diff --git a/.nvmrc b/.nvmrc index e8aa64417..2bd5a0a98 100644 --- a/.nvmrc +++ b/.nvmrc @@ -1 +1 @@ -v20.18.1 +22 diff --git a/README.md b/README.md index dfd1d7a27..fa5017789 100644 --- a/README.md +++ b/README.md @@ -147,6 +147,11 @@ https://www.youtube.com/watch?v=dJrykKQGDcs ## Changelog ## +### 4.7.16 + +* FIXED + * Fixed GoDAM video player markup corruption in BuddyPress activity updates and comments caused by content filters. + ### 4.7.15 * FIXED diff --git a/changelog.txt b/changelog.txt index 753f122a0..f4ad80942 100644 --- a/changelog.txt +++ b/changelog.txt @@ -1,5 +1,10 @@ == Changelog == += 4.7.16 [October 27, 2026] = + +* FIXED + * Fixed GoDAM video player markup corruption in BuddyPress activity updates and comments caused by content filters. + = 4.7.15 [October 13, 2026] = * FIXED diff --git a/index.php b/index.php index a1da0a583..b5073006a 100644 --- a/index.php +++ b/index.php @@ -3,7 +3,7 @@ * Plugin Name: rtMedia for WordPress, BuddyPress and bbPress * Plugin URI: https://rtmedia.io/?utm_source=dashboard&utm_medium=plugin&utm_campaign=buddypress-media * Description: This plugin adds missing media rich features like photos, videos and audio uploading to BuddyPress which are essential if you are building social network, seriously! - * Version: 4.7.15 + * Version: 4.7.16 * Requires at least: 4.9.6 * Text Domain: buddypress-media * Author: rtCamp @@ -26,7 +26,7 @@ /** * The version of the plugin */ - define( 'RTMEDIA_VERSION', '4.7.15' ); + define( 'RTMEDIA_VERSION', '4.7.16' ); } if ( ! defined( 'RTMEDIA_PATH' ) ) { diff --git a/languages/buddpress-media.pot b/languages/buddpress-media.pot index 2f97e1f3f..c8cb66e7c 100644 --- a/languages/buddpress-media.pot +++ b/languages/buddpress-media.pot @@ -2,14 +2,14 @@ # This file is distributed under the GPLv2 or later. msgid "" msgstr "" -"Project-Id-Version: rtMedia for WordPress, BuddyPress and bbPress 4.7.15\n" +"Project-Id-Version: rtMedia for WordPress, BuddyPress and bbPress 4.7.16\n" "Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/buddypress-media\n" "Last-Translator: FULL NAME \n" "Language-Team: LANGUAGE \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" -"POT-Creation-Date: 2026-10-13T06:23:39+00:00\n" +"POT-Creation-Date: 2026-10-27T06:28:08+00:00\n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "X-Generator: WP-CLI 2.12.0\n" "X-Domain: buddypress-media\n" @@ -3493,19 +3493,19 @@ msgstr "" msgid "Sorry !! You can not edit this album." msgstr "" -#: templates/media/godam-integration.php:211 +#: templates/media/godam-integration.php:284 msgid "Authentication required" msgstr "" -#: templates/media/godam-integration.php:217 +#: templates/media/godam-integration.php:290 msgid "Invalid activity ID" msgstr "" -#: templates/media/godam-integration.php:222 +#: templates/media/godam-integration.php:295 msgid "Activity comment not found" msgstr "" -#: templates/media/godam-integration.php:227 +#: templates/media/godam-integration.php:300 msgid "You do not have permission to view this activity" msgstr "" diff --git a/languages/buddypress-media.pot b/languages/buddypress-media.pot index 2f97e1f3f..c8cb66e7c 100644 --- a/languages/buddypress-media.pot +++ b/languages/buddypress-media.pot @@ -2,14 +2,14 @@ # This file is distributed under the GPLv2 or later. msgid "" msgstr "" -"Project-Id-Version: rtMedia for WordPress, BuddyPress and bbPress 4.7.15\n" +"Project-Id-Version: rtMedia for WordPress, BuddyPress and bbPress 4.7.16\n" "Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/buddypress-media\n" "Last-Translator: FULL NAME \n" "Language-Team: LANGUAGE \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" -"POT-Creation-Date: 2026-10-13T06:23:39+00:00\n" +"POT-Creation-Date: 2026-10-27T06:28:08+00:00\n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "X-Generator: WP-CLI 2.12.0\n" "X-Domain: buddypress-media\n" @@ -3493,19 +3493,19 @@ msgstr "" msgid "Sorry !! You can not edit this album." msgstr "" -#: templates/media/godam-integration.php:211 +#: templates/media/godam-integration.php:284 msgid "Authentication required" msgstr "" -#: templates/media/godam-integration.php:217 +#: templates/media/godam-integration.php:290 msgid "Invalid activity ID" msgstr "" -#: templates/media/godam-integration.php:222 +#: templates/media/godam-integration.php:295 msgid "Activity comment not found" msgstr "" -#: templates/media/godam-integration.php:227 +#: templates/media/godam-integration.php:300 msgid "You do not have permission to view this activity" msgstr "" diff --git a/readme.txt b/readme.txt index 431b0d80b..ea662373e 100644 --- a/readme.txt +++ b/readme.txt @@ -5,7 +5,7 @@ License: GPLv2 or later License URI: http://www.gnu.org/licenses/gpl-2.0.html Requires at least: 4.9.6 Tested up to: 7.0 -Stable tag: 4.7.15 +Stable tag: 4.7.16 Add albums, photo, audio/video upload, privacy, sharing, front-end uploads & more. All this works on mobile/tablets devices. @@ -128,6 +128,11 @@ http://www.youtube.com/watch?v=dJrykKQGDcs == Changelog == += 4.7.16 [October 27, 2026] = + +* FIXED + * Fixed GoDAM video player markup corruption in BuddyPress activity updates and comments caused by content filters. + = 4.7.15 [October 13, 2026] = * FIXED @@ -1041,6 +1046,9 @@ http://www.youtube.com/watch?v=dJrykKQGDcs == Upgrade Notice == += 4.7.16 = +This release fixes GoDAM video player markup corruption and playback issues in BuddyPress activity updates and comments. We recommend upgrading. + = 4.7.15 = This release includes important security improvements for media ownership verification and upload endpoint activity authorization. We strongly recommend upgrading. diff --git a/templates/media/godam-integration.php b/templates/media/godam-integration.php index 616e64ef0..783f2bc55 100644 --- a/templates/media/godam-integration.php +++ b/templates/media/godam-integration.php @@ -135,14 +135,14 @@ function ( $content ) { $godam_videos = ''; - // Build Godam player shortcodes for videos. + // Build neutral placeholders for videos. The real player markup is + // injected later by godam_rtmedia_expand_player_placeholders(), after + // BuddyPress/theme content filters have run, so make_clickable, the + // hashtag linkifier and wpautop cannot corrupt the player attributes. if ( ! empty( $grouped_media['video'] ) ) { foreach ( $grouped_media['video'] as $index => $video ) { $player_id = 'godam-activity-' . esc_attr( $activity->id ) . '-' . $index; - $godam_videos .= do_shortcode( - '[godam_video id="' . esc_attr( $video->media_id ) . - '" context="buddypress" player_id="' . esc_attr( $player_id ) . '"]' - ); + $godam_videos .= godam_rtmedia_build_player_placeholder( $video->media_id, $player_id ); } } @@ -159,9 +159,7 @@ function ( $content ) { foreach ( $child_media as $index => $video ) { $player_id = 'godam-comment-' . esc_attr( $child->id ) . '-' . $index; - $child_videos .= do_shortcode( - '[godam_video id="' . esc_attr( $video->media_id ) . '"]' - ); + $child_videos .= godam_rtmedia_build_player_placeholder( $video->media_id, $player_id ); } if ( $child_videos ) { @@ -188,6 +186,81 @@ function ( $content ) { 10 ); + /** + * Build a neutral placeholder for a GoDAM activity player. + * + * The placeholder deliberately carries no URL and no "#" so the activity + * content filters (make_clickable, the hashtag linkifier, wpautop) leave it + * untouched. It is swapped for the real player markup by + * godam_rtmedia_expand_player_placeholders() on a final, late-priority pass. + * + * @param int|string $media_id rtMedia media id for the video. + * @param string $player_id Unique player id for this activity/comment. + * @param string $context Player context passed to the shortcode. + * @return string Placeholder HTML. + */ + function godam_rtmedia_build_player_placeholder( $media_id, $player_id = '', $context = 'buddypress' ) { + return sprintf( + '
', + esc_attr( $media_id ), + esc_attr( $player_id ), + esc_attr( $context ) + ); + } + + /** + * Expand GoDAM player placeholders into real player markup. + * + * Runs at the last possible priority on bp_get_activity_content_body so every + * other activity content filter (kses, make_clickable, the hashtag linkifier, + * wptexturize, wpautop, nofollow, …) has already finished. The player HTML — + * which carries #hex colours and URLs inside its data-* attributes — is + * therefore never seen by those filters and cannot be corrupted into broken + * tags. Surrounding activity text keeps its normal formatting. + * + * @param string $content Activity content, already fully filtered. + * @return string Content with placeholders replaced by GoDAM players. + */ + function godam_rtmedia_expand_player_placeholders( $content ) { + if ( ! is_string( $content ) || false === strpos( $content, 'godam-activity-player-placeholder' ) ) { + return $content; + } + + return preg_replace_callback( + '#]*class="[^"]*godam-activity-player-placeholder[^"]*"[^>]*>\s*#i', + function ( $matches ) { + $tag = $matches[0]; + + $media_id = preg_match( '/data-media-id="([^"]*)"/', $tag, $m ) ? $m[1] : ''; + $player_id = preg_match( '/data-player-id="([^"]*)"/', $tag, $m ) ? $m[1] : ''; + $context = preg_match( '/data-context="([^"]*)"/', $tag, $m ) ? $m[1] : ''; + + if ( '' === $media_id ) { + return ''; + } + + $shortcode = '[godam_video id="' . esc_attr( $media_id ) . '"'; + if ( '' !== $context ) { + $shortcode .= ' context="' . esc_attr( $context ) . '"'; + } + if ( '' !== $player_id ) { + $shortcode .= ' player_id="' . esc_attr( $player_id ) . '"'; + } + $shortcode .= ']'; + + return do_shortcode( $shortcode ); + }, + $content + ); + } + + // Activity updates render through bp_get_activity_content_body; activity + // comments render through bp_get_activity_content + bp_activity_comment_content + // and never hit the body filter. Hook both pipelines so comment-video + // placeholders are expanded too (otherwise they stay as empty
s). + add_filter( 'bp_get_activity_content_body', 'godam_rtmedia_expand_player_placeholders', PHP_INT_MAX ); + add_filter( 'bp_activity_comment_content', 'godam_rtmedia_expand_player_placeholders', PHP_INT_MAX ); + /** * Handle AJAX request for loading a single activity comment's HTML. * Note: Only registered for logged-in users (wp_ajax_) for security.