From acf42b8bf95990dc48b96fc81b037f18ddd2d91d Mon Sep 17 00:00:00 2001
From: Takshil Kunadia <takshilkunadia@gmail.com>
Date: Fri, 8 May 2026 04:34:34 +0530
Subject: [PATCH 1/2] Media: Add support for custom bulk actions in Media grid
 view

---
 src/js/media/views/attachments/browser.js | 86 +++++++++++++++++++++++
 src/wp-admin/admin-ajax.php               |  1 +
 src/wp-admin/includes/ajax-actions.php    | 46 ++++++++++++
 src/wp-admin/upload.php                   | 19 ++++-
 4 files changed, 150 insertions(+), 2 deletions(-)

diff --git a/src/js/media/views/attachments/browser.js b/src/js/media/views/attachments/browser.js
index 26218ea2fa1ae..d8ba71a28700b 100644
--- a/src/js/media/views/attachments/browser.js
+++ b/src/js/media/views/attachments/browser.js
@@ -361,6 +361,8 @@ AttachmentsBrowser = View.extend(/** @lends wp.media.view.AttachmentsBrowser.pro
 				}).render() );
 			}
 
+			this.addCustomBulkActions();
+
 		} else if ( this.options.date ) {
 			// DateFilter is a <select>, a label element needs to be rendered before.
 			this.toolbar.set( 'dateFilterLabel', new wp.media.view.Label({
@@ -409,6 +411,90 @@ AttachmentsBrowser = View.extend(/** @lends wp.media.view.AttachmentsBrowser.pro
 		}
 	},
 
+	/**
+	 * Adds custom bulk action buttons registered via the PHP-side
+	 * `bulk_actions-upload` filter to the grid view toolbar.
+	 *
+	 * @since x.x.x
+	 *
+	 * @return {void}
+	 */
+	addCustomBulkActions: function() {
+		var toolbar = this.toolbar,
+			selection = this.options.selection,
+			controller = this.controller,
+			settings = window._wpMediaGridSettings || {},
+			bulkActions = settings.bulkActions || {},
+			nonce = settings.bulkActionNonce || '';
+
+		var BulkActionButton = wp.media.view.Button.extend( {
+			initialize: function() {
+				wp.media.view.Button.prototype.initialize.apply( this, arguments );
+				this.controller.on( 'selection:toggle', this.toggleDisabled, this );
+				this.controller.on( 'select:activate', this.toggleDisabled, this );
+				this.controller.on( 'select:deactivate', this.toggleDisabled, this );
+			},
+
+			toggleDisabled: function() {
+				this.model.set( 'disabled', ! this.controller.state().get( 'selection' ).length );
+			},
+
+			render: function() {
+				wp.media.view.Button.prototype.render.apply( this, arguments );
+				if ( this.controller.isModeActive( 'select' ) ) {
+					this.$el.addClass( 'delete-selected-button' );
+				} else {
+					this.$el.addClass( 'delete-selected-button hidden' );
+				}
+				this.toggleDisabled();
+				return this;
+			},
+
+			click: function() {
+				var ids = this.controller.state().get( 'selection' ).map( function( model ) {
+					return model.get( 'id' );
+				} );
+
+				if ( ! ids.length ) {
+					return;
+				}
+
+				this.model.set( 'disabled', true );
+
+				wp.media.ajax( {
+					data: {
+						action: 'media-grid-bulk-action',
+						bulk_action: this.options.bulkAction,
+						ids: ids,
+						nonce: nonce
+					},
+					success: _.bind( function( response ) {
+						if ( response && response.redirect && response.redirect.length ) {
+							window.location.href = response.redirect;
+						} else {
+							this.controller.trigger( 'selection:action:done' );
+						}
+					}, this ),
+					error: _.bind( function() {
+						this.model.set( 'disabled', false );
+						this.controller.trigger( 'selection:action:done' );
+					}, this )
+				} );
+			}
+		} );
+
+		_.each( bulkActions, function( label, action ) {
+			toolbar.set( 'bulkAction-' + action, new BulkActionButton( {
+				text: label,
+				disabled: true,
+				style: 'secondary',
+				priority: -75,
+				controller: controller,
+				bulkAction: action
+			} ).render() );
+		} );
+	},
+
 	updateContent: function() {
 		var view = this,
 			noItemsView;
diff --git a/src/wp-admin/admin-ajax.php b/src/wp-admin/admin-ajax.php
index 3ad60f95766e3..42ab601fd43f2 100644
--- a/src/wp-admin/admin-ajax.php
+++ b/src/wp-admin/admin-ajax.php
@@ -106,6 +106,7 @@
 	'send-link-to-editor',
 	'send-attachment-to-editor',
 	'save-attachment-order',
+	'media-grid-bulk-action',
 	'media-create-image-subsizes',
 	'heartbeat',
 	'get-revision-diffs',
diff --git a/src/wp-admin/includes/ajax-actions.php b/src/wp-admin/includes/ajax-actions.php
index 2af08fba70af9..f11f23c0cac7d 100644
--- a/src/wp-admin/includes/ajax-actions.php
+++ b/src/wp-admin/includes/ajax-actions.php
@@ -3308,6 +3308,52 @@ function wp_ajax_save_attachment_order() {
 	wp_send_json_success();
 }
 
+/**
+ * Handles a custom bulk action from the Media Library grid view via AJAX.
+ *
+ * @since x.x.x
+ */
+function wp_ajax_media_grid_bulk_action() {
+	check_ajax_referer( 'media-grid-bulk-action', 'nonce' );
+
+	if ( ! current_user_can( 'upload_files' ) ) {
+		wp_send_json_error( array( 'message' => __( 'Sorry, you are not allowed to do that.' ) ) );
+	}
+
+	$action   = isset( $_REQUEST['bulk_action'] ) ? sanitize_key( wp_unslash( $_REQUEST['bulk_action'] ) ) : '';
+	$post_ids = isset( $_REQUEST['ids'] ) ? array_map( 'absint', wp_unslash( (array) $_REQUEST['ids'] ) ) : array();
+
+	if ( ! $action || empty( $post_ids ) ) {
+		wp_send_json_error( array( 'message' => __( 'Invalid request.' ) ) );
+	}
+
+	// Reject built-in actions handled natively by the grid view JS.
+	$built_in = array( 'delete', 'trash', 'untrash' );
+	if ( in_array( $action, $built_in, true ) ) {
+		wp_send_json_error( array( 'message' => __( 'Invalid bulk action.' ) ) );
+	}
+
+	// Verify current user can edit each of the requested attachments.
+	$post_ids = array_filter( $post_ids, function( $id ) {
+		return current_user_can( 'edit_post', $id );
+	} );
+
+	if ( empty( $post_ids ) ) {
+		wp_send_json_error( array( 'message' => __( 'No valid attachments found.' ) ) );
+	}
+
+	// Re-index after filtering.
+	$post_ids = array_values( $post_ids );
+
+	/** This action is documented in wp-admin/upload.php */
+	$redirect_url = apply_filters( 'handle_bulk_actions-upload', '', $action, $post_ids ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.UseUnderscores
+
+	// Sanitize redirect to prevent open redirects from plugin filter callbacks.
+	$redirect_url = wp_validate_redirect( $redirect_url, '' );
+
+	wp_send_json_success( array( 'redirect' => esc_url_raw( $redirect_url ) ) );
+}
+
 /**
  * Handles sending an attachment to the editor via AJAX.
  *
diff --git a/src/wp-admin/upload.php b/src/wp-admin/upload.php
index 1f42a287e4957..c5f8b774de3b2 100644
--- a/src/wp-admin/upload.php
+++ b/src/wp-admin/upload.php
@@ -164,12 +164,27 @@ function () {
 		}
 	}
 
+	/*
+	 * Collect custom bulk actions registered via the `bulk_actions-upload`
+	 * filter so they can be surfaced in the grid view toolbar alongside
+	 * the built-in Delete button.
+	 */
+	$base_actions = MEDIA_TRASH
+		? array( 'trash' => __( 'Move to Trash' ) )
+		: array( 'delete' => __( 'Delete permanently' ) );
+
+	$bulk_actions        = apply_filters( 'bulk_actions-upload', $base_actions ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.UseUnderscores
+	$built_in_actions    = array( 'delete', 'trash', 'untrash' );
+	$custom_bulk_actions = array_diff_key( $bulk_actions, array_flip( $built_in_actions ) );
+
 	wp_localize_script(
 		'media-grid',
 		'_wpMediaGridSettings',
 		array(
-			'adminUrl'  => parse_url( self_admin_url(), PHP_URL_PATH ),
-			'queryVars' => (object) $query_vars,
+			'adminUrl'        => parse_url( self_admin_url(), PHP_URL_PATH ),
+			'queryVars'       => (object) $query_vars,
+			'bulkActions'     => (object) $custom_bulk_actions,
+			'bulkActionNonce' => wp_create_nonce( 'media-grid-bulk-action' ),
 		)
 	);
 

From 3f1255aa8ed87d9c6c5b2fcdffc86eec2f671742 Mon Sep 17 00:00:00 2001
From: Takshil Kunadia <takshilkunadia@gmail.com>
Date: Fri, 8 May 2026 05:02:28 +0530
Subject: [PATCH 2/2] fix: PHPCS and JSHint issues

---
 src/js/media/views/attachments/browser.js |  1 -
 src/wp-admin/includes/ajax-actions.php    | 12 ++++++++----
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/src/js/media/views/attachments/browser.js b/src/js/media/views/attachments/browser.js
index d8ba71a28700b..a1590558d1206 100644
--- a/src/js/media/views/attachments/browser.js
+++ b/src/js/media/views/attachments/browser.js
@@ -421,7 +421,6 @@ AttachmentsBrowser = View.extend(/** @lends wp.media.view.AttachmentsBrowser.pro
 	 */
 	addCustomBulkActions: function() {
 		var toolbar = this.toolbar,
-			selection = this.options.selection,
 			controller = this.controller,
 			settings = window._wpMediaGridSettings || {},
 			bulkActions = settings.bulkActions || {},
diff --git a/src/wp-admin/includes/ajax-actions.php b/src/wp-admin/includes/ajax-actions.php
index f11f23c0cac7d..a4ed2b47cb196 100644
--- a/src/wp-admin/includes/ajax-actions.php
+++ b/src/wp-admin/includes/ajax-actions.php
@@ -3333,10 +3333,14 @@ function wp_ajax_media_grid_bulk_action() {
 		wp_send_json_error( array( 'message' => __( 'Invalid bulk action.' ) ) );
 	}
 
-	// Verify current user can edit each of the requested attachments.
-	$post_ids = array_filter( $post_ids, function( $id ) {
-		return current_user_can( 'edit_post', $id );
-	} );
+	// Verify each ID is a real attachment the current user can edit.
+	$post_ids = array_filter(
+		$post_ids,
+		function ( $id ) {
+			return 'attachment' === get_post_type( $id )
+				&& current_user_can( 'edit_post', $id );
+		}
+	);
 
 	if ( empty( $post_ids ) ) {
 		wp_send_json_error( array( 'message' => __( 'No valid attachments found.' ) ) );