Skip to content

Fix: Missing Authorization to Unauthenticated Information Disclosure via handle_rest_pre_dispatch Function - #2179

Merged
KMchaudhary merged 2 commits into
developfrom
fix/handle_rest_pre_dispatch
Oct 3, 2025
Merged

KMchaudhary merged 2 commits into
developfrom
fix/handle_rest_pre_dispatch

Conversation

@KMchaudhary

@KMchaudhary KMchaudhary commented Oct 3, 2025 •

Copy link
Copy Markdown
Contributor

Fix issue: rtMedia for WordPress, BuddyPress and bbPress 4.7.0 – 4.7.1 — Missing Authorization to Unauthenticated Information Disclosure via handle_rest_pre_dispatch Function
Ref doc: https://docs.google.com/document/d/1Z2nAE-nn4SvmutUEckc6pA6SSN-rM_aF/edit

This pull request removes custom REST API integration logic from the RTMediaJsonApi controller. The main change is the deletion of the conditional registration and handling of the rest_pre_dispatch filter, which was used to intercept media GET requests and prepare custom responses.

Explaination

On the rtMedia plugin, we are applying the handle_rest_pre_dispatch() function on rest_pre_dispatch hook when the GoDAM plugin is active, to get the attachment information in all cases.

I recall that initially, we were receiving a below response on the video editor for some media attachments (Note: users were receiving this message because they did not have sufficient permission to edit specific media). To resolve the issue, the rtMedia team may have added this function on the rest_pre_dispatch hook, which is no longer needed.

{"code":"rest_forbidden","message":"Sorry, you are not allowed to do that.","data":{"status":401}}

Related issue: https://github.com/rtCamp/rtmedia-io/issues/1684#event-20074973749

@KMchaudhary
KMchaudhary merged commit fc8effa into develop Oct 3, 2025
5 checks passed
@joelabreo227 joelabreo227 mentioned this pull request Oct 24, 2025
5 tasks done
@NoumaanAhamed
NoumaanAhamed deleted the fix/handle_rest_pre_dispatch branch January 8, 2026 07:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants