Skip to content

Version update v4.7.14 #2376

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Pradeep1308 merged 14 commits into from
Oct 6, 2026
Merged

Version update v4.7.14 #2376

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
a6e6bc4
fix: validate album permissions before updating media album in save_s…
Intenzi Sep 29, 2026
db2a01c
fix: enforce allowlist via exceptions param in rtmedia_sanitize_objec…
Intenzi Sep 29, 2026
be9386a
fix: sanitize and validate privacy level against allowed values
Intenzi Sep 29, 2026
1be2b05
Merge pull request #2373 from rtCamp/fix/media-edit-security-fixes
Intenzi Sep 30, 2026
62baca7
fix: strictly validate file extension and remove MIME type regex fall…
Intenzi Sep 30, 2026
90fdb0c
fix: restrict file uploads to standard multipart $_FILES to prevent a…
Intenzi Sep 30, 2026
cf899ec
Merge pull request #2374 from rtCamp/fix/upload-security-fixes
Intenzi Oct 1, 2026
e9d64fa
Version update v4.7.14
Intenzi Oct 1, 2026
f27ec4c
Merge pull request #2375 from rtCamp/version-update/v4.7.14
Intenzi Oct 1, 2026
b958bda
chore: update release date to October 06, 2026 for v4.7.14
Intenzi Oct 6, 2026
9751781
fix: disallow privacy modification on single media and album edit whe…
Intenzi Oct 6, 2026
9e4ddc6
Merge pull request #2378 from rtCamp/fix/edit-privacy-permissions
Intenzi Oct 6, 2026
4a04156
docs: add privacy edit fix to v4.7.14 changelog
Intenzi Oct 6, 2026
88592bc
Merge pull request #2377 from rtCamp/chore/update-release-date-v4.7.14
Intenzi Oct 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ Add albums, photo, audio/video upload, privacy, sharing, front-end uploads & mor
![BrowserStack Status](https://www.browserstack.com/automate/badge.svg?badge_key=MU1JamdmRnppK0hhQy9QMU8wdDJ2MUEyb1ZuS0ljVFQvSHZ6anFvNzUxTT0tLXhUNnliTnZGcE5CcW93N0I1eXdnM3c9PQ==--8c124e667dd0c317618efde1bed2b260000916b6)


* **Contributors:** [rtcamp](http://profiles.wordpress.org/rtcamp), [mangeshp](http://profiles.wordpress.org/mangeshp), [sanket.parmar](http://profiles.wordpress.org/sanket.parmar), [pranalipatel](http://profiles.wordpress.org/pranalipatel), [jignesh.nakrani](http://profiles.wordpress.org/jignesh.nakrani), [manishsongirkar36](http://profiles.wordpress.org/manishsongirkar36), [kiranpotphode](http://profiles.wordpress.org/kiranpotphode), [yahil](http://profiles.wordpress.org/yahil), [1naveengiri](http://profiles.wordpress.org/1naveengiri), [bhargavbhandari90](http://profiles.wordpress.org/bhargavbhandari90), [deepak1191](http://profiles.wordpress.org/deepak1191), [rittesh.patel](http://profiles.wordpress.org/rittesh.patel), [sagarjadhav](http://profiles.wordpress.org/sagarjadhav), [pushpak.pop](http://profiles.wordpress.org/pushpak.pop), [faishal](http://profiles.wordpress.org/faishal), [desaiuditd](http://profiles.wordpress.org/desaiuditd), [rahul286](http://profiles.wordpress.org/rahul286), [JoshuaAbenazer](http://profiles.wordpress.org/JoshuaAbenazer), [gagan0123](http://profiles.wordpress.org/gagan0123), [saurabhshukla](http://profiles.wordpress.org/saurabhshukla), [nitun.lanjewar](http://profiles.wordpress.org/nitun.lanjewar), [umesh.nevase](http://profiles.wordpress.org/umesh.nevase), [suhasgirgaonkar](http://profiles.wordpress.org/suhasgirgaonkar), [neerukoul](http://profiles.wordpress.org/neerukoul), [hrishiv90](http://profiles.wordpress.org/hrishiv90), [kanakiyajay](http://profiles.wordpress.org/kanakiyajay), [jarretc](http://profiles.wordpress.org/jarretc), [tobiaskluge](http://profiles.wordpress.org/tobiaskluge), [rafaelfunchal](http://profiles.wordpress.org/rafaelfunchal), [UmeshSingla](http://profiles.wordpress.org/UmeshSingla), [mehulkaklotar](http://profiles.wordpress.org/mehulkaklotar), [tannermirabel](http://profiles.wordpress.org/tannermirabel), [kishores](http://profiles.wordpress.org/kishores), [chandrapatel](http://profiles.wordpress.org/chandrapatel), [rahul3883](http://profiles.wordpress.org/rahul3883/), [nomnom99](http://profiles.wordpress.org/nomnom99), [sayanchakraborty](https://profiles.wordpress.org/sayanchakraborty), [milindmore22](https://profiles.wordpress.org/milindmore22), [thrijith](https://profiles.wordpress.org/thrijith), [abhijitrakas](https://profiles.wordpress.org/abhijitrakas), [sid177](https://profiles.wordpress.org/sid177), [montu3366](https://profiles.wordpress.org/montu3366), [jashwini](https://profiles.wordpress.org/jashwini), [juhise](https://profiles.wordpress.org/juhise), [ravatparmar](https://profiles.wordpress.org/ravatparmar), [dharmin16](https://profiles.wordpress.org/dharmin16), [malavvasita](https://profiles.wordpress.org/malavvasita), [pooja1210](https://profiles.wordpress.org/pooja1210), [krupajnanda](https://profiles.wordpress.org/krupajnanda), [kanumalivad](https://profiles.wordpress.org/kanumalivad), [surajkumarsingh](https://profiles.wordpress.org/surajkumarsingh), [dishitpala](https://profiles.wordpress.org/dishitpala), [shobhit2412](https://profiles.wordpress.org/shobhit2412/), [vkd007](https://profiles.wordpress.org/vkd007/), [vaishu.agola27](https://profiles.wordpress.org/vaishuagola27/), [kapilpaul](https://profiles.wordpress.org/kapilpaul/), [opurockey](https://profiles.wordpress.org/opurockey/), [pavanpatil1](https://profiles.wordpress.org/pavanpatil1/), [pradeep1308](https://profiles.wordpress.org/pradeep1308/), [shardul200](https://profiles.wordpress.org/shardul200/), [ibnulk](https://profiles.wordpress.org/ibnulk/), [sabbir1991](https://profiles.wordpress.org/sabbir1991/), [kamalahmed](https://profiles.wordpress.org/kamalahmed/), [harshbarach](https://profiles.wordpress.org/harshbarach/), [mukulsingh27](https://profiles.wordpress.org/mukulsingh27/), [vishalkakadiya](https://profiles.wordpress.org/vishalkakadiya/), [elifvish](https://profiles.wordpress.org/elifvish/), [krupajnanda](https://profiles.wordpress.org/krupajnanda/), [utsavladani](https://profiles.wordpress.org/utsavladani/),[krishana79](https://profiles.wordpress.org/krishana79/), [rohitmathur7](https://profiles.wordpress.org/rohitmathur7/), [kuldipchaudhary](https://profiles.wordpress.org/kuldipchaudhary/), [mchirag2002](https://profiles.wordpress.org/mchirag2002/), [vedantgandhi28](https://profiles.wordpress.org/vedantgandhi28/), [mohamedahamed](https://profiles.wordpress.org/mohamedahamed/),[thehercules](https://profiles.wordpress.org/thehercules/), [suryakantupadhyay](https://profiles.wordpress.org/suryakantupadhyay/)
* **Contributors:** [rtcamp](http://profiles.wordpress.org/rtcamp), [mangeshp](http://profiles.wordpress.org/mangeshp), [sanket.parmar](http://profiles.wordpress.org/sanket.parmar), [pranalipatel](http://profiles.wordpress.org/pranalipatel), [jignesh.nakrani](http://profiles.wordpress.org/jignesh.nakrani), [manishsongirkar36](http://profiles.wordpress.org/manishsongirkar36), [kiranpotphode](http://profiles.wordpress.org/kiranpotphode), [yahil](http://profiles.wordpress.org/yahil), [1naveengiri](http://profiles.wordpress.org/1naveengiri), [bhargavbhandari90](http://profiles.wordpress.org/bhargavbhandari90), [deepak1191](http://profiles.wordpress.org/deepak1191), [rittesh.patel](http://profiles.wordpress.org/rittesh.patel), [sagarjadhav](http://profiles.wordpress.org/sagarjadhav), [pushpak.pop](http://profiles.wordpress.org/pushpak.pop), [faishal](http://profiles.wordpress.org/faishal), [desaiuditd](http://profiles.wordpress.org/desaiuditd), [rahul286](http://profiles.wordpress.org/rahul286), [JoshuaAbenazer](http://profiles.wordpress.org/JoshuaAbenazer), [gagan0123](http://profiles.wordpress.org/gagan0123), [saurabhshukla](http://profiles.wordpress.org/saurabhshukla), [nitun.lanjewar](http://profiles.wordpress.org/nitun.lanjewar), [umesh.nevase](http://profiles.wordpress.org/umesh.nevase), [suhasgirgaonkar](http://profiles.wordpress.org/suhasgirgaonkar), [neerukoul](http://profiles.wordpress.org/neerukoul), [hrishiv90](http://profiles.wordpress.org/hrishiv90), [kanakiyajay](http://profiles.wordpress.org/kanakiyajay), [jarretc](http://profiles.wordpress.org/jarretc), [tobiaskluge](http://profiles.wordpress.org/tobiaskluge), [rafaelfunchal](http://profiles.wordpress.org/rafaelfunchal), [UmeshSingla](http://profiles.wordpress.org/UmeshSingla), [mehulkaklotar](http://profiles.wordpress.org/mehulkaklotar), [tannermirabel](http://profiles.wordpress.org/tannermirabel), [kishores](http://profiles.wordpress.org/kishores), [chandrapatel](http://profiles.wordpress.org/chandrapatel), [rahul3883](http://profiles.wordpress.org/rahul3883/), [nomnom99](http://profiles.wordpress.org/nomnom99), [sayanchakraborty](https://profiles.wordpress.org/sayanchakraborty), [milindmore22](https://profiles.wordpress.org/milindmore22), [thrijith](https://profiles.wordpress.org/thrijith), [abhijitrakas](https://profiles.wordpress.org/abhijitrakas), [sid177](https://profiles.wordpress.org/sid177), [montu3366](https://profiles.wordpress.org/montu3366), [jashwini](https://profiles.wordpress.org/jashwini), [juhise](https://profiles.wordpress.org/juhise), [ravatparmar](https://profiles.wordpress.org/ravatparmar), [dharmin16](https://profiles.wordpress.org/dharmin16), [malavvasita](https://profiles.wordpress.org/malavvasita), [pooja1210](https://profiles.wordpress.org/pooja1210), [krupajnanda](https://profiles.wordpress.org/krupajnanda), [kanumalivad](https://profiles.wordpress.org/kanumalivad), [surajkumarsingh](https://profiles.wordpress.org/surajkumarsingh), [dishitpala](https://profiles.wordpress.org/dishitpala), [shobhit2412](https://profiles.wordpress.org/shobhit2412/), [vkd007](https://profiles.wordpress.org/vkd007/), [vaishu.agola27](https://profiles.wordpress.org/vaishuagola27/), [kapilpaul](https://profiles.wordpress.org/kapilpaul/), [opurockey](https://profiles.wordpress.org/opurockey/), [pavanpatil1](https://profiles.wordpress.org/pavanpatil1/), [pradeep1308](https://profiles.wordpress.org/pradeep1308/), [shardul200](https://profiles.wordpress.org/shardul200/), [ibnulk](https://profiles.wordpress.org/ibnulk/), [sabbir1991](https://profiles.wordpress.org/sabbir1991/), [kamalahmed](https://profiles.wordpress.org/kamalahmed/), [harshbarach](https://profiles.wordpress.org/harshbarach/), [mukulsingh27](https://profiles.wordpress.org/mukulsingh27/), [vishalkakadiya](https://profiles.wordpress.org/vishalkakadiya/), [elifvish](https://profiles.wordpress.org/elifvish/), [krupajnanda](https://profiles.wordpress.org/krupajnanda/), [utsavladani](https://profiles.wordpress.org/utsavladani/),[krishana79](https://profiles.wordpress.org/krishana79/), [rohitmathur7](https://profiles.wordpress.org/rohitmathur7/), [kuldipchaudhary](https://profiles.wordpress.org/kuldipchaudhary/), [mchirag2002](https://profiles.wordpress.org/mchirag2002/), [vedantgandhi28](https://profiles.wordpress.org/vedantgandhi28/), [mohamedahamed](https://profiles.wordpress.org/mohamedahamed/),[thehercules](https://profiles.wordpress.org/thehercules/), [suryakantupadhyay](https://profiles.wordpress.org/suryakantupadhyay/), [intenzi](https://profiles.wordpress.org/intenzi/)

* **License:** [GPL v2 or later]( http://www.gnu.org/licenses/gpl-2.0.html)

Expand Down Expand Up @@ -147,6 +147,15 @@ https://www.youtube.com/watch?v=dJrykKQGDcs

## Changelog ##

### 4.7.14

* FIXED
* Fixed file upload handling to prevent arbitrary file sideloading.
* Fixed file extension validation to enforce allowed media extensions strictly.
* Fixed album permission checks when moving media to another album.
* Fixed media edit sanitization to prevent unauthorized attribute modifications.
* Fixed media privacy level validation against allowed values.

### 4.7.13

* FIXED
Expand Down
23 changes: 20 additions & 3 deletions app/main/controllers/template/RTMediaTemplate.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -361,10 +361,24 @@ public function save_single_edit() {

do_action( 'rtmedia_before_update_media', $rtmedia_query->action_query->id );

$data_array = array( 'media_title', 'description', 'privacy' );
// Privacy should not be editable for group media, moderated media and when privacy override is disabled.
if ( ( isset( $rtmedia_query->query['context'] ) && 'group' === $rtmedia_query->query['context'] )
|| ( isset( $rtmedia_query->media[0]->context ) && 'group' === $rtmedia_query->media[0]->context )
// Moderated media privacy is not editable.
|| ( isset( $rtmedia_query->media[0]->privacy ) && 80 === intval( $rtmedia_query->media[0]->privacy ) )
|| ! is_rtmedia_privacy_enable()
|| ! is_rtmedia_privacy_user_overide() ) {
unset( $_POST['privacy'] );
}

$data_array = array( 'media_title', 'description' );

if ( isset( $_POST['privacy'] ) ) {
$data_array[] = 'privacy';
}
$_album_id = filter_input( INPUT_POST, 'album_id', FILTER_SANITIZE_NUMBER_INT );
// for medias except album and playlist, if album_is is found, then update album_id for the media also.
if ( ! empty( $_album_id ) ) {
if ( ! empty( $_album_id ) && rtmedia_current_user_can_add_to_album( $_album_id ) ) {
$data_array[] = 'album_id';

// check it has an media id.
Expand All @@ -373,6 +387,8 @@ public function save_single_edit() {
// update the comment media album.
$comment->update_comment_media_album( $rtmedia_query->media[0]->media_id );
}
} else {
unset( $_POST['album_id'] );
}

$data = rtmedia_sanitize_object( $_POST, $data_array ); // Properly Sanitized.
Expand Down Expand Up @@ -539,7 +555,8 @@ public function save_album_edit() {
$_selected_arr = filter_input_array( INPUT_POST, $filters );
$_selected = $_selected_arr['selected'];
if ( ! empty( $submit ) ) {
$data_array = array( 'media_title', 'description', 'privacy' );
$data_array = array( 'media_title', 'description' );
unset( $_POST['privacy'] );
$data = rtmedia_sanitize_object( $_POST, $data_array ); // Properly Sanitized.
$album = $model->get_media( array( 'id' => $rtmedia_query->media_query['album_id'] ), false, false );
$state = $media->update( $album[0]->id, $data, $album[0]->media_id );
Expand Down
12 changes: 9 additions & 3 deletions app/main/controllers/template/rtmedia-functions.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -971,16 +971,22 @@ function rtmedia_duration( $id = false ) {
* Sanitizing object
*
* @param array $data Array of data.
* @param array $exceptions Exception array.
* @param array $exceptions Allowlist of allowed keys to be sanitized.
*
* @return array
*/
function rtmedia_sanitize_object( $data, $exceptions = array() ) {
$allowed_keys = array_merge( RTMediaMedia::$default_object, $exceptions );
if ( empty( $exceptions ) || ! is_array( $exceptions ) ) {
return array();
}

$allowed_keys = $exceptions;
$sanitized = array();
foreach ( $data as $key => $value ) {
if ( in_array( $key, $allowed_keys, true ) ) {
if ( is_array( $value ) ) {
if ( 'privacy' === $key ) {
$sanitized[ $key ] = rtmedia_sanitize_privacy_level( $value );
} elseif ( is_array( $value ) ) {
$sanitized[ $key ] = rtmedia_sanitize_object( $value );
} elseif ( is_numeric( $value ) ) {
$sanitized[ $key ] = absint( $value );
Expand Down
1 change: 1 addition & 0 deletions app/main/controllers/upload/RTMediaUploadEndpoint.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -267,6 +267,7 @@ public function template_redirect( $create_activity = true ) {
if ( empty( $privacy ) ) {
$privacy = 0;
}
$privacy = rtmedia_sanitize_privacy_level( $privacy );
$obj_activity = new RTMediaActivity( $update_activity_media, $privacy, false );

if ( ! empty( $same_medias[0] ) && ! empty( $activity_id ) ) {
Expand Down
19 changes: 5 additions & 14 deletions app/main/controllers/upload/processors/RTMediaUploadFile.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,7 @@ public function process() {
include_once ABSPATH . 'wp-admin/includes/file.php';
include_once ABSPATH . 'wp-admin/includes/image.php';

$upload_type = $this->fake ? 'wp_handle_sideload' : 'wp_handle_upload';
$upload_type = 'wp_handle_upload';

@Intenzi Intenzi Oct 6, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This can be dismissed. wp_handle_sideload was deliberately removed to prevent arbitrary server file sideloading vulnerabilities via client-supplied paths, as recommended by security intelligence. All legitimate rtMedia uploads (UI, activity, and AJAX) operate strictly via standard multipart $_FILES['rtmedia_file'] through wp_handle_upload. Furthermore, rtmedia_add_media() is not utilized internally anywhere in the plugin.


// todo why use $rt_set_filter_uplaod_dir global variable if we can remove filter for upload_dir after upload finish.
global $rt_set_filter_uplaod_dir;
Expand Down Expand Up @@ -173,16 +173,9 @@ public function upload_dir( $upload_dir ) {
*/
public function set_file( $files ) {
/**
* If files parameter is provided then take th file details from that object
* Check for $_FILES global object from the form submitted
*/
if ( $files ) {

$this->fake = true;
$this->populate_file_array( (array) $this->uploaded['files'] );
/**
* Otherwise check for $_FILES global object from the form submitted
*/
} elseif ( isset( $_FILES['rtmedia_file'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing -- We are just checking if the value exists over here.
if ( isset( $_FILES['rtmedia_file'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing -- We are just checking if the value exists over here.
$this->populate_file_array( array_map( 'sanitize_text_field', $_FILES['rtmedia_file'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing -- We are just checking if the value exists over here.
// The function populate_file_array is sanitizing string and integer values.
} else {
Expand Down Expand Up @@ -249,10 +242,8 @@ public function is_valid_type( $file ) {
);
$allowed_types = explode( ',', $allowed_types[0]['extensions'] );

if ( false === in_array( strtolower( $file_data['ext'] ), $allowed_types, true ) ) {
if ( ! preg_match( '/' . implode( '|', $allowed_types ) . '/i', $file['type'], $result ) || ! isset( $result[0] ) ) {
throw new RTMediaUploadException( UPLOAD_ERR_EXTENSION );
}
if ( empty( $file_data['ext'] ) || false === in_array( strtolower( $file_data['ext'] ), $allowed_types, true ) ) {
throw new RTMediaUploadException( UPLOAD_ERR_EXTENSION );
}
} catch ( RTMediaUploadException $e ) {
echo esc_html( $e->getMessage() );
Expand Down
11 changes: 11 additions & 0 deletions changelog.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,16 @@
== Changelog ==

= 4.7.14 [October 06, 2026] =

* FIXED
* Fixed file upload handling to prevent arbitrary file sideloading.
* Fixed file extension validation to enforce allowed media extensions strictly.
* Fixed album permission checks when moving media to another album.
* Fixed media edit sanitization to prevent unauthorized attribute modifications.
* Fixed media privacy level validation against allowed values.
* Fixed privacy modification checks on single media and album edit forms.


= 4.7.13 [August 27, 2026] =

* FIXED
Expand Down
4 changes: 2 additions & 2 deletions index.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
* Plugin Name: rtMedia for WordPress, BuddyPress and bbPress
* Plugin URI: https://rtmedia.io/?utm_source=dashboard&utm_medium=plugin&utm_campaign=buddypress-media
* Description: This plugin adds missing media rich features like photos, videos and audio uploading to BuddyPress which are essential if you are building social network, seriously!
* Version: 4.7.13
* Version: 4.7.14
* Requires at least: 4.9.6
* Text Domain: buddypress-media
* Author: rtCamp
Expand All @@ -26,7 +26,7 @@
/**
* The version of the plugin
*/
define( 'RTMEDIA_VERSION', '4.7.13' );
define( 'RTMEDIA_VERSION', '4.7.14' );
}

if ( ! defined( 'RTMEDIA_PATH' ) ) {
Expand Down
Loading