                            'convert_format' => array(
+                                'type'        => 'boolean',
+                                'default'     => true,
+                                'description' => __( 'Whether to convert image formats.' ),
+                            ),
+                        ),
+                    ),
+                    'allow_batch' => $this->allow_batch,
+                    'schema'      => array( $this, 'get_public_item_schema' ),
+                )
+            );
+        }
+    }
+
+    /**
+     * Retrieves the query params for the attachments collection.
+     *
+     * @since 7.0.0
+     *
+     * @param string $method Optional. HTTP method of the request.
+     *                       The arguments for `CREATABLE` requests are
+     *                       checked for required values and may fall-back to a given default.
+     *                       Default WP_REST_Server::CREATABLE.
+     * @return array<string, array<string, mixed>> Endpoint arguments.
+     */
+    public function get_endpoint_args_for_item_schema( $method = WP_REST_Server::CREATABLE ) {
+        $args = parent::get_endpoint_args_for_item_schema( $method );
+
+        if ( WP_REST_Server::CREATABLE === $method && wp_is_client_side_media_processing_enabled() ) {
+            $args['generate_sub_sizes'] = array(
+                'type'        => 'boolean',
+                'default'     => true,
+                'description' => __( 'Whether to generate image sub sizes.' ),
+            );
+            $args['convert_format']     = array(
+                'type'        => 'boolean',
+                'default'     => true,
+                'description' => __( 'Whether to convert image formats.' ),
+            );
+        }
+
+        return $args;
     }
 
@@ -193 +262 @@
      *
      * @since 4.7.0
+     * @since 7.0.0 Added `generate_sub_sizes` and `convert_format` parameters.
      *
      * @param WP_REST_Request $request Full details about the request.
@@ -206 +276 @@
         }
 
+        // Handle generate_sub_sizes parameter.
+        if ( isset( $request['generate_sub_sizes'] ) && ! $request['generate_sub_sizes'] ) {
+            add_filter( 'intermediate_image_sizes_advanced', '__return_empty_array', 100 );
+            add_filter( 'fallback_intermediate_image_sizes', '__return_empty_array', 100 );
+            // Disable server-side EXIF rotation so the client can handle it.
+            // This preserves the original orientation value in the metadata.
+            add_filter( 'wp_image_maybe_exif_rotate', '__return_false', 100 );
+        }
+
+        // Handle convert_format parameter.
+        if ( isset( $request['convert_format'] ) && ! $request['convert_format'] ) {
+            add_filter( 'image_editor_output_format', '__return_empty_array', 100 );
+        }
+
         $insert = $this->insert_attachment( $request );
 
         if ( is_wp_error( $insert ) ) {
+            $this->remove_client_side_media_processing_filters();
             return $insert;
         }
@@ -226 +311 @@
 
             if ( is_wp_error( $thumbnail_update ) ) {
+                $this->remove_client_side_media_processing_filters();
                 return $thumbnail_update;
             }
@@ -234 +320 @@
 
             if ( is_wp_error( $meta_update ) ) {
+                $this->remove_client_side_media_processing_filters();
                 return $meta_update;
             }
@@ -242 +329 @@
 
         if ( is_wp_error( $fields_update ) ) {
+            $this->remove_client_side_media_processing_filters();
             return $fields_update;
         }
@@ -248 +336 @@
 
         if ( is_wp_error( $terms_update ) ) {
+            $this->remove_client_side_media_processing_filters();
             return $terms_update;
         }
@@ -284 +373 @@
         wp_update_attachment_metadata( $attachment_id, wp_generate_attachment_metadata( $attachment_id, $file ) );
 
+        $this->remove_client_side_media_processing_filters();
+
         $response = $this->prepare_item_for_response( $attachment, $request );
         $response = rest_ensure_response( $response );
@@ -290 +381 @@
 
         return $response;
+    }
+
+    /**
+     * Removes filters added for client-side media processing.
+     *
+     * @since 7.0.0
+     */
+    private function remove_client_side_media_processing_filters() {
+        remove_filter( 'intermediate_image_sizes_advanced', '__return_empty_array', 100 );
+        remove_filter( 'fallback_intermediate_image_sizes', '__return_empty_array', 100 );
+        remove_filter( 'wp_image_maybe_exif_rotate', '__return_false', 100 );
+        remove_filter( 'image_editor_output_format', '__return_empty_array', 100 );
     }
 
@@ -989 +1092 @@
             require_once ABSPATH . 'wp-admin/includes/image.php';
             $data['missing_image_sizes'] = array_keys( wp_get_missing_image_subsizes( $post->ID ) );
+
+            // Handle PDFs which don't use wp_get_missing_image_subsizes().
+            if ( empty( $data['missing_image_sizes'] ) && 'application/pdf' === get_post_mime_type( $post ) ) {
+                $metadata = wp_get_attachment_metadata( $post->ID, true );
+
+                if ( ! is_array( $metadata ) ) {
+                    $metadata = array();
+                }
+
+                $metadata['sizes'] = $metadata['sizes'] ?? array();
+
+                $fallback_sizes = array(
+                    'thumbnail',
+                    'medium',
+                    'large',
+                );
+
+                // The filter might have been added by ::create_item().
+                remove_filter( 'fallback_intermediate_image_sizes', '__return_empty_array', 100 );
+
+                /** This filter is documented in wp-admin/includes/image.php */
+                $fallback_sizes = apply_filters( 'fallback_intermediate_image_sizes', $fallback_sizes, $metadata );
+
+                $registered_sizes = wp_get_registered_image_subsizes();
+                $merged_sizes     = array_keys( array_intersect_key( $registered_sizes, array_flip( $fallback_sizes ) ) );
+
+                $data['missing_image_sizes'] = array_values( array_diff( $merged_sizes, array_keys( $metadata['sizes'] ) ) );
+            }
+        }
+
+        if ( in_array( 'filename', $fields, true ) ) {
+            $data['filename'] = $this->get_attachment_filename( $post->ID );
+        }
+
+        if ( in_array( 'filesize', $fields, true ) ) {
+            $data['filesize'] = $this->get_attachment_filesize( $post->ID );
+        }
+
+        if ( in_array( 'exif_orientation', $fields, true ) && wp_attachment_is_image( $post ) ) {
+            $metadata = wp_get_attachment_metadata( $post->ID, true );
+
+            // Default to 1 (no rotation needed) if orientation not set.
+            $orientation = 1;
+
+            if (
+                is_array( $metadata ) &&
+                isset( $metadata['image_meta']['orientation'] ) &&
+                (int) $metadata['image_meta']['orientation'] > 0
+            ) {
+                $orientation = (int) $metadata['image_meta']['orientation'];
+            }
+
+            $data['exif_orientation'] = $orientation;
         }
 
@@ -1156 +1312 @@
             'type'        => 'array',
             'items'       => array( 'type' => 'string' ),
+            'context'     => array( 'edit' ),
+            'readonly'    => true,
+        );
+
+        $schema['properties']['filename'] = array(
+            'description' => __( 'Original attachment file name.' ),
+            'type'        => 'string',
+            'context'     => array( 'view', 'edit' ),
+            'readonly'    => true,
+        );
+
+        $schema['properties']['filesize'] = array(
+            'description' => __( 'Attachment file size in bytes.' ),
+            'type'        => 'integer',
+            'context'     => array( 'view', 'edit' ),
+            'readonly'    => true,
+        );
+
+        $schema['properties']['exif_orientation'] = array(
+            'description' => __( 'EXIF orientation value. Values 1-8 follow the EXIF specification, where 1 means no rotation needed.' ),
+            'type'        => 'integer',
             'context'     => array( 'edit' ),
             'readonly'    => true,
@@ -1725 +1902 @@
         return $args;
     }
+
+    /**
+     * Gets the attachment's original file name.
+     *
+     * @since 7.0.0
+     *
+     * @param int $attachment_id Attachment ID.
+     * @return string|null Attachment file name, or null if not found.
+     */
+    protected function get_attachment_filename( int $attachment_id ): ?string {
+        $path = wp_get_original_image_path( $attachment_id );
+
+        if ( $path ) {
+            return wp_basename( $path );
+        }
+
+        $path = get_attached_file( $attachment_id );
+
+        if ( $path ) {
+            return wp_basename( $path );
+        }
+
+        return null;
+    }
+
+    /**
+     * Gets the attachment's file size in bytes.
+     *
+     * @since 7.0.0
+     *
+     * @param int $attachment_id Attachment ID.
+     * @return int|null Attachment file size in bytes, or null if not available.
+     */
+    protected function get_attachment_filesize( int $attachment_id ): ?int {
+        $meta = wp_get_attachment_metadata( $attachment_id );
+
+        if ( isset( $meta['filesize'] ) ) {
+            return $meta['filesize'];
+        }
+
+        $original_path = wp_get_original_image_path( $attachment_id );
+        $attached_file = $original_path ? $original_path : get_attached_file( $attachment_id );
+
+        if ( is_string( $attached_file ) && is_readable( $attached_file ) ) {
+            return wp_filesize( $attached_file );
+        }
+
+        return null;
+    }
+
+    /**
+     * Checks if a given request has access to sideload a file.
+     *
+     * Sideloading a file for an existing attachment
+     * requires both update and create permissions.
+     *
+     * @since 7.0.0
+     *
+     * @param WP_REST_Request $request Full details about the request.
+     * @return true|WP_Error True if the request has access to update the item, WP_Error object otherwise.
+     */
+    public function sideload_item_permissions_check( $request ) {
+        return $this->edit_media_item_permissions_check( $request );
+    }
+
+    /**
+     * Side-loads a media file without creating a new attachment.
+     *
+     * @since 7.0.0
+     *
+     * @param WP_REST_Request $request Full details about the request.
+     * @return WP_REST_Response|WP_Error Response object on success, WP_Error object on failure.
+     */
+    public function sideload_item( WP_REST_Request $request ) {
+        $attachment_id = $request['id'];
+
+        $post = $this->get_post( $attachment_id );
+
+        if ( is_wp_error( $post ) ) {
+            return $post;
+        }
+
+        if (
+            ! wp_attachment_is_image( $post ) &&
+            ! wp_attachment_is( 'pdf', $post )
+        ) {
+            return new WP_Error(
+                'rest_post_invalid_id',
+                __( 'Invalid post ID. Only images and PDFs can be sideloaded.' ),
+                array( 'status' => 400 )
+            );
+        }
+
+        if ( isset( $request['convert_format'] ) && ! $request['convert_format'] ) {
+            // Prevent image conversion as that is done client-side.
+            add_filter( 'image_editor_output_format', '__return_empty_array', 100 );
+        }
+
+        // Get the file via $_FILES or raw data.
+        $files   = $request->get_file_params();
+        $headers = $request->get_headers();
+
+        /*
+         * wp_unique_filename() will always add numeric suffix if the name looks like a sub-size to avoid conflicts.
+         * See /wp-includes/functions.php.
+         * With the following filter we can work around this safeguard.
+         */
+        $attachment_filename = get_attached_file( $attachment_id, true );
+        $attachment_filename = $attachment_filename ? wp_basename( $attachment_filename ) : null;
+
+        $filter_filename = static function ( $filename, $ext, $dir, $unique_filename_callback, $alt_filenames, $number ) use ( $attachment_filename ) {
+            return self::filter_wp_unique_filename( $filename, $dir, $number, $attachment_filename );
+        };
+
+        add_filter( 'wp_unique_filename', $filter_filename, 10, 6 );
+
+        $parent_post = get_post_parent( $attachment_id );
+
+        $time = null;
+
+        // Matches logic in media_handle_upload().
+        // The post date doesn't usually matter for pages, so don't backdate this upload.
+        if ( $parent_post && 'page' !== $parent_post->post_type && ! str_starts_with( $parent_post->post_date, '0000-00-00' ) ) {
+            $time = $parent_post->post_date;
+        }
+
+        if ( ! empty( $files ) ) {
+            $file = $this->upload_from_file( $files, $headers, $time );
+        } else {
+            $file = $this->upload_from_data( $request->get_body(), $headers, $time );
+        }
+
+        remove_filter( 'wp_unique_filename', $filter_filename );
+        remove_filter( 'image_editor_output_format', '__return_empty_array', 100 );
+
+        if ( is_wp_error( $file ) ) {
+            return $file;
+        }
+
+        $type = $file['type'];
+        $path = $file['file'];
+
+        $image_size = $request['image_size'];
+
+        $metadata = wp_get_attachment_metadata( $attachment_id, true );
+
+        if ( ! $metadata ) {
+            $metadata = array();
+        }
+
+        if ( 'original' === $image_size ) {
+            $metadata['original_image'] = wp_basename( $path );
+        } else {
+            $metadata['sizes'] = $metadata['sizes'] ?? array();
+
+            $size = wp_getimagesize( $path );
+
+            $metadata['sizes'][ $image_size ] = array(
+                'width'     => $size ? $size[0] : 0,
+                'height'    => $size ? $size[1] : 0,
+                'file'      => wp_basename( $path ),
+                'mime-type' => $type,
+                'filesize'  => wp_filesize( $path ),
+            );
+        }
+
+        wp_update_attachment_metadata( $attachment_id, $metadata );
+
+        $response_request = new WP_REST_Request(
+            WP_REST_Server::READABLE,
+            rest_get_route_for_post( $attachment_id )
+        );
+
+        $response_request['context'] = 'edit';
+
+        if ( isset( $request['_fields'] ) ) {
+            $response_request['_fields'] = $request['_fields'];
+        }
+
+        $response = $this->prepare_item_for_response( get_post( $attachment_id ), $response_request );
+
+        $response->header( 'Location', rest_url( rest_get_route_for_post( $attachment_id ) ) );
+
+        return $response;
+    }
+
+    /**
+     * Filters wp_unique_filename during sideloads.
+     *
+     * wp_unique_filename() will always add numeric suffix if the name looks like a sub-size to avoid conflicts.
+     * Adding this closure to the filter helps work around this safeguard.
+     *
+     * Example: when uploading myphoto.jpeg, WordPress normally creates myphoto-150x150.jpeg,
+     * and when uploading myphoto-150x150.jpeg, it will be renamed to myphoto-150x150-1.jpeg
+     * However, here it is desired not to add the suffix in order to maintain the same
+     * naming convention as if the file was uploaded regularly.
+     *
+     * @since 7.0.0
+     *
+     * @link https://github.com/WordPress/wordpress-develop/blob/30954f7ac0840cfdad464928021d7f380940c347/src/wp-includes/functions.php#L2576-L2582
+     *
+     * @param string      $filename            Unique file name.
+     * @param string      $dir                 Directory path.
+     * @param int|string  $number              The highest number that was used to make the file name unique
+     *                                         or an empty string if unused.
+     * @param string|null $attachment_filename Original attachment file name.
+     * @return string Filtered file name.
+     */
+    private static function filter_wp_unique_filename( $filename, $dir, $number, $attachment_filename ) {
+        if ( empty( $number ) || ! $attachment_filename ) {
+            return $filename;
+        }
+
+        $ext       = pathinfo( $filename, PATHINFO_EXTENSION );
+        $name      = pathinfo( $filename, PATHINFO_FILENAME );
+        $orig_name = pathinfo( $attachment_filename, PATHINFO_FILENAME );
+
+        if ( ! $ext || ! $name ) {
+            return $filename;
+        }
+
+        $matches = array();
+        if ( preg_match( '/(.*)(-\d+x\d+)-' . $number . '$/', $name, $matches ) ) {
+            $filename_without_suffix = $matches[1] . $matches[2] . ".$ext";
+            if ( $matches[1] === $orig_name && ! file_exists( "$dir/$filename_without_suffix" ) ) {
+                return $filename_without_suffix;
+            }
+        }
+
+        return $filename;
+    }
 }

trunk/src/wp-includes/script-loader.php

@@ -310 +310 @@
 
         $scripts->add( $handle, $path, $dependencies, $package_data['version'], 1 );
+
+        if ( ! empty( $package_data['module_dependencies'] ) ) {
+            $scripts->add_data( $handle, 'module_dependencies', $package_data['module_dependencies'] );
+        }
 
         if ( in_array( 'wp-i18n', $dependencies, true ) ) {

trunk/tests/phpunit/tests/rest-api/rest-attachments-controller.php

@@ -1940 +1940 @@
         $data       = $response->get_data();
         $properties = $data['schema']['properties'];
-        $this->assertCount( 29, $properties );
+        $this->assertCount( 32, $properties );
         $this->assertArrayHasKey( 'author', $properties );
         $this->assertArrayHasKey( 'alt_text', $properties );
+        $this->assertArrayHasKey( 'exif_orientation', $properties );
+        $this->assertArrayHasKey( 'filename', $properties );
+        $this->assertArrayHasKey( 'filesize', $properties );
         $this->assertArrayHasKey( 'caption', $properties );
         $this->assertArrayHasKey( 'raw', $properties['caption']['properties'] );

trunk/tests/phpunit/tests/rest-api/rest-schema-setup.php

@@ -110 +110 @@
             '/wp/v2/media/(?P<id>[\\d]+)/post-process',
             '/wp/v2/media/(?P<id>[\\d]+)/edit',
+            '/wp/v2/media/(?P<id>[\\d]+)/sideload',
             '/wp/v2/blocks',
             '/wp/v2/blocks/(?P<id>[\d]+)',

trunk/tests/qunit/fixtures/wp-api-generated.js

@@ -3148 +3148 @@
                             "description": "The ID for the associated post of the attachment.",
                             "type": "integer",
+                            "required": false
+                        },
+                        "generate_sub_sizes": {
+                            "type": "boolean",
+                            "default": true,
+                            "description": "Whether to generate image sub sizes.",
+                            "required": false
+                        },
+                        "convert_format": {
+                            "type": "boolean",
+                            "default": true,
+                            "description": "Whether to convert image formats.",
                             "required": false
                         }
@@ -3665 +3677 @@
             ]
         },
+        "/wp/v2/media/(?P<id>[\\d]+)/sideload": {
+            "namespace": "wp/v2",
+            "methods": [
+                "POST"
+            ],
+            "endpoints": [
+                {
+                    "methods": [
+                        "POST"
+                    ],
+                    "args": {
+                        "id": {
+                            "description": "Unique identifier for the attachment.",
+                            "type": "integer",
+                            "required": false
+                        },
+                        "image_size": {
+                            "description": "Image size.",
+                            "type": "string",
+                            "enum": [
+                                "thumbnail",
+                                "medium",
+                                "medium_large",
+                                "large",
+                                "1536x1536",
+                                "2048x2048",
+                                "original",
+                                "full"
+                            ],
+                            "required": true
+                        },
+                        "convert_format": {
+                            "type": "boolean",
+                            "default": true,
+                            "description": "Whether to convert image formats.",
+                            "required": false
+                        }
+                    }
+                }
+            ]
+        },
         "/wp/v2/menu-items": {
             "namespace": "wp/v2",
@@ -12701 +12754 @@
         }
     },
+    "image_sizes": {
+        "thumbnail": {
+            "width": 150,
+            "height": 150,
+            "crop": true
+        },
+        "medium": {
+            "width": 300,
+            "height": 300,
+            "crop": false
+        },
+        "medium_large": {
+            "width": 768,
+            "height": 0,
+            "crop": false
+        },
+        "large": {
+            "width": 1024,
+            "height": 1024,
+            "crop": false
+        },
+        "1536x1536": {
+            "width": 1536,
+            "height": 1536,
+            "crop": false
+        },
+        "2048x2048": {
+            "width": 2048,
+            "height": 2048,
+            "crop": false
+        }
+    },
+    "image_size_threshold": 2560,
+    "image_output_formats": {},
+    "jpeg_interlaced": false,
+    "png_interlaced": false,
+    "gif_interlaced": false,
     "site_logo": 0,
     "site_icon": 0,
@@ -13513 +13603 @@
         "post": null,
         "source_url": "http://example.org/wp-content/uploads//tmp/canola.jpg",
+        "filename": "canola.jpg",
+        "filesize": null,
         "_links": {
             "self": [
@@ -13590 +13682 @@
     "media_details": {},
     "post": null,
-    "source_url": "http://example.org/wp-content/uploads//tmp/canola.jpg"
+    "source_url": "http://example.org/wp-content/uploads//tmp/canola.jpg",
+    "filename": "canola.jpg",
+    "filesize": null
 };
 

trunk/tools/gutenberg/copy-gutenberg-build.js

@@ -442 +442 @@
                 const assetData = parsePHPArray( match[ 1 ] );
 
-                // For regular scripts, use dependencies as-is
-                // Keep dependencies array (don't use module_dependencies)
+                // For regular scripts, use dependencies as-is.
                 if ( ! assetData.dependencies ) {
                     assetData.dependencies = [];
                 }
-
-                // Remove module_dependencies if present (not used for regular scripts)
-                delete assetData.module_dependencies;
 
                 // Create entries for both minified and non-minified versions
@@ -921 +917 @@
     const scriptsDest = path.join( wpIncludesDir, scriptsConfig.destination );
 
-    // Transform function to remove source map comments from all JS files
+    // Transform function to remove source map comments from all JS files.
+    // Only match actual source map comments at the start of a line (possibly
+    // with whitespace), not occurrences inside string literals.
     const removeSourceMaps = ( content ) => {
-        return content.replace( /\/\/# sourceMappingURL=.*$/gm, '' ).trimEnd();
+        return content.replace( /^\s*\/\/# sourceMappingURL=.*$/gm, '' ).trimEnd();
     };