Skip to content

Fix: Enforce media ownership verification for activity and comment attachments #2379

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Intenzi merged 3 commits into from
Oct 13, 2026
Merged

Fix: Enforce media ownership verification for activity and comment attachments #2379

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f86e8a4
fix: enforce media ownership verification for activity and comment at…
Intenzi Oct 12, 2026
0418b60
fix: support batch media ownership validation in rtmedia_is_media_owner
Intenzi Oct 12, 2026
6fd5cb7
fix: validate all attached media and prevent metadata mutation
Intenzi Oct 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions app/main/controllers/activity/RTMediaBuddyPressActivity.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -506,7 +506,7 @@ public function bp_activity_content_before_save( $content, $class_obj ) {
}

$rtmedia_attached_files = filter_input( INPUT_POST, 'rtMedia_attached_files', FILTER_DEFAULT, FILTER_REQUIRE_ARRAY );
if ( ( ! empty( $rtmedia_attached_files ) ) && is_array( $rtmedia_attached_files ) ) {
if ( ( ! empty( $rtmedia_attached_files ) ) && is_array( $rtmedia_attached_files ) && rtmedia_is_media_owner( $rtmedia_attached_files ) ) {
$obj_activity = new RTMediaActivity( $rtmedia_attached_files, 0, $content );

// Remove action to fix duplication issue of comment content.
Expand Down Expand Up @@ -575,7 +575,7 @@ public function comment_sync( $comment_id, $param ) {
// has media in comment.
$rtmedia_attached_files = filter_input( INPUT_POST, 'rtMedia_attached_files', FILTER_DEFAULT, FILTER_REQUIRE_ARRAY );
// if the media is not empty.
if ( is_array( $rtmedia_attached_files ) && ! empty( $rtmedia_attached_files[0] ) && class_exists( 'RTMediaActivity' ) ) {
if ( is_array( $rtmedia_attached_files ) && ! empty( $rtmedia_attached_files ) && class_exists( 'RTMediaActivity' ) && rtmedia_is_media_owner( $rtmedia_attached_files, $user_id ) ) {
// create new html for comment content.
$obj_comment = new RTMediaActivity( $rtmedia_attached_files[0], 0, $param['content'] );
$param['content'] = $obj_comment->create_activity_html( 'comment-media' );
Expand Down Expand Up @@ -622,13 +622,13 @@ public function bp_activity_posted_update( $content, $user_id, $activity_id ) {
do_action( 'rtmedia_bp_before_activity_posted', $content, $user_id, $activity_id );

$rtmedia_attached_files = filter_input( INPUT_POST, 'rtMedia_attached_files', FILTER_DEFAULT, FILTER_REQUIRE_ARRAY );
if ( is_array( $rtmedia_attached_files ) ) {
if ( is_array( $rtmedia_attached_files ) && ! empty( $rtmedia_attached_files ) ) {
bp_activity_update_meta( $activity_id, 'bp_activity_text', bp_activity_filter_kses( $content ) );
$media_obj = new RTMediaModel();
// Credit faisal : https://gist.github.com/faishal/c4306ae7267fff976465.
$in_str_arr = array_fill( 0, count( $rtmedia_attached_files ), '%d' );
$in_str = join( ',', $in_str_arr );
$sql = $wpdb->prepare( "update {$media_obj->table_name} set activity_id = %d where blog_id = %d and ", $activity_id, get_current_blog_id() ); // phpcs:ignore
$sql = $wpdb->prepare( "update {$media_obj->table_name} set activity_id = %d where blog_id = %d and media_author = %d and ", $activity_id, get_current_blog_id(), $user_id ); // phpcs:ignore
$form_id_where = $wpdb->prepare( "id IN ($in_str)", $rtmedia_attached_files ); // phpcs:ignore
$sql .= $form_id_where;
$wpdb->query( $sql ); // phpcs:ignore
Expand Down Expand Up @@ -1226,7 +1226,7 @@ public function activity_after_media_comment( $params ) {
$rtmedia_attached_files = filter_input( INPUT_POST, 'rtMedia_attached_files', FILTER_DEFAULT, FILTER_REQUIRE_ARRAY );

// check media should be in array format and is not empty to.
if ( ! empty( $rtmedia_attached_files ) && class_exists( 'RTMediaActivity' ) && is_array( $rtmedia_attached_files ) ) {
if ( ! empty( $rtmedia_attached_files ) && class_exists( 'RTMediaActivity' ) && is_array( $rtmedia_attached_files ) && rtmedia_is_media_owner( $rtmedia_attached_files, $user_id ) ) {
$comment_media = true;
$comment_media_id = $rtmedia_attached_files[0];
$obj_comment = new RTMediaActivity( $rtmedia_attached_files[0], 0, $comment_content );
Expand Down
2 changes: 1 addition & 1 deletion app/main/controllers/media/RTMediaComment.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,7 +100,7 @@ public function add( $attr ) {
$rtmedia_attached_files = filter_input( INPUT_POST, 'rtMedia_attached_files', FILTER_DEFAULT, FILTER_REQUIRE_ARRAY );

// add comment id in the rtmedia meta fields.
if ( ! empty( $rtmedia_attached_files ) && is_array( $rtmedia_attached_files ) ) {
if ( ! empty( $rtmedia_attached_files ) && is_array( $rtmedia_attached_files ) && function_exists( 'rtmedia_is_media_owner' ) && rtmedia_is_media_owner( $rtmedia_attached_files ) ) {
add_rtmedia_meta( $rtmedia_attached_files[0], 'rtmedia_comment_media_comment_id', $id );
}

Expand Down
17 changes: 11 additions & 6 deletions app/main/controllers/template/RTMediaTemplate.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -894,12 +894,17 @@ public function check_return_comments() {
}

if ( ! empty( $rtmedia_attached_files ) ) {
// has media.
$comment_with_media = true;

// create new html for comment content.
$obj_comment = new RTMediaActivity( $rtmedia_attached_files[0], 0, $comment_content );
$comment_content = $obj_comment->create_activity_html( 'comment-media' );
if ( rtmedia_is_media_owner( $rtmedia_attached_files ) ) {
// has media.
$comment_with_media = true;

// create new html for comment content.
$obj_comment = new RTMediaActivity( $rtmedia_attached_files[0], 0, $comment_content );
$comment_content = $obj_comment->create_activity_html( 'comment-media' );
} else {
unset( $_POST['rtMedia_attached_files'] );
$rtmedia_attached_files = array();
}
}

$comment = new RTMediaComment();
Expand Down
33 changes: 17 additions & 16 deletions app/main/controllers/template/rtmedia-ajax-actions.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -214,24 +214,25 @@ function rtmedia_bp_activity_after_save_callback( $activity_data ) {

// check if class exits or not and it has any media in it.
if ( ! empty( $rtmedia_attached_files ) && isset( $activity_data->id ) && is_array( $rtmedia_attached_files ) && ! empty( $rtmedia_attached_files[0] ) && class_exists( 'RTMediaModel' ) ) {
if ( rtmedia_is_media_owner( $rtmedia_attached_files ) ) {
if ( function_exists( 'rtmedia_get_original_comment_media_content' ) ) {
// get the original content of media.
$original_content = rtmedia_get_original_comment_media_content();
// save the original content in the meta fields.
bp_activity_update_meta( $activity_data->id, 'bp_activity_text', $original_content );
}

if ( function_exists( 'rtmedia_get_original_comment_media_content' ) ) {
// get the original content of media.
$original_content = rtmedia_get_original_comment_media_content();
// save the original content in the meta fields.
bp_activity_update_meta( $activity_data->id, 'bp_activity_text', $original_content );
$rtmedia_model = new RTMediaModel();
$rtmedia_model->update(
array(
'activity_id' => $activity_data->id,
),
array(
'id' => $rtmedia_attached_files[0],
)
);
}

$rtmedia_model = new RTMediaModel();
$rtmedia_model->update(
array(
'activity_id' => $activity_data->id,
),
array(
'id' => $rtmedia_attached_files[0],
)
);

$privacy = -1;
$form_id = filter_input( INPUT_POST, 'form_id', FILTER_SANITIZE_NUMBER_INT );

Expand Down Expand Up @@ -289,7 +290,7 @@ function rtmedia_bp_activity_comment_content_callback( $content ) {

if ( ! empty( $rtmedia_attached_files ) && ! empty( $comment_id ) && ! empty( $form_id ) ) {

if ( ! empty( $rtmedia_attached_files[0] ) && is_array( $rtmedia_attached_files ) && class_exists( 'RTMediaActivity' ) ) {
if ( ! empty( $rtmedia_attached_files[0] ) && is_array( $rtmedia_attached_files ) && class_exists( 'RTMediaActivity' ) && rtmedia_is_media_owner( $rtmedia_attached_files ) ) {
$obj_comment = new RTMediaActivity( $rtmedia_attached_files[0], 0, $content );
$new_content = $obj_comment->create_activity_html();
}
Expand Down
44 changes: 44 additions & 0 deletions app/main/controllers/template/rtmedia-functions.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5394,3 +5394,47 @@ function rtmedia_like_eraser( $email_address, $page = 1 ) {
'done' => $done,
);
}

/**
* Check if the given user owns the specified media.
*
* @param int|array $media_id Media ID or array of Media IDs.
* @param int $user_id Optional. User ID. Defaults to current logged-in user.
*
* @return bool True if media exists and author matches user ID, false otherwise.
*/
function rtmedia_is_media_owner( $media_id, $user_id = 0 ) {
if ( empty( $media_id ) ) {
return false;
}

$user_id = ! empty( $user_id ) ? intval( $user_id ) : get_current_user_id();
if ( empty( $user_id ) ) {
return false;
}

// Normalize input to a unique array of valid integer IDs.
$media_ids = is_array( $media_id ) ? $media_id : array( $media_id );
$media_ids = array_filter( array_map( 'intval', $media_ids ) );
$media_ids = array_unique( $media_ids );

if ( empty( $media_ids ) ) {
return false;
}

$model = new RTMediaModel();
$media = $model->get( array( 'id' => $media_ids ) );

if ( count( $media ) !== count( $media_ids ) ) {
return false;
}

foreach ( $media as $item ) {
if ( intval( $item->media_author ) !== $user_id ) {
return false;
}
}

return true;
}

Loading