Loosen-IT/WP-LIT-MCP
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

fix: restrict media-search to the query, not just editable() after it

Browse Source 
I1: query the attachments themselves author-restricted when the user
lacks edit_others_posts (PostGuard::ownPostsOnly, extracted from
ContentQueryAbility so content-query reuses the exact same rule)
instead of relying solely on a post-query editable() filter, which
could leak the existence of other users' attachments via an empty
page plus next_cursor. editable() stays as a backstop.

Also: M1 document that only status=inherit attachments are listed;
M2 tie-break ordering by ID (content-query and media-search) for
stable pagination; M3 no next_cursor once the last candidate was
examined; M4 reject an explicit non-image mime with missing_alt;
M5 additional coverage (posts_per_page, cursor offset pass-through,
invalid cursor, post_status/date/mime args); mime maxLength 100.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
This commit is contained in:
janniclas.loosen
2026-09-26 02:19:50 +02:00
co-authored by Claude Opus 5.5
parent 5099c9fc89
commit b0da2cdecc
6 changed files with 262 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Integrations/Media/MediaSearchAbility.php
+61 -12
View File
@@ -7,6 +7,7 @@ namespace LIT\MCP\Integrations\Media;
use LIT\MCP\Abilities\Ability;
use LIT\MCP\Abilities\Cursor;
use LIT\MCP\Abilities\Errors;
use LIT\MCP\Integrations\WordPress\PostGuard;
use WP_Error;
use WP_Post;
@@ -40,12 +41,13 @@ final class MediaSearchAbility implements Ability
public function description(): string
{
return 'Sucht in der Mediathek nach Text (Titel, Dateiname, Beschreibung), MIME-Typ (z. B. image oder '
. 'application/pdf) und Zeitraum. Nur Medien, die der Nutzer bearbeiten darf; Papierkorb ausgeschlossen. '
. 'missing_alt: Bilder ohne Alt-Text. unused: Medien ohne gefundene Verwendung – "keine Verwendung '
. 'gefunden" ist keine Garantie (Details je Medium über lit/media-get); als "möglicherweise verwendet" '
. 'erkannte Medien zählen bereits als verwendet und werden nicht gelistet. Prüft dafür je Aufruf '
. 'höchstens ' . self::MAX_SCAN . ' Medien; wird die Prüfung dadurch unterbrochen, folgt eine Warnung '
. 'und mit next_cursor kann fortgesetzt werden.';
. 'application/pdf) und Zeitraum. Nur Medien mit Status inherit (reguläre Mediathek-Einträge, kein '
. 'Papierkorb), die der Nutzer bearbeiten darf. missing_alt: Bilder ohne Alt-Text (mime muss dabei leer '
. 'oder ein Bild-Typ sein). unused: Medien ohne gefundene Verwendung – "keine Verwendung gefunden" ist '
. 'keine Garantie (Details je Medium über lit/media-get); als "möglicherweise verwendet" erkannte '
. 'Medien zählen bereits als verwendet und werden nicht gelistet. Prüft dafür je Aufruf höchstens '
. self::MAX_SCAN . ' Medien; wird die Prüfung dadurch unterbrochen, folgt eine Warnung und mit '
. 'next_cursor kann fortgesetzt werden.';
}
public function inputSchema(): array
@@ -54,7 +56,7 @@ final class MediaSearchAbility implements Ability
'type' => 'object',
'properties' => array_merge([
'search' => ['type' => 'string', 'maxLength' => 200],
'mime' => ['type' => 'string', 'pattern' => '^[a-z]+(/[a-z0-9.+-]+)?$'],
'mime' => ['type' => 'string', 'maxLength' => 100, 'pattern' => '^[a-z]+(/[a-z0-9.+-]+)?$'],
'date_after' => ['type' => 'string', 'pattern' => self::DATE_PATTERN],
'date_before' => ['type' => 'string', 'pattern' => self::DATE_PATTERN],
'missing_alt' => ['type' => 'boolean'],
@@ -101,6 +103,11 @@ final class MediaSearchAbility implements Ability
return Cursor::invalid();
}
$mimeError = $this->rejectNonImageMimeForMissingAlt($input);
if ($mimeError !== null) {
return $mimeError;
}
$limit = Cursor::limit($input['limit'] ?? null);
$args = $this->queryArgs($input);
@@ -118,6 +125,27 @@ final class MediaSearchAbility implements Ability
];
}
/**
* missing_alt only makes sense for images; an explicit non-image mime would otherwise
* be silently ignored (post_mime_type overwritten) and quietly return nothing.
*
* @param array<string, mixed> $input
*/
private function rejectNonImageMimeForMissingAlt(array $input): ?WP_Error
{
$mime = isset($input['mime']) ? (string) $input['mime'] : '';
$isImage = $mime === '' || $mime === 'image' || str_starts_with($mime, 'image/');
if (($input['missing_alt'] ?? false) !== true || $isImage) {
return null;
}
return Errors::invalidInput(
'missing_alt gilt nur für Bilder.',
['mime' => 'kein Bild-MIME-Typ'],
'mime weglassen, auf "image" setzen oder einen "image/…"-Subtyp verwenden.'
);
}
/**
* @param array<string, mixed> $input
* @return array<string, mixed>
@@ -127,12 +155,22 @@ final class MediaSearchAbility implements Ability
$args = [
'post_type' => 'attachment',
'post_status' => 'inherit',
'orderby' => 'date',
'order' => 'DESC',
// A secondary ID tie-breaker keeps paging stable when several attachments share
// the exact same date (common with bulk uploads).
'orderby' => ['date' => 'DESC', 'ID' => 'DESC'],
'no_found_rows' => true,
'suppress_filters' => false,
];
// Without edit_others_posts, restrict the query itself to the user's own uploads –
// filtering with editable() afterwards is not enough on its own: an unrestricted
// query could otherwise come back empty (or short) with a next_cursor that quietly
// reveals other users' attachments exist without ever showing them.
$ownerId = PostGuard::ownPostsOnly('attachment');
if ($ownerId !== null) {
$args['author'] = $ownerId;
}
if (isset($input['search']) && $input['search'] !== '') {
$args['s'] = (string) $input['search'];
}
@@ -174,6 +212,9 @@ final class MediaSearchAbility implements Ability
$page = Cursor::page(array_values($rows), $limit, $offset);
return [
// editable() stays as a backstop even though the query is already author-restricted
// above: e.g. a per-attachment cap denial (a filter, or the author losing rights
// after upload) must still drop the row instead of exposing it.
'items' => array_values(array_filter($page['items'], [self::class, 'editable'])),
'next_cursor' => $page['next_cursor'],
'warnings' => [],
@@ -197,6 +238,7 @@ final class MediaSearchAbility implements Ability
$items = [];
$position = $offset;
$examined = 0;
$reachedLimit = false;
foreach ($candidates as $attachment) {
if ($examined >= self::MAX_SCAN) {
@@ -209,15 +251,22 @@ final class MediaSearchAbility implements Ability
if (self::editable($attachment) && ! $this->finder->isUsed((int) $attachment->ID)) {
$items[] = $attachment;
if (count($items) === $limit) {
return ['items' => $items, 'next_cursor' => Cursor::encode($position), 'warnings' => []];
$reachedLimit = true;
break;
}
}
}
if (count($candidates) <= self::MAX_SCAN) {
// The extra (MAX_SCAN + 1)th candidate, when present, was deliberately never examined –
// its mere presence is enough to know more candidates remain either way.
if ($examined >= count($candidates)) {
return ['items' => $items, 'next_cursor' => null, 'warnings' => []];
}
if ($reachedLimit) {
return ['items' => $items, 'next_cursor' => Cursor::encode($position), 'warnings' => []];
}
return [
'items' => $items,
'next_cursor' => Cursor::encode($position),
@@ -228,7 +277,7 @@ final class MediaSearchAbility implements Ability
];
}
/** Only attachments the current user may edit are ever listed; trashed ones never reach here. */
/** Backstop: editable() is checked even though the query is already author-restricted. */
private static function editable(WP_Post $attachment): bool
{
return current_user_can('edit_post', (int) $attachment->ID);