Media: Accept audio files stored in an MP4 container detected as video/mp4

[sanketio]

Trac ticket: https://core.trac.wordpress.org/ticket/46544

Problem

Uploading an audio file whose real MIME type doesn't share the same major type as its extension is rejected with "Sorry, you are not allowed to upload this file type." The common real-world case is audio stored in an MP4/ISO-BMFF container — .m4a/.m4b, and some .mp3 files produced by mobile recorders — which fileinfo detects as video/mp4, while the extension maps to audio/mpeg.

In wp_check_filetype_and_ext(), the audio/* / video/* branch forgives sub-type mismatches but still requires the major type to match, so audio/mpeg (from the extension) vs video/mp4 (from finfo) fails and the file is rejected.

Change

Add a small, curated allow-list for known audio-in-MP4-container confusions inside that branch, mirroring the existing special-casing for text/csv and text/rtf. All three affected extensions (m4a, m4b, mp3) map to audio/mpeg, so the case collapses to a single entry:

$cross_container_types = array(
    'audio/mpeg' => array( 'video/mp4' ),
);

The check stays strict for every other combination. The application/octet-stream variant from the original report already passes today via the $nonspecific_types branch, so this targets only the remaining video/mp4 case.

Security: the worst case is a genuine MP4 video uploaded as .m4a being treated as audio/mpeg — both are allowed media types served as downloads, so no new upload vector is opened.

Testing instructions

1. Attempt to upload an audio file that fileinfo reports as video/mp4 (e.g. an .m4a from a phone recorder, or any MP4 container renamed to .m4a) via Media → Add New.
2. Before this change: the upload fails with "Sorry, you are not allowed to upload this file type."
3. After this change: the file uploads and appears in the Media Library as audio (audio/mpeg).

Automated coverage: a new case in the data_wp_check_filetype_and_ext provider uploads a fixture detected as video/mp4 and asserts it resolves to ext = m4a, type = audio/mpeg. The full Tests_Functions suite passes on single and multisite.

Use of AI Tools

• AI assistance: Yes
• Tool(s): Claude Code
• Model(s): Claude Opus 4.8
• Used for: investigating the root cause, drafting the fix and unit test, and verifying via automated tests and a live Media Library upload.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props sanketparmar.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[github-actions]

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

• All changes will be lost when closing a tab with a Playground instance.
• All changes will be lost when refreshing the page.
• A fresh instance is created each time the link below is clicked.
• Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
  it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.