README

A media browser for S3-compatible storage, inside the WordPress admin.

What it does

Files sold as downloads usually live in object storage rather than the media library, and the moment they do, attaching one to a product means copying a key out of another tab.

This adds a browser beside the media library: buckets, folders, search, upload and a link back into whatever field asked for it. Underneath it is arraypress/wp-s3-signer, so nothing is made public and uploads go straight from the browser to storage rather than through PHP.

Features

Browse buckets and folders from the admin, without leaving WordPress
Upload straight to storage from the browser, bypassing the PHP upload limit
Attach a file to a field, the way the media library does
Confine a browser to one bucket, or to certain post types
Require a capability, so not everyone who can edit can see storage
Run more than one browser on a site, each on its own provider and context
Work against R2, B2, Wasabi, DigitalOcean, MinIO or anything S3-compatible

Installation

composer require arraypress/wp-s3-browser

Quick start

use ArrayPress\S3\Browser;
use ArrayPress\S3\Provider;

$browser = new Browser(
	Provider::r2( 'your-account-id' ),
	$access_key,
	$secret_key,
	[ 'download' ],   // post types this browser appears for; [] means all
	'my-bucket',      // bucket it opens on
	'upload_files',   // capability required to use it
	'edd'             // context: which integration this instance serves
);

$browser->set_allowed_buckets( [ 'my-bucket' ] );

Confining it to one bucket is worth doing whenever you can — the credentials usually reach more than the browser should.

Uploads need CORS

Uploading from the browser is a cross-origin request, so the bucket has to allow it. Setting that rule needs an admin token: a key with Object Read & Write cannot call PutBucketCors, and the error it returns says AccessDenied, which reads like a bucket-permissions problem rather than a key-permissions one.

Requirements

PHP 8.3 or later
WordPress 7.1 or later
Credentials for an S3-compatible provider

License

GPL-2.0-or-later

arraypress / wp-s3-browser

Package info

Security

Statistics