Commit 121d3237b4 for wordpress.org

commit 121d3237b4d69f798a65fa4d3bf4dd4a5b42c2d3
Author: desrosj <desrosj@git.wordpress.org>
Date:   Fri Nov 6 01:48:59 2026 +0000

    Media: Report failed image writes to streams.

    When saving an image to a stream, `WP_Image_Editor::make_image()` currently ignores the return values of `fwrite()` and `fclose()`. A save that failed to write the image still reported success. `WP_Image_Editor_GD` uses this path for all stream destinations.

    The buffered image is now written with `file_put_contents()`, and `make_image()` returns `false` when that fails. This happens when the stream cannot be opened or the image is only partially written. As of PHP 8.6, it also happens when flushing or closing the stream fails. For stream wrappers that only send data on flush or close, a failed upload was previously reported as a successful save.

    Streams are now written the same way as in `WP_Image_Editor_Imagick::write_image()`, so both editors report the same failures.

    Developed in https://github.com/WordPress/wordpress-develop/pull/15477.

    Props adamsilverstein.
    Fixes #66486.


    Built from https://develop.svn.wordpress.org/trunk@65294


    git-svn-id: http://core.svn.wordpress.org/trunk@64443 1a063a9b-81f0-0310-95a4-ce76da25c4cd

diff --git a/wp-includes/class-wp-image-editor.php b/wp-includes/class-wp-image-editor.php
index 90a9f12cf1..df07c4229b 100644
--- a/wp-includes/class-wp-image-editor.php
+++ b/wp-includes/class-wp-image-editor.php
@@ -559,6 +559,7 @@ abstract class WP_Image_Editor {
 	 * Either calls editor's save function or handles file as a stream.
 	 *
 	 * @since 3.5.0
+	 * @since 7.2.0 Returns false when the image cannot be fully written to a stream.
 	 *
 	 * @param string   $filename
 	 * @param callable $callback
@@ -579,15 +580,17 @@ abstract class WP_Image_Editor {
 		if ( $result && $stream ) {
 			$contents = ob_get_contents();

-			$fp = fopen( $filename, 'w' );
-
-			if ( ! $fp ) {
-				ob_end_clean();
-				return false;
+			/*
+			 * file_put_contents() returns false if the stream cannot be opened, or if fewer
+			 * bytes are written than the image contains.
+			 *
+			 * As of PHP 8.6, false is also returned when flushing or closing the stream fails.
+			 * For stream wrappers that only send data on flush or close, such a failure means
+			 * the image was never saved.
+			 */
+			if ( false === file_put_contents( $filename, $contents ) ) {
+				$result = false;
 			}
-
-			fwrite( $fp, $contents );
-			fclose( $fp );
 		}

 		if ( $stream ) {
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 0043c893f2..61d89a1495 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '7.2-beta4-65293';
+$wp_version = '7.2-beta4-65294';

 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.