【WordPress】メディアアップローダーに独自のファイル種別（SVG・JSONなど）を許可する方法

function custom_mime_types($mimes) {
  $mimes['svg']  = 'image/svg+xml';
  $mimes['json'] = 'application/json';
  return $mimes;
}
add_filter('upload_mimes', 'custom_mime_types');

function restrict_svg_upload_to_admin($mimes) {
  if (current_user_can('manage_options')) {
    $mimes['svg'] = 'image/svg+xml';
  }
  return $mimes;
}
add_filter('upload_mimes', 'restrict_svg_upload_to_admin');

function sanitize_svg_on_upload($file) {
  if ($file['type'] !== 'image/svg+xml') {
    return $file;
  }

  $content = file_get_contents($file['tmp_name']);

  libxml_use_internal_errors(true);
  $dom = new DOMDocument();
  if (!$dom->loadXML($content)) {
    $file['error'] = '不正なSVGファイルです。';
    return $file;
  }

  // <script>要素を削除
  foreach (iterator_to_array($dom->getElementsByTagName('script')) as $script) {
    $script->parentNode->removeChild($script);
  }

  // on*イベント属性を削除
  $xpath = new DOMXPath($dom);
  foreach (iterator_to_array($xpath->query('//@*[starts-with(name(), "on")]')) as $attr) {
    $attr->ownerElement->removeAttribute($attr->nodeName);
  }

  file_put_contents($file['tmp_name'], $dom->saveXML());
  return $file;
}
add_filter('wp_handle_upload_prefilter', 'sanitize_svg_on_upload');

function fix_svg_mime_type($data, $file, $filename, $mimes) {
  $ext = pathinfo($filename, PATHINFO_EXTENSION);
  if ($ext === 'svg') {
    $data['ext']  = 'svg';
    $data['type'] = 'image/svg+xml';
  }
  return $data;
}
add_filter('wp_check_filetype_and_ext', 'fix_svg_mime_type', 10, 4);