diff --git a/README.md b/README.md index b1cd6edfd..138e3f934 100644 --- a/README.md +++ b/README.md @@ -11,7 +11,7 @@ Add albums, photo, audio/video upload, privacy, sharing, front-end uploads & mor ![BrowserStack Status](https://www.browserstack.com/automate/badge.svg?badge_key=MU1JamdmRnppK0hhQy9QMU8wdDJ2MUEyb1ZuS0ljVFQvSHZ6anFvNzUxTT0tLXhUNnliTnZGcE5CcW93N0I1eXdnM3c9PQ==--8c124e667dd0c317618efde1bed2b260000916b6) -* **Contributors:** [rtcamp](http://profiles.wordpress.org/rtcamp), [mangeshp](http://profiles.wordpress.org/mangeshp), [sanket.parmar](http://profiles.wordpress.org/sanket.parmar), [pranalipatel](http://profiles.wordpress.org/pranalipatel), [jignesh.nakrani](http://profiles.wordpress.org/jignesh.nakrani), [manishsongirkar36](http://profiles.wordpress.org/manishsongirkar36), [kiranpotphode](http://profiles.wordpress.org/kiranpotphode), [yahil](http://profiles.wordpress.org/yahil), [1naveengiri](http://profiles.wordpress.org/1naveengiri), [bhargavbhandari90](http://profiles.wordpress.org/bhargavbhandari90), [deepak1191](http://profiles.wordpress.org/deepak1191), [rittesh.patel](http://profiles.wordpress.org/rittesh.patel), [sagarjadhav](http://profiles.wordpress.org/sagarjadhav), [pushpak.pop](http://profiles.wordpress.org/pushpak.pop), [faishal](http://profiles.wordpress.org/faishal), [desaiuditd](http://profiles.wordpress.org/desaiuditd), [rahul286](http://profiles.wordpress.org/rahul286), [JoshuaAbenazer](http://profiles.wordpress.org/JoshuaAbenazer), [gagan0123](http://profiles.wordpress.org/gagan0123), [saurabhshukla](http://profiles.wordpress.org/saurabhshukla), [nitun.lanjewar](http://profiles.wordpress.org/nitun.lanjewar), [umesh.nevase](http://profiles.wordpress.org/umesh.nevase), [suhasgirgaonkar](http://profiles.wordpress.org/suhasgirgaonkar), [neerukoul](http://profiles.wordpress.org/neerukoul), [hrishiv90](http://profiles.wordpress.org/hrishiv90), [kanakiyajay](http://profiles.wordpress.org/kanakiyajay), [jarretc](http://profiles.wordpress.org/jarretc), [tobiaskluge](http://profiles.wordpress.org/tobiaskluge), [rafaelfunchal](http://profiles.wordpress.org/rafaelfunchal), [UmeshSingla](http://profiles.wordpress.org/UmeshSingla), [mehulkaklotar](http://profiles.wordpress.org/mehulkaklotar), [tannermirabel](http://profiles.wordpress.org/tannermirabel), [kishores](http://profiles.wordpress.org/kishores), [chandrapatel](http://profiles.wordpress.org/chandrapatel), [rahul3883](http://profiles.wordpress.org/rahul3883/), [nomnom99](http://profiles.wordpress.org/nomnom99), [sayanchakraborty](https://profiles.wordpress.org/sayanchakraborty), [milindmore22](https://profiles.wordpress.org/milindmore22), [thrijith](https://profiles.wordpress.org/thrijith), [abhijitrakas](https://profiles.wordpress.org/abhijitrakas), [sid177](https://profiles.wordpress.org/sid177), [montu3366](https://profiles.wordpress.org/montu3366), [jashwini](https://profiles.wordpress.org/jashwini), [juhise](https://profiles.wordpress.org/juhise), [ravatparmar](https://profiles.wordpress.org/ravatparmar), [dharmin16](https://profiles.wordpress.org/dharmin16), [malavvasita](https://profiles.wordpress.org/malavvasita), [pooja1210](https://profiles.wordpress.org/pooja1210), [krupajnanda](https://profiles.wordpress.org/krupajnanda), [kanumalivad](https://profiles.wordpress.org/kanumalivad), [surajkumarsingh](https://profiles.wordpress.org/surajkumarsingh), [dishitpala](https://profiles.wordpress.org/dishitpala), [shobhit2412](https://profiles.wordpress.org/shobhit2412/), [vkd007](https://profiles.wordpress.org/vkd007/), [vaishu.agola27](https://profiles.wordpress.org/vaishuagola27/), [kapilpaul](https://profiles.wordpress.org/kapilpaul/), [opurockey](https://profiles.wordpress.org/opurockey/), [pavanpatil1](https://profiles.wordpress.org/pavanpatil1/), [pradeep1308](https://profiles.wordpress.org/pradeep1308/), [shardul200](https://profiles.wordpress.org/shardul200/), [ibnulk](https://profiles.wordpress.org/ibnulk/), [sabbir1991](https://profiles.wordpress.org/sabbir1991/), [kamalahmed](https://profiles.wordpress.org/kamalahmed/), [harshbarach](https://profiles.wordpress.org/harshbarach/), [mukulsingh27](https://profiles.wordpress.org/mukulsingh27/), [vishalkakadiya](https://profiles.wordpress.org/vishalkakadiya/), [elifvish](https://profiles.wordpress.org/elifvish/), [krupajnanda](https://profiles.wordpress.org/krupajnanda/), [utsavladani](https://profiles.wordpress.org/utsavladani/),[krishana79](https://profiles.wordpress.org/krishana79/), [rohitmathur7](https://profiles.wordpress.org/rohitmathur7/), [kuldipchaudhary](https://profiles.wordpress.org/kuldipchaudhary/), [mchirag2002](https://profiles.wordpress.org/mchirag2002/), [vedantgandhi28](https://profiles.wordpress.org/vedantgandhi28/), [mohamedahamed](https://profiles.wordpress.org/mohamedahamed/),[thehercules](https://profiles.wordpress.org/thehercules/), [suryakantupadhyay](https://profiles.wordpress.org/suryakantupadhyay/) +* **Contributors:** [rtcamp](http://profiles.wordpress.org/rtcamp), [mangeshp](http://profiles.wordpress.org/mangeshp), [sanket.parmar](http://profiles.wordpress.org/sanket.parmar), [pranalipatel](http://profiles.wordpress.org/pranalipatel), [jignesh.nakrani](http://profiles.wordpress.org/jignesh.nakrani), [manishsongirkar36](http://profiles.wordpress.org/manishsongirkar36), [kiranpotphode](http://profiles.wordpress.org/kiranpotphode), [yahil](http://profiles.wordpress.org/yahil), [1naveengiri](http://profiles.wordpress.org/1naveengiri), [bhargavbhandari90](http://profiles.wordpress.org/bhargavbhandari90), [deepak1191](http://profiles.wordpress.org/deepak1191), [rittesh.patel](http://profiles.wordpress.org/rittesh.patel), [sagarjadhav](http://profiles.wordpress.org/sagarjadhav), [pushpak.pop](http://profiles.wordpress.org/pushpak.pop), [faishal](http://profiles.wordpress.org/faishal), [desaiuditd](http://profiles.wordpress.org/desaiuditd), [rahul286](http://profiles.wordpress.org/rahul286), [JoshuaAbenazer](http://profiles.wordpress.org/JoshuaAbenazer), [gagan0123](http://profiles.wordpress.org/gagan0123), [saurabhshukla](http://profiles.wordpress.org/saurabhshukla), [nitun.lanjewar](http://profiles.wordpress.org/nitun.lanjewar), [umesh.nevase](http://profiles.wordpress.org/umesh.nevase), [suhasgirgaonkar](http://profiles.wordpress.org/suhasgirgaonkar), [neerukoul](http://profiles.wordpress.org/neerukoul), [hrishiv90](http://profiles.wordpress.org/hrishiv90), [kanakiyajay](http://profiles.wordpress.org/kanakiyajay), [jarretc](http://profiles.wordpress.org/jarretc), [tobiaskluge](http://profiles.wordpress.org/tobiaskluge), [rafaelfunchal](http://profiles.wordpress.org/rafaelfunchal), [UmeshSingla](http://profiles.wordpress.org/UmeshSingla), [mehulkaklotar](http://profiles.wordpress.org/mehulkaklotar), [tannermirabel](http://profiles.wordpress.org/tannermirabel), [kishores](http://profiles.wordpress.org/kishores), [chandrapatel](http://profiles.wordpress.org/chandrapatel), [rahul3883](http://profiles.wordpress.org/rahul3883/), [nomnom99](http://profiles.wordpress.org/nomnom99), [sayanchakraborty](https://profiles.wordpress.org/sayanchakraborty), [milindmore22](https://profiles.wordpress.org/milindmore22), [thrijith](https://profiles.wordpress.org/thrijith), [abhijitrakas](https://profiles.wordpress.org/abhijitrakas), [sid177](https://profiles.wordpress.org/sid177), [montu3366](https://profiles.wordpress.org/montu3366), [jashwini](https://profiles.wordpress.org/jashwini), [juhise](https://profiles.wordpress.org/juhise), [ravatparmar](https://profiles.wordpress.org/ravatparmar), [dharmin16](https://profiles.wordpress.org/dharmin16), [malavvasita](https://profiles.wordpress.org/malavvasita), [pooja1210](https://profiles.wordpress.org/pooja1210), [krupajnanda](https://profiles.wordpress.org/krupajnanda), [kanumalivad](https://profiles.wordpress.org/kanumalivad), [surajkumarsingh](https://profiles.wordpress.org/surajkumarsingh), [dishitpala](https://profiles.wordpress.org/dishitpala), [shobhit2412](https://profiles.wordpress.org/shobhit2412/), [vkd007](https://profiles.wordpress.org/vkd007/), [vaishu.agola27](https://profiles.wordpress.org/vaishuagola27/), [kapilpaul](https://profiles.wordpress.org/kapilpaul/), [opurockey](https://profiles.wordpress.org/opurockey/), [pavanpatil1](https://profiles.wordpress.org/pavanpatil1/), [pradeep1308](https://profiles.wordpress.org/pradeep1308/), [shardul200](https://profiles.wordpress.org/shardul200/), [ibnulk](https://profiles.wordpress.org/ibnulk/), [sabbir1991](https://profiles.wordpress.org/sabbir1991/), [kamalahmed](https://profiles.wordpress.org/kamalahmed/), [harshbarach](https://profiles.wordpress.org/harshbarach/), [mukulsingh27](https://profiles.wordpress.org/mukulsingh27/), [vishalkakadiya](https://profiles.wordpress.org/vishalkakadiya/), [elifvish](https://profiles.wordpress.org/elifvish/), [krupajnanda](https://profiles.wordpress.org/krupajnanda/), [utsavladani](https://profiles.wordpress.org/utsavladani/),[krishana79](https://profiles.wordpress.org/krishana79/), [rohitmathur7](https://profiles.wordpress.org/rohitmathur7/), [kuldipchaudhary](https://profiles.wordpress.org/kuldipchaudhary/), [mchirag2002](https://profiles.wordpress.org/mchirag2002/), [vedantgandhi28](https://profiles.wordpress.org/vedantgandhi28/), [mohamedahamed](https://profiles.wordpress.org/mohamedahamed/),[thehercules](https://profiles.wordpress.org/thehercules/), [suryakantupadhyay](https://profiles.wordpress.org/suryakantupadhyay/), [intenzi](https://profiles.wordpress.org/intenzi/) * **License:** [GPL v2 or later]( http://www.gnu.org/licenses/gpl-2.0.html) @@ -147,6 +147,15 @@ https://www.youtube.com/watch?v=dJrykKQGDcs ## Changelog ## +### 4.7.14 + +* FIXED + * Fixed file upload handling to prevent arbitrary file sideloading. + * Fixed file extension validation to enforce allowed media extensions strictly. + * Fixed album permission checks when moving media to another album. + * Fixed media edit sanitization to prevent unauthorized attribute modifications. + * Fixed media privacy level validation against allowed values. + ### 4.7.13 * FIXED diff --git a/changelog.txt b/changelog.txt index 3bc0adb40..70ad92867 100644 --- a/changelog.txt +++ b/changelog.txt @@ -1,5 +1,15 @@ == Changelog == += 4.7.14 [October 01, 2026] = + +* FIXED + * Fixed file upload handling to prevent arbitrary file sideloading. + * Fixed file extension validation to enforce allowed media extensions strictly. + * Fixed album permission checks when moving media to another album. + * Fixed media edit sanitization to prevent unauthorized attribute modifications. + * Fixed media privacy level validation against allowed values. + + = 4.7.13 [August 27, 2026] = * FIXED diff --git a/index.php b/index.php index 1ac75c42c..49d8c439e 100644 --- a/index.php +++ b/index.php @@ -3,7 +3,7 @@ * Plugin Name: rtMedia for WordPress, BuddyPress and bbPress * Plugin URI: https://rtmedia.io/?utm_source=dashboard&utm_medium=plugin&utm_campaign=buddypress-media * Description: This plugin adds missing media rich features like photos, videos and audio uploading to BuddyPress which are essential if you are building social network, seriously! - * Version: 4.7.13 + * Version: 4.7.14 * Requires at least: 4.9.6 * Text Domain: buddypress-media * Author: rtCamp @@ -26,7 +26,7 @@ /** * The version of the plugin */ - define( 'RTMEDIA_VERSION', '4.7.13' ); + define( 'RTMEDIA_VERSION', '4.7.14' ); } if ( ! defined( 'RTMEDIA_PATH' ) ) { diff --git a/languages/buddpress-media.pot b/languages/buddpress-media.pot index 91eb52c51..f50f35459 100644 --- a/languages/buddpress-media.pot +++ b/languages/buddpress-media.pot @@ -2,14 +2,14 @@ # This file is distributed under the GPLv2 or later. msgid "" msgstr "" -"Project-Id-Version: rtMedia for WordPress, BuddyPress and bbPress 4.7.13\n" +"Project-Id-Version: rtMedia for WordPress, BuddyPress and bbPress 4.7.14\n" "Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/buddypress-media\n" "Last-Translator: FULL NAME \n" "Language-Team: LANGUAGE \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" -"POT-Creation-Date: 2026-08-27T11:14:49+00:00\n" +"POT-Creation-Date: 2026-10-01T07:41:26+00:00\n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "X-Generator: WP-CLI 2.12.0\n" "X-Domain: buddypress-media\n" @@ -276,7 +276,7 @@ msgstr "" #: app/admin/RTMediaAdmin.php:1339 #: app/main/controllers/privacy/RTMediaPrivacy.php:587 -#: app/main/controllers/template/rtmedia-functions.php:2869 +#: app/main/controllers/template/rtmedia-functions.php:2875 msgid "Privacy" msgstr "" @@ -2193,7 +2193,7 @@ msgstr "" #: app/main/controllers/activity/RTMediaBuddyPressActivity.php:765 #: app/main/controllers/shortcodes/RTMediaGalleryShortcode.php:131 -#: app/main/controllers/upload/processors/RTMediaUploadFile.php:245 +#: app/main/controllers/upload/processors/RTMediaUploadFile.php:238 #: app/main/RTMedia.php:167 #: app/main/RTMedia.php:1594 #: app/main/RTMedia.php:1687 @@ -2203,7 +2203,7 @@ msgstr "" #: app/main/controllers/activity/RTMediaBuddyPressActivity.php:824 #: app/main/controllers/media/RTMediaComment.php:227 #: app/main/controllers/shortcodes/RTMediaUploadShortcode.php:135 -#: app/main/controllers/template/rtmedia-functions.php:2395 +#: app/main/controllers/template/rtmedia-functions.php:2401 msgid "You are not allowed to upload/attach media." msgstr "" @@ -2220,7 +2220,7 @@ msgstr "" #. translators: 1: Username, 2: Number of medias, 3: Media slug. #: app/main/controllers/activity/RTMediaBuddyPressActivity.php:988 #: app/main/controllers/activity/RTMediaBuddyPressActivity.php:991 -#: app/main/controllers/upload/RTMediaUploadEndpoint.php:282 +#: app/main/controllers/upload/RTMediaUploadEndpoint.php:283 #, php-format msgid "%1$s added %2$d %3$s" msgstr "" @@ -2590,8 +2590,8 @@ msgstr "" #: app/main/controllers/media/RTMediaGalleryItemAction.php:87 #: app/main/controllers/media/RTMediaGalleryItemAction.php:121 -#: app/main/controllers/template/rtmedia-functions.php:1354 -#: app/main/controllers/template/rtmedia-functions.php:1380 +#: app/main/controllers/template/rtmedia-functions.php:1360 +#: app/main/controllers/template/rtmedia-functions.php:1386 #: app/main/RTMedia.php:1432 msgid "Edit" msgstr "" @@ -2603,8 +2603,8 @@ msgstr "" #: app/main/controllers/media/RTMediaGalleryItemAction.php:90 #: app/main/controllers/media/RTMediaGalleryItemAction.php:123 -#: app/main/controllers/template/rtmedia-functions.php:2346 -#: app/main/controllers/template/rtmedia-functions.php:2361 +#: app/main/controllers/template/rtmedia-functions.php:2352 +#: app/main/controllers/template/rtmedia-functions.php:2367 #: app/main/RTMedia.php:1433 #: templates/media/album-single-edit.php:98 msgid "Delete" @@ -2772,7 +2772,7 @@ msgid "Doing wrong, invalid AJAX request!" msgstr "" #: app/main/controllers/template/rtmedia-ajax-actions.php:196 -#: app/main/controllers/template/rtmedia-functions.php:2269 +#: app/main/controllers/template/rtmedia-functions.php:2275 msgid "Comment" msgstr "" @@ -2797,12 +2797,12 @@ msgid "Merge Album" msgstr "" #: app/main/controllers/template/rtmedia-filters.php:970 -#: app/main/controllers/template/rtmedia-functions.php:4853 +#: app/main/controllers/template/rtmedia-functions.php:4859 msgid "rtMedia Shortcode Uploads" msgstr "" #: app/main/controllers/template/rtmedia-filters.php:974 -#: app/main/controllers/template/rtmedia-functions.php:4734 +#: app/main/controllers/template/rtmedia-functions.php:4740 msgid "rtMedia Activities" msgstr "" @@ -2811,12 +2811,12 @@ msgid "rtMedia Comments" msgstr "" #: app/main/controllers/template/rtmedia-filters.php:982 -#: app/main/controllers/template/rtmedia-functions.php:5083 +#: app/main/controllers/template/rtmedia-functions.php:5089 msgid "rtMedia Media Views" msgstr "" #: app/main/controllers/template/rtmedia-filters.php:986 -#: app/main/controllers/template/rtmedia-functions.php:5185 +#: app/main/controllers/template/rtmedia-functions.php:5191 msgid "rtMedia Media Likes" msgstr "" @@ -2838,80 +2838,80 @@ msgstr "" msgid "All" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:1463 +#: app/main/controllers/template/rtmedia-functions.php:1469 msgid "There are no comments on this media yet." msgstr "" #. translators: %s Count of comments. -#: app/main/controllers/template/rtmedia-functions.php:1502 +#: app/main/controllers/template/rtmedia-functions.php:1508 #, php-format msgid "Show all %s comments" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:1546 +#: app/main/controllers/template/rtmedia-functions.php:1552 msgid "Delete Comment" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:2268 +#: app/main/controllers/template/rtmedia-functions.php:2274 msgid "Type Comment..." msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:2345 -#: app/main/controllers/template/rtmedia-functions.php:2360 +#: app/main/controllers/template/rtmedia-functions.php:2351 +#: app/main/controllers/template/rtmedia-functions.php:2366 msgid "Delete Media" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:2630 +#: app/main/controllers/template/rtmedia-functions.php:2636 msgid "Profile Albums" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:2639 -#: app/main/controllers/template/rtmedia-functions.php:2696 +#: app/main/controllers/template/rtmedia-functions.php:2645 +#: app/main/controllers/template/rtmedia-functions.php:2702 msgid "Group Albums" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:3305 +#: app/main/controllers/template/rtmedia-functions.php:3311 msgid "You like this" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:3319 +#: app/main/controllers/template/rtmedia-functions.php:3325 msgid "You and " msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:3342 +#: app/main/controllers/template/rtmedia-functions.php:3348 msgid " person likes this" msgid_plural " people like this" msgstr[0] "" msgstr[1] "" -#: app/main/controllers/template/rtmedia-functions.php:3461 +#: app/main/controllers/template/rtmedia-functions.php:3467 msgid "Public" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:3466 +#: app/main/controllers/template/rtmedia-functions.php:3472 msgid "All members" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:3471 +#: app/main/controllers/template/rtmedia-functions.php:3477 msgid "Your friends" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:3476 +#: app/main/controllers/template/rtmedia-functions.php:3482 msgid "Only you" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:3481 +#: app/main/controllers/template/rtmedia-functions.php:3487 msgid "Blocked temporarily" msgstr "" #. translators: %s: count of hour/minute/second. -#: app/main/controllers/template/rtmedia-functions.php:3537 +#: app/main/controllers/template/rtmedia-functions.php:3543 #, php-format msgid "%s ago " msgstr "" #. translators: %s: number of seconds. -#: app/main/controllers/template/rtmedia-functions.php:3559 +#: app/main/controllers/template/rtmedia-functions.php:3565 #, php-format msgid "%s second" msgid_plural "%s seconds" @@ -2919,7 +2919,7 @@ msgstr[0] "" msgstr[1] "" #. translators: %s: number of minutes. -#: app/main/controllers/template/rtmedia-functions.php:3564 +#: app/main/controllers/template/rtmedia-functions.php:3570 #, php-format msgid "%s minute" msgid_plural "%s minutes" @@ -2927,69 +2927,69 @@ msgstr[0] "" msgstr[1] "" #. translators: %s: number of hours. -#: app/main/controllers/template/rtmedia-functions.php:3569 +#: app/main/controllers/template/rtmedia-functions.php:3575 #, php-format msgid "%s hour" msgid_plural "%s hours" msgstr[0] "" msgstr[1] "" -#: app/main/controllers/template/rtmedia-functions.php:4184 +#: app/main/controllers/template/rtmedia-functions.php:4190 msgid "View Conversation" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:4760 +#: app/main/controllers/template/rtmedia-functions.php:4766 msgid "Activity Date" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:4764 +#: app/main/controllers/template/rtmedia-functions.php:4770 msgid "Activity Content" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:4768 -#: app/main/controllers/template/rtmedia-functions.php:4992 +#: app/main/controllers/template/rtmedia-functions.php:4774 +#: app/main/controllers/template/rtmedia-functions.php:4998 msgid "Attachments" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:4862 +#: app/main/controllers/template/rtmedia-functions.php:4868 msgid "Media Upload Date" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:4866 +#: app/main/controllers/template/rtmedia-functions.php:4872 msgid "Media Title" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:4870 -#: app/main/controllers/template/rtmedia-functions.php:5087 -#: app/main/controllers/template/rtmedia-functions.php:5189 +#: app/main/controllers/template/rtmedia-functions.php:4876 +#: app/main/controllers/template/rtmedia-functions.php:5093 +#: app/main/controllers/template/rtmedia-functions.php:5195 msgid "Media URL" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:4874 +#: app/main/controllers/template/rtmedia-functions.php:4880 msgid "Album Title" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:4963 +#: app/main/controllers/template/rtmedia-functions.php:4969 msgid "rtMedia Activity Comments" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:4984 +#: app/main/controllers/template/rtmedia-functions.php:4990 msgid "Comment Date" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:4988 +#: app/main/controllers/template/rtmedia-functions.php:4994 msgid "Comment Content" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:5091 +#: app/main/controllers/template/rtmedia-functions.php:5097 msgid "Number of Views" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:5095 +#: app/main/controllers/template/rtmedia-functions.php:5101 msgid "Date of First View" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:5193 +#: app/main/controllers/template/rtmedia-functions.php:5199 msgid "Date" msgstr "" @@ -3019,18 +3019,18 @@ msgstr "" msgid "Invalid attribute passed for rtmedia_gallery shortcode." msgstr "" -#: app/main/controllers/template/RTMediaTemplate.php:470 -#: app/main/controllers/template/RTMediaTemplate.php:610 -#: app/main/controllers/template/RTMediaTemplate.php:733 -#: app/main/controllers/template/RTMediaTemplate.php:973 +#: app/main/controllers/template/RTMediaTemplate.php:472 +#: app/main/controllers/template/RTMediaTemplate.php:612 +#: app/main/controllers/template/RTMediaTemplate.php:735 +#: app/main/controllers/template/RTMediaTemplate.php:975 msgid "Ooops !!! Invalid access. No nonce was found !!" msgstr "" -#: app/main/controllers/template/RTMediaTemplate.php:480 +#: app/main/controllers/template/RTMediaTemplate.php:482 msgid "Media updated Successfully" msgstr "" -#: app/main/controllers/template/RTMediaTemplate.php:499 +#: app/main/controllers/template/RTMediaTemplate.php:501 msgid "Error in updating Media" msgstr "" @@ -3038,33 +3038,33 @@ msgstr "" msgid "Error Uploading File" msgstr "" -#: app/main/controllers/upload/processors/RTMediaUploadFile.php:303 +#: app/main/controllers/upload/processors/RTMediaUploadFile.php:294 msgid "MP4 file you have uploaded is corrupt." msgstr "" -#: app/main/controllers/upload/processors/RTMediaUploadFile.php:311 -#: app/main/controllers/upload/processors/RTMediaUploadFile.php:315 +#: app/main/controllers/upload/processors/RTMediaUploadFile.php:302 +#: app/main/controllers/upload/processors/RTMediaUploadFile.php:306 msgid "The MP4 file you have uploaded is using an unsupported video codec. Supported video codec is H.264." msgstr "" -#: app/main/controllers/upload/processors/RTMediaUploadFile.php:319 +#: app/main/controllers/upload/processors/RTMediaUploadFile.php:310 msgid "The MP4 file you have uploaded is not a video file." msgstr "" -#: app/main/controllers/upload/processors/RTMediaUploadFile.php:332 +#: app/main/controllers/upload/processors/RTMediaUploadFile.php:323 msgid "MP3 file you have uploaded is currupt." msgstr "" -#: app/main/controllers/upload/processors/RTMediaUploadFile.php:340 -#: app/main/controllers/upload/processors/RTMediaUploadFile.php:344 +#: app/main/controllers/upload/processors/RTMediaUploadFile.php:331 +#: app/main/controllers/upload/processors/RTMediaUploadFile.php:335 msgid "The MP3 file you have uploaded is using an unsupported audio format. Supported audio format is MP3." msgstr "" -#: app/main/controllers/upload/processors/RTMediaUploadFile.php:348 +#: app/main/controllers/upload/processors/RTMediaUploadFile.php:339 msgid "The MP3 file you have uploaded is not an audio file." msgstr "" -#: app/main/controllers/upload/processors/RTMediaUploadFile.php:355 +#: app/main/controllers/upload/processors/RTMediaUploadFile.php:346 msgid "Media File you have tried to upload is not supported. Supported media files are .jpg, .png, .gif, .mp3, .mov and .mp4." msgstr "" diff --git a/languages/buddypress-media.pot b/languages/buddypress-media.pot index 4aa99a7b7..f50f35459 100644 --- a/languages/buddypress-media.pot +++ b/languages/buddypress-media.pot @@ -2,14 +2,14 @@ # This file is distributed under the GPLv2 or later. msgid "" msgstr "" -"Project-Id-Version: rtMedia for WordPress, BuddyPress and bbPress 4.7.13\n" +"Project-Id-Version: rtMedia for WordPress, BuddyPress and bbPress 4.7.14\n" "Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/buddypress-media\n" "Last-Translator: FULL NAME \n" "Language-Team: LANGUAGE \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" -"POT-Creation-Date: 2026-08-27T11:14:44+00:00\n" +"POT-Creation-Date: 2026-10-01T07:41:26+00:00\n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "X-Generator: WP-CLI 2.12.0\n" "X-Domain: buddypress-media\n" @@ -276,7 +276,7 @@ msgstr "" #: app/admin/RTMediaAdmin.php:1339 #: app/main/controllers/privacy/RTMediaPrivacy.php:587 -#: app/main/controllers/template/rtmedia-functions.php:2869 +#: app/main/controllers/template/rtmedia-functions.php:2875 msgid "Privacy" msgstr "" @@ -2193,7 +2193,7 @@ msgstr "" #: app/main/controllers/activity/RTMediaBuddyPressActivity.php:765 #: app/main/controllers/shortcodes/RTMediaGalleryShortcode.php:131 -#: app/main/controllers/upload/processors/RTMediaUploadFile.php:245 +#: app/main/controllers/upload/processors/RTMediaUploadFile.php:238 #: app/main/RTMedia.php:167 #: app/main/RTMedia.php:1594 #: app/main/RTMedia.php:1687 @@ -2203,7 +2203,7 @@ msgstr "" #: app/main/controllers/activity/RTMediaBuddyPressActivity.php:824 #: app/main/controllers/media/RTMediaComment.php:227 #: app/main/controllers/shortcodes/RTMediaUploadShortcode.php:135 -#: app/main/controllers/template/rtmedia-functions.php:2395 +#: app/main/controllers/template/rtmedia-functions.php:2401 msgid "You are not allowed to upload/attach media." msgstr "" @@ -2220,7 +2220,7 @@ msgstr "" #. translators: 1: Username, 2: Number of medias, 3: Media slug. #: app/main/controllers/activity/RTMediaBuddyPressActivity.php:988 #: app/main/controllers/activity/RTMediaBuddyPressActivity.php:991 -#: app/main/controllers/upload/RTMediaUploadEndpoint.php:282 +#: app/main/controllers/upload/RTMediaUploadEndpoint.php:283 #, php-format msgid "%1$s added %2$d %3$s" msgstr "" @@ -2590,8 +2590,8 @@ msgstr "" #: app/main/controllers/media/RTMediaGalleryItemAction.php:87 #: app/main/controllers/media/RTMediaGalleryItemAction.php:121 -#: app/main/controllers/template/rtmedia-functions.php:1354 -#: app/main/controllers/template/rtmedia-functions.php:1380 +#: app/main/controllers/template/rtmedia-functions.php:1360 +#: app/main/controllers/template/rtmedia-functions.php:1386 #: app/main/RTMedia.php:1432 msgid "Edit" msgstr "" @@ -2603,8 +2603,8 @@ msgstr "" #: app/main/controllers/media/RTMediaGalleryItemAction.php:90 #: app/main/controllers/media/RTMediaGalleryItemAction.php:123 -#: app/main/controllers/template/rtmedia-functions.php:2346 -#: app/main/controllers/template/rtmedia-functions.php:2361 +#: app/main/controllers/template/rtmedia-functions.php:2352 +#: app/main/controllers/template/rtmedia-functions.php:2367 #: app/main/RTMedia.php:1433 #: templates/media/album-single-edit.php:98 msgid "Delete" @@ -2772,7 +2772,7 @@ msgid "Doing wrong, invalid AJAX request!" msgstr "" #: app/main/controllers/template/rtmedia-ajax-actions.php:196 -#: app/main/controllers/template/rtmedia-functions.php:2269 +#: app/main/controllers/template/rtmedia-functions.php:2275 msgid "Comment" msgstr "" @@ -2797,12 +2797,12 @@ msgid "Merge Album" msgstr "" #: app/main/controllers/template/rtmedia-filters.php:970 -#: app/main/controllers/template/rtmedia-functions.php:4853 +#: app/main/controllers/template/rtmedia-functions.php:4859 msgid "rtMedia Shortcode Uploads" msgstr "" #: app/main/controllers/template/rtmedia-filters.php:974 -#: app/main/controllers/template/rtmedia-functions.php:4734 +#: app/main/controllers/template/rtmedia-functions.php:4740 msgid "rtMedia Activities" msgstr "" @@ -2811,12 +2811,12 @@ msgid "rtMedia Comments" msgstr "" #: app/main/controllers/template/rtmedia-filters.php:982 -#: app/main/controllers/template/rtmedia-functions.php:5083 +#: app/main/controllers/template/rtmedia-functions.php:5089 msgid "rtMedia Media Views" msgstr "" #: app/main/controllers/template/rtmedia-filters.php:986 -#: app/main/controllers/template/rtmedia-functions.php:5185 +#: app/main/controllers/template/rtmedia-functions.php:5191 msgid "rtMedia Media Likes" msgstr "" @@ -2838,80 +2838,80 @@ msgstr "" msgid "All" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:1463 +#: app/main/controllers/template/rtmedia-functions.php:1469 msgid "There are no comments on this media yet." msgstr "" #. translators: %s Count of comments. -#: app/main/controllers/template/rtmedia-functions.php:1502 +#: app/main/controllers/template/rtmedia-functions.php:1508 #, php-format msgid "Show all %s comments" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:1546 +#: app/main/controllers/template/rtmedia-functions.php:1552 msgid "Delete Comment" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:2268 +#: app/main/controllers/template/rtmedia-functions.php:2274 msgid "Type Comment..." msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:2345 -#: app/main/controllers/template/rtmedia-functions.php:2360 +#: app/main/controllers/template/rtmedia-functions.php:2351 +#: app/main/controllers/template/rtmedia-functions.php:2366 msgid "Delete Media" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:2630 +#: app/main/controllers/template/rtmedia-functions.php:2636 msgid "Profile Albums" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:2639 -#: app/main/controllers/template/rtmedia-functions.php:2696 +#: app/main/controllers/template/rtmedia-functions.php:2645 +#: app/main/controllers/template/rtmedia-functions.php:2702 msgid "Group Albums" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:3305 +#: app/main/controllers/template/rtmedia-functions.php:3311 msgid "You like this" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:3319 +#: app/main/controllers/template/rtmedia-functions.php:3325 msgid "You and " msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:3342 +#: app/main/controllers/template/rtmedia-functions.php:3348 msgid " person likes this" msgid_plural " people like this" msgstr[0] "" msgstr[1] "" -#: app/main/controllers/template/rtmedia-functions.php:3461 +#: app/main/controllers/template/rtmedia-functions.php:3467 msgid "Public" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:3466 +#: app/main/controllers/template/rtmedia-functions.php:3472 msgid "All members" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:3471 +#: app/main/controllers/template/rtmedia-functions.php:3477 msgid "Your friends" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:3476 +#: app/main/controllers/template/rtmedia-functions.php:3482 msgid "Only you" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:3481 +#: app/main/controllers/template/rtmedia-functions.php:3487 msgid "Blocked temporarily" msgstr "" #. translators: %s: count of hour/minute/second. -#: app/main/controllers/template/rtmedia-functions.php:3537 +#: app/main/controllers/template/rtmedia-functions.php:3543 #, php-format msgid "%s ago " msgstr "" #. translators: %s: number of seconds. -#: app/main/controllers/template/rtmedia-functions.php:3559 +#: app/main/controllers/template/rtmedia-functions.php:3565 #, php-format msgid "%s second" msgid_plural "%s seconds" @@ -2919,7 +2919,7 @@ msgstr[0] "" msgstr[1] "" #. translators: %s: number of minutes. -#: app/main/controllers/template/rtmedia-functions.php:3564 +#: app/main/controllers/template/rtmedia-functions.php:3570 #, php-format msgid "%s minute" msgid_plural "%s minutes" @@ -2927,69 +2927,69 @@ msgstr[0] "" msgstr[1] "" #. translators: %s: number of hours. -#: app/main/controllers/template/rtmedia-functions.php:3569 +#: app/main/controllers/template/rtmedia-functions.php:3575 #, php-format msgid "%s hour" msgid_plural "%s hours" msgstr[0] "" msgstr[1] "" -#: app/main/controllers/template/rtmedia-functions.php:4184 +#: app/main/controllers/template/rtmedia-functions.php:4190 msgid "View Conversation" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:4760 +#: app/main/controllers/template/rtmedia-functions.php:4766 msgid "Activity Date" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:4764 +#: app/main/controllers/template/rtmedia-functions.php:4770 msgid "Activity Content" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:4768 -#: app/main/controllers/template/rtmedia-functions.php:4992 +#: app/main/controllers/template/rtmedia-functions.php:4774 +#: app/main/controllers/template/rtmedia-functions.php:4998 msgid "Attachments" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:4862 +#: app/main/controllers/template/rtmedia-functions.php:4868 msgid "Media Upload Date" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:4866 +#: app/main/controllers/template/rtmedia-functions.php:4872 msgid "Media Title" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:4870 -#: app/main/controllers/template/rtmedia-functions.php:5087 -#: app/main/controllers/template/rtmedia-functions.php:5189 +#: app/main/controllers/template/rtmedia-functions.php:4876 +#: app/main/controllers/template/rtmedia-functions.php:5093 +#: app/main/controllers/template/rtmedia-functions.php:5195 msgid "Media URL" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:4874 +#: app/main/controllers/template/rtmedia-functions.php:4880 msgid "Album Title" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:4963 +#: app/main/controllers/template/rtmedia-functions.php:4969 msgid "rtMedia Activity Comments" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:4984 +#: app/main/controllers/template/rtmedia-functions.php:4990 msgid "Comment Date" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:4988 +#: app/main/controllers/template/rtmedia-functions.php:4994 msgid "Comment Content" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:5091 +#: app/main/controllers/template/rtmedia-functions.php:5097 msgid "Number of Views" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:5095 +#: app/main/controllers/template/rtmedia-functions.php:5101 msgid "Date of First View" msgstr "" -#: app/main/controllers/template/rtmedia-functions.php:5193 +#: app/main/controllers/template/rtmedia-functions.php:5199 msgid "Date" msgstr "" @@ -3019,18 +3019,18 @@ msgstr "" msgid "Invalid attribute passed for rtmedia_gallery shortcode." msgstr "" -#: app/main/controllers/template/RTMediaTemplate.php:470 -#: app/main/controllers/template/RTMediaTemplate.php:610 -#: app/main/controllers/template/RTMediaTemplate.php:733 -#: app/main/controllers/template/RTMediaTemplate.php:973 +#: app/main/controllers/template/RTMediaTemplate.php:472 +#: app/main/controllers/template/RTMediaTemplate.php:612 +#: app/main/controllers/template/RTMediaTemplate.php:735 +#: app/main/controllers/template/RTMediaTemplate.php:975 msgid "Ooops !!! Invalid access. No nonce was found !!" msgstr "" -#: app/main/controllers/template/RTMediaTemplate.php:480 +#: app/main/controllers/template/RTMediaTemplate.php:482 msgid "Media updated Successfully" msgstr "" -#: app/main/controllers/template/RTMediaTemplate.php:499 +#: app/main/controllers/template/RTMediaTemplate.php:501 msgid "Error in updating Media" msgstr "" @@ -3038,33 +3038,33 @@ msgstr "" msgid "Error Uploading File" msgstr "" -#: app/main/controllers/upload/processors/RTMediaUploadFile.php:303 +#: app/main/controllers/upload/processors/RTMediaUploadFile.php:294 msgid "MP4 file you have uploaded is corrupt." msgstr "" -#: app/main/controllers/upload/processors/RTMediaUploadFile.php:311 -#: app/main/controllers/upload/processors/RTMediaUploadFile.php:315 +#: app/main/controllers/upload/processors/RTMediaUploadFile.php:302 +#: app/main/controllers/upload/processors/RTMediaUploadFile.php:306 msgid "The MP4 file you have uploaded is using an unsupported video codec. Supported video codec is H.264." msgstr "" -#: app/main/controllers/upload/processors/RTMediaUploadFile.php:319 +#: app/main/controllers/upload/processors/RTMediaUploadFile.php:310 msgid "The MP4 file you have uploaded is not a video file." msgstr "" -#: app/main/controllers/upload/processors/RTMediaUploadFile.php:332 +#: app/main/controllers/upload/processors/RTMediaUploadFile.php:323 msgid "MP3 file you have uploaded is currupt." msgstr "" -#: app/main/controllers/upload/processors/RTMediaUploadFile.php:340 -#: app/main/controllers/upload/processors/RTMediaUploadFile.php:344 +#: app/main/controllers/upload/processors/RTMediaUploadFile.php:331 +#: app/main/controllers/upload/processors/RTMediaUploadFile.php:335 msgid "The MP3 file you have uploaded is using an unsupported audio format. Supported audio format is MP3." msgstr "" -#: app/main/controllers/upload/processors/RTMediaUploadFile.php:348 +#: app/main/controllers/upload/processors/RTMediaUploadFile.php:339 msgid "The MP3 file you have uploaded is not an audio file." msgstr "" -#: app/main/controllers/upload/processors/RTMediaUploadFile.php:355 +#: app/main/controllers/upload/processors/RTMediaUploadFile.php:346 msgid "Media File you have tried to upload is not supported. Supported media files are .jpg, .png, .gif, .mp3, .mov and .mp4." msgstr "" diff --git a/readme.txt b/readme.txt index f62f0122e..1da5b3b6b 100644 --- a/readme.txt +++ b/readme.txt @@ -1,11 +1,11 @@ === rtMedia for WordPress, BuddyPress and bbPress === -Contributors: rtcamp, mangeshp, sanket.parmar, pranalipatel, jignesh.nakrani, manishsongirkar36, kiranpotphode, yahil, 1naveengiri, bhargavbhandari90, raftaar1191, rittesh.patel, sagarjadhav, pushpak.pop, faishal, desaiuditd, rahul286, JoshuaAbenazer, gagan0123, saurabhshukla, nitun.lanjewar, umesh.nevase, suhasgirgaonkar, neerukoul, hrishiv90, kanakiyajay, jarretc, tobiaskluge, rafaelfunchal, UmeshSingla, mehulkaklotar, tannermirabel, kishores, chandrapatel, rahul3883, nomnom99, sayanchakraborty, milindmore22, thrijith, abhijitrakas, sid177, montu3366, jashwini, juhise, ravatparmar, dharmin16, malavvasita, pooja1210, krupajnanda, surajkumarsingh, kanumalivad, dishitpala, shobhit2412, vaishu.agola27, kapilpaul, opurockey, vkd007, pavanpatil1, pradeep1308, shardul200, sabbir1991, kamalahmed, ibnulk, harshbarach, Mukulsingh27, vishalkakadiya, elifvish, krupajnanda, utsavladani, krishana79, rohitmathur7, kuldipchaudhary, mchirag2002, vedantgandhi28, mohamedahamed, thehercules, suryakantupadhyay +Contributors: rtcamp, mangeshp, sanket.parmar, pranalipatel, jignesh.nakrani, manishsongirkar36, kiranpotphode, yahil, 1naveengiri, bhargavbhandari90, raftaar1191, rittesh.patel, sagarjadhav, pushpak.pop, faishal, desaiuditd, rahul286, JoshuaAbenazer, gagan0123, saurabhshukla, nitun.lanjewar, umesh.nevase, suhasgirgaonkar, neerukoul, hrishiv90, kanakiyajay, jarretc, tobiaskluge, rafaelfunchal, UmeshSingla, mehulkaklotar, tannermirabel, kishores, chandrapatel, rahul3883, nomnom99, sayanchakraborty, milindmore22, thrijith, abhijitrakas, sid177, montu3366, jashwini, juhise, ravatparmar, dharmin16, malavvasita, pooja1210, krupajnanda, surajkumarsingh, kanumalivad, dishitpala, shobhit2412, vaishu.agola27, kapilpaul, opurockey, vkd007, pavanpatil1, pradeep1308, shardul200, sabbir1991, kamalahmed, ibnulk, harshbarach, Mukulsingh27, vishalkakadiya, elifvish, krupajnanda, utsavladani, krishana79, rohitmathur7, kuldipchaudhary, mchirag2002, vedantgandhi28, mohamedahamed, thehercules, suryakantupadhyay, intenzi Tags: BuddyPress, media, multimedia, album, audio, music, video, photo, upload, share, MediaElement.js, media-node, rtMedia, WordPress, bbPress, masonry License: GPLv2 or later License URI: http://www.gnu.org/licenses/gpl-2.0.html Requires at least: 4.9.6 Tested up to: 7.0 -Stable tag: 4.7.13 +Stable tag: 4.7.14 Add albums, photo, audio/video upload, privacy, sharing, front-end uploads & more. All this works on mobile/tablets devices. @@ -128,6 +128,15 @@ http://www.youtube.com/watch?v=dJrykKQGDcs == Changelog == += 4.7.14 [October 01, 2026] = + +* FIXED + * Fixed file upload handling to prevent arbitrary file sideloading. + * Fixed file extension validation to enforce allowed media extensions strictly. + * Fixed album permission checks when moving media to another album. + * Fixed media edit sanitization to prevent unauthorized attribute modifications. + * Fixed media privacy level validation against allowed values. + = 4.7.13 [August 27, 2026] = * FIXED @@ -1024,6 +1033,9 @@ http://www.youtube.com/watch?v=dJrykKQGDcs == Upgrade Notice == += 4.7.14 = +This release includes important security improvements for media uploads, file extension validation and media edit authorization. We strongly recommend upgrading. + = 4.7.13 = This release includes important security improvements for API authentication and tokens. Existing API users must log in again to receive a new token. We strongly recommend upgrading.