From f17dceed7e2ba771e1d935aa0560cced72065f5c Mon Sep 17 00:00:00 2001 From: Rodrigo Butzke Date: Tue, 27 Jan 2026 15:51:55 -0300 Subject: [PATCH 1/3] Use wp_check_filetype to determine file extension Fix WP_Customize_Media_Control::to_json() extension validation. --- .../customize/class-wp-customize-media-control.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/wp-includes/customize/class-wp-customize-media-control.php b/src/wp-includes/customize/class-wp-customize-media-control.php index af137512c41f3..46572f3cea540 100644 --- a/src/wp-includes/customize/class-wp-customize-media-control.php +++ b/src/wp-includes/customize/class-wp-customize-media-control.php @@ -92,7 +92,9 @@ public function to_json() { * Fake an attachment model - needs all fields used by template. * Note that the default value must be a URL, NOT an attachment ID. */ - $ext = substr( $this->setting->default, -3 ); + $wp_filetype = wp_check_filetype( $this->setting->default ); + $ext = $wp_filetype['ext']; + $type = in_array( $ext, array( 'jpg', 'png', 'gif', 'bmp', 'webp', 'avif' ), true ) ? 'image' : 'document'; $default_attachment = array( From 9793899ae93d18291be3498cf589dfa0d4e5372b Mon Sep 17 00:00:00 2001 From: Rodrigo Butzke Date: Tue, 27 Jan 2026 15:59:21 -0300 Subject: [PATCH 2/3] remove whitespace; --- src/wp-includes/customize/class-wp-customize-media-control.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/wp-includes/customize/class-wp-customize-media-control.php b/src/wp-includes/customize/class-wp-customize-media-control.php index 46572f3cea540..904e779ffb9f9 100644 --- a/src/wp-includes/customize/class-wp-customize-media-control.php +++ b/src/wp-includes/customize/class-wp-customize-media-control.php @@ -94,7 +94,7 @@ public function to_json() { */ $wp_filetype = wp_check_filetype( $this->setting->default ); $ext = $wp_filetype['ext']; - + $type = in_array( $ext, array( 'jpg', 'png', 'gif', 'bmp', 'webp', 'avif' ), true ) ? 'image' : 'document'; $default_attachment = array( From ffa22876e074fcf4f1d8b5e809fd087e0b280bc7 Mon Sep 17 00:00:00 2001 From: Weston Ruter Date: Thu, 29 Jan 2026 12:08:55 -0800 Subject: [PATCH 3/3] Refactor file type check to eliminate redundant variable --- .../customize/class-wp-customize-media-control.php | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/src/wp-includes/customize/class-wp-customize-media-control.php b/src/wp-includes/customize/class-wp-customize-media-control.php index 904e779ffb9f9..30eed65599696 100644 --- a/src/wp-includes/customize/class-wp-customize-media-control.php +++ b/src/wp-includes/customize/class-wp-customize-media-control.php @@ -92,9 +92,7 @@ public function to_json() { * Fake an attachment model - needs all fields used by template. * Note that the default value must be a URL, NOT an attachment ID. */ - $wp_filetype = wp_check_filetype( $this->setting->default ); - $ext = $wp_filetype['ext']; - + $ext = wp_check_filetype( $this->setting->default )['ext']; $type = in_array( $ext, array( 'jpg', 'png', 'gif', 'bmp', 'webp', 'avif' ), true ) ? 'image' : 'document'; $default_attachment = array(