fix: slash media title/alt on import, keep sideload errors out of client responses

src/Integrations/Media/MediaImporter.php

@@ -188,11 +188,21 @@ class MediaImporter
         }
 
         $title = isset($meta['title']) ? sanitize_text_field((string) $meta['title']) : null;
-        $attachmentId = $this->sideload($name, $tmp, (int) ($meta['post_id'] ?? 0), $title);
+        // media_handle_sideload() and update_post_meta() expect slashed data (they unslash).
+        $attachmentId = $this->sideload(
+            $name,
+            $tmp,
+            (int) ($meta['post_id'] ?? 0),
+            $title === null ? null : wp_slash($title)
+        );
         if ($attachmentId instanceof WP_Error) {
-            $reason = 'WordPress hat die Datei nicht übernommen: ' . $attachmentId->get_error_message();
+            // WordPress' message can contain server paths: only for the log, not for the client.
+            $message = sprintf('[wp-lit-mcp] media sideload failed: %s', $attachmentId->get_error_message());
+            error_log($message); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
 
-            return Errors::writeFailed($reason);
+            return Errors::writeFailed(
+                'WordPress hat die Datei nicht übernommen (z. B. Upload-Verzeichnis nicht beschreibbar).'
+            );
         }
 
         if (isset($meta['alt']) && $meta['alt'] !== '') {
@@ -235,7 +245,7 @@ class MediaImporter
     private function saveAlt(int $attachmentId, string $alt): void
     {
         // update_post_meta() is also false when the value is already stored (alt from IPTC data).
-        $stored = update_post_meta($attachmentId, self::ALT_KEY, $alt) !== false
+        $stored = update_post_meta($attachmentId, self::ALT_KEY, wp_slash($alt)) !== false
             || (string) get_post_meta($attachmentId, self::ALT_KEY, true) === $alt;
         if ($stored) {
             return;