[wp-trac] [WordPress Trac] #30123: Custom Mime Type filter problem in upload.php list view

[WordPress Trac]

#30123: Custom Mime Type filter problem in upload.php list view
--------------------------+------------------------------
 Reporter:  csschris      |       Owner:
     Type:  defect (bug)  |      Status:  new
 Priority:  normal        |   Milestone:  Awaiting Review
Component:  Media         |     Version:  4.0
 Severity:  normal        |  Resolution:
 Keywords:                |     Focuses:  administration
--------------------------+------------------------------

Comment (by birgire):

 As reported independently here:

 http://wordpress.stackexchange.com/questions/166560/wordpress-media-mime-
 type-filter-problem-4-0

 http://wordpress.stackexchange.com/questions/166530/post-mime-types-
 filter-not-working-in-list-mode

 there's a potential problem when filtering custom post mime types, in the
 ''list'' mode.

 When we register a custom post mime type, as suggested:

 {{{
 add_filter( 'post_mime_types', function( $post_mime_types ) {
     $post_mime_types['application/pdf'] = array( __( 'PDFs' ), __( 'Manage
 PDFs' ), _n_noop( 'PDF <span class="count">(%s)</span>', 'PDFs <span
 class="count">(%s)</span>' ) );
     return $post_mime_types;
 });

 }}}

 then it will add the following option to the select box for attachments
 filters:

 {{{
 <option value="post_mime_type:application%2Fpdf" selected="selected">PDF
 (1)</option>
 }}}

 When we submit this option, the relevant GET request becomes:

 {{{
 &attachment-filter=post_mime_type%3Aapplication%252Fpdf
 }}}

 The reason for this is the {{{urlencode}}} part:

 {{{
 '<option value="post_mime_type:' . urlencode( $mime_type )
 }}}

 Check out this source line:
 [https://core.trac.wordpress.org/browser/tags/4.0/src/wp-admin/includes
 /class-wp-media-list-table.php#L73]

 This wasn't a problem in WP 3.9 because it wasn't encoded:

 {{{
 $type_links[$mime_type] = "<a
 href='upload.php?post_mime_type=$mime_type'$class>"
 }}}

 See this code line in version 3.9:
 [https://core.trac.wordpress.org/browser/tags/3.9/src/wp-admin/includes
 /class-wp-media-list-table.php#L67]

 I wonder if we could use {{{esc_attr()}}} instead of {{{urlencode()}}}:

 {{{
 '<option value="post_mime_type:' . esc_attr( $mime_type )
 }}}

 so the HTML of the option becomes:

 {{{
 <option value="post_mime_type:application/pdf" selected="selected">PDF
 (1)</option>
 }}}

 and the {{{GET}}} request becomes:

 {{{
 &attachment-filter=post_mime_type%3Aapplication%2Fpdf
 }}}

 which works as expected.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/30123#comment:1>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform