Uploads Block

Added in 1.1.0. The Uploads block (lh-share-target/uploads) is an upload form for any page. It exists because iPhones cannot use an installed web app as a share target, so this is the iOS route into the same pipeline as the Android share sheet.

What people see

• Logged-in users who can edit posts: a file picker (multiple files; on iPhone it offers Take Photo, Photo Library or Files), an optional title and note, and an upload button. Progress is shown while sending, and the button is disabled until the upload finishes, so one tap uploads once.
• Visitors: a log in link that returns them to the page.
• Logged-in users who cannot edit posts: nothing.

Settings

• Button label: defaults to Upload.
• Accepted file types: the file input’s accept list, default image/*,application/pdf. This only shapes the picker; the server still applies the site’s allowed upload types.
• Send to post type: optional. When set, each upload is converted straight away to a draft of that post type (the user must be able to create it), as the share endpoint’s lh_share_target-post_type parameter does. Empty keeps uploads as staged Shares.

How it works

The form is rendered on the server. Its script posts the files, title and note as multipart/form-data to the share endpoint (lh-share-target/v1/receive) with the REST nonce, so the request is authenticated as the logged-in user. The endpoint stages the upload exactly as a share from the share sheet. The form needs JavaScript; without it a notice is shown.

Private staging

Since 1.1.1 every share is staged as a private lh_share post, and its files as inherit attachments inserted with wp_insert_attachment(), so their path is known when add_attachment fires. LH Private Uploads keys privacy on post status, so where it is active the files go straight into the site’s private directory, outside the web root. There is no direct dependency: without LH Private Uploads the files stay in normal uploads.

• Converting a share (from the editor panel or the block’s post type setting) changes its post type and makes it a draft for review. Leaving private moves its files back to public uploads.
• Expiry: a daily cron deletes staged shares (private, or draft from before 1.1.1) a week after they arrive. Deleting a share deletes its attachments with wp_delete_post(), which removes their files wherever they are stored.