WordPress: Hooking Into The Upload Action

by Curtiss   |   last updated April 8, 2011   |   PHP Tutorials ·

While WordPress implements a really nice asynchronous upload function, it doesn’t really offer any simple way to manipulate the files before they’re actually stored in your uploads folder. There are multiple filters you can hook into after the file’s been uploaded and processed; but there aren’t any filters available to do anything with the file beforehand.

However, you can hook into the check_admin_referer() function to perform some pre-upload actions. The check_admin_referer() function is generally used to make sure that the form was submitted correctly (to help avoid XSS, etc.); but it also calls the do_action() method before returning a result; meaning that you can hook into it before the upload actually happens.

The check_admin_referer() action sends two parameters: the $action being performed and the $result (generally boolean true if you’ve gotten far enough to call the action). You don’t really need the $result parameter to do what you need to do; as the check_admin_referer() method kills the script before hooking the action if the referer check fails.

Therefore, to hook into the action, you want to start by putting the hook somewhere in your plugin’s __construct() method (or hook it to the plugins_loaded() method). That might look something like:

add_action( 'check_admin_referer', array( $this, 'check_admin_referer' ) );

Then, within the class definition for your plugin, you would create a check_admin_referer() function (if your plugin doesn’t have its own class, you should call the function something other than check_admin_referer(), otherwise it will override the check_admin_referer() function built into WordPress). That function might look something like:

/**
 * Check the admin referer and change the way things are handled
 * 		if uploading from global library tab
 */
function check_admin_referer( $action ) {
	/**
     * Check to see if the $action parameter is equal to 'media-form'. If it's not,
     * 		we don't need to do anything.
     */
    if( 'media-form' !== $action )
        return;

    /**
     * Since this was called from the media-upload action, we can perform our
     * 		actions that need to happen before the upload. Once we've performed
     * 		our actions, we should exit/die, so that the script doesn't go any
     * 		further.
     * If you want the upload script to continue successfully, you should just
     * 		return an empty value instead of calling exit/die
     */
    exit;
}

As mentioned in the comments for the function, you first want to check to see if the action matches the action you’re expecting. If it doesn’t, you simply return an empty value from the function (the return value isn’t used anywhere, so there’s no need to return a real value).

If the $action does match the action you’re trying to modify, you should perform your actions and then exit. If you don’t exit, the upload script will continue.

Note: I am aware of the fact that the word “referer” is not spelled correctly. However, in PHP (and in WordPress), that is the way it’s spelled for some reason; which is why I used it that way within this article.