From 253add2a54b813fc7790248e3459affe4d11085a Mon Sep 17 00:00:00 2001 From: Intenzi Date: Mon, 12 Oct 2026 14:57:53 +0530 Subject: [PATCH 1/3] fix: enforce activity ownership check on media upload endpoint --- .../controllers/upload/RTMediaUploadEndpoint.php | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/app/main/controllers/upload/RTMediaUploadEndpoint.php b/app/main/controllers/upload/RTMediaUploadEndpoint.php index fa2d1b6fb..6306bd588 100755 --- a/app/main/controllers/upload/RTMediaUploadEndpoint.php +++ b/app/main/controllers/upload/RTMediaUploadEndpoint.php @@ -87,10 +87,20 @@ public function template_redirect( $create_activity = true ) { do_action( 'rtmedia_upload_set_post_object' ); $this->upload = $model->set_post_object(); - if ( -1 !== $_activity_id ) { - $this->upload['activity_id'] = $_activity_id; - $activity_id = $_activity_id; + if ( -1 !== $_activity_id && ! empty( $_activity_id ) ) { + $can_attach = false; + // Query the activity to check if the activity belongs to the user. + if ( function_exists( 'bp_activity_get_specific' ) ) { + $activity = bp_activity_get_specific( array( 'activity_ids' => array( intval( $_activity_id ) ) ) ); + if ( ! empty( $activity['activities'][0] ) && intval( $activity['activities'][0]->user_id ) === get_current_user_id() ) { + $can_attach = true; + } + } + if ( $can_attach ) { + $this->upload['activity_id'] = $_activity_id; + $activity_id = $_activity_id; + } } // Media uploaded into a group takes its privacy from that group. From 0aaba07626e2d38c84ceab098f149370d81ce33a Mon Sep 17 00:00:00 2001 From: Intenzi Date: Mon, 12 Oct 2026 18:17:54 +0530 Subject: [PATCH 2/3] fix: strip unverified activity_id from upload object --- app/main/controllers/upload/RTMediaUploadEndpoint.php | 1 + 1 file changed, 1 insertion(+) diff --git a/app/main/controllers/upload/RTMediaUploadEndpoint.php b/app/main/controllers/upload/RTMediaUploadEndpoint.php index 6306bd588..3bd82278b 100755 --- a/app/main/controllers/upload/RTMediaUploadEndpoint.php +++ b/app/main/controllers/upload/RTMediaUploadEndpoint.php @@ -86,6 +86,7 @@ public function template_redirect( $create_activity = true ) { $model = new RTMediaUploadModel(); do_action( 'rtmedia_upload_set_post_object' ); $this->upload = $model->set_post_object(); + unset( $this->upload['activity_id'] ); if ( -1 !== $_activity_id && ! empty( $_activity_id ) ) { $can_attach = false; From 459a282f2e0ce2638ba7ceaa73bbe83490962c43 Mon Sep 17 00:00:00 2001 From: Intenzi Date: Mon, 12 Oct 2026 18:20:05 +0530 Subject: [PATCH 3/3] fix: require authenticated user for activity ownership check --- app/main/controllers/upload/RTMediaUploadEndpoint.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/main/controllers/upload/RTMediaUploadEndpoint.php b/app/main/controllers/upload/RTMediaUploadEndpoint.php index 3bd82278b..5e5f6636a 100755 --- a/app/main/controllers/upload/RTMediaUploadEndpoint.php +++ b/app/main/controllers/upload/RTMediaUploadEndpoint.php @@ -91,7 +91,7 @@ public function template_redirect( $create_activity = true ) { if ( -1 !== $_activity_id && ! empty( $_activity_id ) ) { $can_attach = false; // Query the activity to check if the activity belongs to the user. - if ( function_exists( 'bp_activity_get_specific' ) ) { + if ( is_user_logged_in() && function_exists( 'bp_activity_get_specific' ) ) { $activity = bp_activity_get_specific( array( 'activity_ids' => array( intval( $_activity_id ) ) ) ); if ( ! empty( $activity['activities'][0] ) && intval( $activity['activities'][0]->user_id ) === get_current_user_id() ) { $can_attach = true;