Skip to content
Merged
Show file tree
Hide file tree
Changes from 3 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 9 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ Add albums, photo, audio/video upload, privacy, sharing, front-end uploads & mor
![BrowserStack Status](https://www.browserstack.com/automate/badge.svg?badge_key=MU1JamdmRnppK0hhQy9QMU8wdDJ2MUEyb1ZuS0ljVFQvSHZ6anFvNzUxTT0tLXhUNnliTnZGcE5CcW93N0I1eXdnM3c9PQ==--8c124e667dd0c317618efde1bed2b260000916b6)


* **Contributors:** [rtcamp](http://profiles.wordpress.org/rtcamp), [mangeshp](http://profiles.wordpress.org/mangeshp), [sanket.parmar](http://profiles.wordpress.org/sanket.parmar), [pranalipatel](http://profiles.wordpress.org/pranalipatel), [jignesh.nakrani](http://profiles.wordpress.org/jignesh.nakrani), [manishsongirkar36](http://profiles.wordpress.org/manishsongirkar36), [kiranpotphode](http://profiles.wordpress.org/kiranpotphode), [yahil](http://profiles.wordpress.org/yahil), [1naveengiri](http://profiles.wordpress.org/1naveengiri), [bhargavbhandari90](http://profiles.wordpress.org/bhargavbhandari90), [deepak1191](http://profiles.wordpress.org/deepak1191), [rittesh.patel](http://profiles.wordpress.org/rittesh.patel), [sagarjadhav](http://profiles.wordpress.org/sagarjadhav), [pushpak.pop](http://profiles.wordpress.org/pushpak.pop), [faishal](http://profiles.wordpress.org/faishal), [desaiuditd](http://profiles.wordpress.org/desaiuditd), [rahul286](http://profiles.wordpress.org/rahul286), [JoshuaAbenazer](http://profiles.wordpress.org/JoshuaAbenazer), [gagan0123](http://profiles.wordpress.org/gagan0123), [saurabhshukla](http://profiles.wordpress.org/saurabhshukla), [nitun.lanjewar](http://profiles.wordpress.org/nitun.lanjewar), [umesh.nevase](http://profiles.wordpress.org/umesh.nevase), [suhasgirgaonkar](http://profiles.wordpress.org/suhasgirgaonkar), [neerukoul](http://profiles.wordpress.org/neerukoul), [hrishiv90](http://profiles.wordpress.org/hrishiv90), [kanakiyajay](http://profiles.wordpress.org/kanakiyajay), [jarretc](http://profiles.wordpress.org/jarretc), [tobiaskluge](http://profiles.wordpress.org/tobiaskluge), [rafaelfunchal](http://profiles.wordpress.org/rafaelfunchal), [UmeshSingla](http://profiles.wordpress.org/UmeshSingla), [mehulkaklotar](http://profiles.wordpress.org/mehulkaklotar), [tannermirabel](http://profiles.wordpress.org/tannermirabel), [kishores](http://profiles.wordpress.org/kishores), [chandrapatel](http://profiles.wordpress.org/chandrapatel), [rahul3883](http://profiles.wordpress.org/rahul3883/), [nomnom99](http://profiles.wordpress.org/nomnom99), [sayanchakraborty](https://profiles.wordpress.org/sayanchakraborty), [milindmore22](https://profiles.wordpress.org/milindmore22), [thrijith](https://profiles.wordpress.org/thrijith), [abhijitrakas](https://profiles.wordpress.org/abhijitrakas), [sid177](https://profiles.wordpress.org/sid177), [montu3366](https://profiles.wordpress.org/montu3366), [jashwini](https://profiles.wordpress.org/jashwini), [juhise](https://profiles.wordpress.org/juhise), [ravatparmar](https://profiles.wordpress.org/ravatparmar), [dharmin16](https://profiles.wordpress.org/dharmin16), [malavvasita](https://profiles.wordpress.org/malavvasita), [pooja1210](https://profiles.wordpress.org/pooja1210), [krupajnanda](https://profiles.wordpress.org/krupajnanda), [kanumalivad](https://profiles.wordpress.org/kanumalivad), [surajkumarsingh](https://profiles.wordpress.org/surajkumarsingh), [dishitpala](https://profiles.wordpress.org/dishitpala), [shobhit2412](https://profiles.wordpress.org/shobhit2412/), [vkd007](https://profiles.wordpress.org/vkd007/), [vaishu.agola27](https://profiles.wordpress.org/vaishuagola27/), [kapilpaul](https://profiles.wordpress.org/kapilpaul/), [opurockey](https://profiles.wordpress.org/opurockey/), [pavanpatil1](https://profiles.wordpress.org/pavanpatil1/), [pradeep1308](https://profiles.wordpress.org/pradeep1308/), [shardul200](https://profiles.wordpress.org/shardul200/), [ibnulk](https://profiles.wordpress.org/ibnulk/), [sabbir1991](https://profiles.wordpress.org/sabbir1991/), [kamalahmed](https://profiles.wordpress.org/kamalahmed/), [harshbarach](https://profiles.wordpress.org/harshbarach/), [mukulsingh27](https://profiles.wordpress.org/mukulsingh27/), [vishalkakadiya](https://profiles.wordpress.org/vishalkakadiya/), [elifvish](https://profiles.wordpress.org/elifvish/), [krupajnanda](https://profiles.wordpress.org/krupajnanda/), [utsavladani](https://profiles.wordpress.org/utsavladani/),[krishana79](https://profiles.wordpress.org/krishana79/), [rohitmathur7](https://profiles.wordpress.org/rohitmathur7/), [kuldipchaudhary](https://profiles.wordpress.org/kuldipchaudhary/), [mchirag2002](https://profiles.wordpress.org/mchirag2002/), [vedantgandhi28](https://profiles.wordpress.org/vedantgandhi28/), [mohamedahamed](https://profiles.wordpress.org/mohamedahamed/)
* **Contributors:** [rtcamp](http://profiles.wordpress.org/rtcamp), [mangeshp](http://profiles.wordpress.org/mangeshp), [sanket.parmar](http://profiles.wordpress.org/sanket.parmar), [pranalipatel](http://profiles.wordpress.org/pranalipatel), [jignesh.nakrani](http://profiles.wordpress.org/jignesh.nakrani), [manishsongirkar36](http://profiles.wordpress.org/manishsongirkar36), [kiranpotphode](http://profiles.wordpress.org/kiranpotphode), [yahil](http://profiles.wordpress.org/yahil), [1naveengiri](http://profiles.wordpress.org/1naveengiri), [bhargavbhandari90](http://profiles.wordpress.org/bhargavbhandari90), [deepak1191](http://profiles.wordpress.org/deepak1191), [rittesh.patel](http://profiles.wordpress.org/rittesh.patel), [sagarjadhav](http://profiles.wordpress.org/sagarjadhav), [pushpak.pop](http://profiles.wordpress.org/pushpak.pop), [faishal](http://profiles.wordpress.org/faishal), [desaiuditd](http://profiles.wordpress.org/desaiuditd), [rahul286](http://profiles.wordpress.org/rahul286), [JoshuaAbenazer](http://profiles.wordpress.org/JoshuaAbenazer), [gagan0123](http://profiles.wordpress.org/gagan0123), [saurabhshukla](http://profiles.wordpress.org/saurabhshukla), [nitun.lanjewar](http://profiles.wordpress.org/nitun.lanjewar), [umesh.nevase](http://profiles.wordpress.org/umesh.nevase), [suhasgirgaonkar](http://profiles.wordpress.org/suhasgirgaonkar), [neerukoul](http://profiles.wordpress.org/neerukoul), [hrishiv90](http://profiles.wordpress.org/hrishiv90), [kanakiyajay](http://profiles.wordpress.org/kanakiyajay), [jarretc](http://profiles.wordpress.org/jarretc), [tobiaskluge](http://profiles.wordpress.org/tobiaskluge), [rafaelfunchal](http://profiles.wordpress.org/rafaelfunchal), [UmeshSingla](http://profiles.wordpress.org/UmeshSingla), [mehulkaklotar](http://profiles.wordpress.org/mehulkaklotar), [tannermirabel](http://profiles.wordpress.org/tannermirabel), [kishores](http://profiles.wordpress.org/kishores), [chandrapatel](http://profiles.wordpress.org/chandrapatel), [rahul3883](http://profiles.wordpress.org/rahul3883/), [nomnom99](http://profiles.wordpress.org/nomnom99), [sayanchakraborty](https://profiles.wordpress.org/sayanchakraborty), [milindmore22](https://profiles.wordpress.org/milindmore22), [thrijith](https://profiles.wordpress.org/thrijith), [abhijitrakas](https://profiles.wordpress.org/abhijitrakas), [sid177](https://profiles.wordpress.org/sid177), [montu3366](https://profiles.wordpress.org/montu3366), [jashwini](https://profiles.wordpress.org/jashwini), [juhise](https://profiles.wordpress.org/juhise), [ravatparmar](https://profiles.wordpress.org/ravatparmar), [dharmin16](https://profiles.wordpress.org/dharmin16), [malavvasita](https://profiles.wordpress.org/malavvasita), [pooja1210](https://profiles.wordpress.org/pooja1210), [krupajnanda](https://profiles.wordpress.org/krupajnanda), [kanumalivad](https://profiles.wordpress.org/kanumalivad), [surajkumarsingh](https://profiles.wordpress.org/surajkumarsingh), [dishitpala](https://profiles.wordpress.org/dishitpala), [shobhit2412](https://profiles.wordpress.org/shobhit2412/), [vkd007](https://profiles.wordpress.org/vkd007/), [vaishu.agola27](https://profiles.wordpress.org/vaishuagola27/), [kapilpaul](https://profiles.wordpress.org/kapilpaul/), [opurockey](https://profiles.wordpress.org/opurockey/), [pavanpatil1](https://profiles.wordpress.org/pavanpatil1/), [pradeep1308](https://profiles.wordpress.org/pradeep1308/), [shardul200](https://profiles.wordpress.org/shardul200/), [ibnulk](https://profiles.wordpress.org/ibnulk/), [sabbir1991](https://profiles.wordpress.org/sabbir1991/), [kamalahmed](https://profiles.wordpress.org/kamalahmed/), [harshbarach](https://profiles.wordpress.org/harshbarach/), [mukulsingh27](https://profiles.wordpress.org/mukulsingh27/), [vishalkakadiya](https://profiles.wordpress.org/vishalkakadiya/), [elifvish](https://profiles.wordpress.org/elifvish/), [krupajnanda](https://profiles.wordpress.org/krupajnanda/), [utsavladani](https://profiles.wordpress.org/utsavladani/),[krishana79](https://profiles.wordpress.org/krishana79/), [rohitmathur7](https://profiles.wordpress.org/rohitmathur7/), [kuldipchaudhary](https://profiles.wordpress.org/kuldipchaudhary/), [mchirag2002](https://profiles.wordpress.org/mchirag2002/), [vedantgandhi28](https://profiles.wordpress.org/vedantgandhi28/), [mohamedahamed](https://profiles.wordpress.org/mohamedahamed/),[thehercules](https://profiles.wordpress.org/thehercules/), [suryakantupadhyay](https://profiles.wordpress.org/suryakantupadhyay/)

* **License:** [GPL v2 or later]( http://www.gnu.org/licenses/gpl-2.0.html)

Expand Down Expand Up @@ -147,6 +147,13 @@ https://www.youtube.com/watch?v=dJrykKQGDcs

## Changelog ##

### 4.7.13

* FIXED
* Fixed insecure API token generation, validation and expiration.
* Fixed insufficient brute-force protection for API authentication and token validation.
* Fixed username enumeration through API login error responses.

### 4.7.12
* FIXED
* Fixed authorization checks for media, albums, comments and activity privacy so actions are limited to permitted users.
Expand Down Expand Up @@ -1049,4 +1056,4 @@ rtMedia uses the following projects/sources for some functionality
* [Magnific Popup](http://dimsemenov.com/plugins/magnific-popup/) for responsive lightbox
* [getID3](http://getid3.sourceforge.net/) gets us some ID tags for the media
* [Foundation](http://foundation.zurb.com/) for the media grid and layout
* [Backbone.js](http://backbonejs.org/) for an MVC architecture for the frontend
* [Backbone.js](http://backbonejs.org/) for an MVC architecture for the frontend
8 changes: 8 additions & 0 deletions changelog.txt
Original file line number Diff line number Diff line change
@@ -1,5 +1,13 @@
== Changelog ==

= 4.7.13 [August 27, 2026] =

* FIXED
* Fixed insecure API token generation, validation and expiration.
* Fixed insufficient brute-force protection for API authentication and token validation.
* Fixed username enumeration through API login error responses.


= 4.7.12 [August 18, 2026] =

* FIXED
Expand Down
4 changes: 2 additions & 2 deletions index.php
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
* Plugin Name: rtMedia for WordPress, BuddyPress and bbPress
* Plugin URI: https://rtmedia.io/?utm_source=dashboard&utm_medium=plugin&utm_campaign=buddypress-media
* Description: This plugin adds missing media rich features like photos, videos and audio uploading to BuddyPress which are essential if you are building social network, seriously!
* Version: 4.7.12
* Version: 4.7.13
* Requires at least: 4.9.6
* Text Domain: buddypress-media
* Author: rtCamp
Expand All @@ -26,7 +26,7 @@
/**
* The version of the plugin
*/
define( 'RTMEDIA_VERSION', '4.7.12' );
define( 'RTMEDIA_VERSION', '4.7.13' );
}

if ( ! defined( 'RTMEDIA_PATH' ) ) {
Expand Down
116 changes: 58 additions & 58 deletions languages/buddpress-media.pot
Original file line number Diff line number Diff line change
Expand Up @@ -2,14 +2,14 @@
# This file is distributed under the GPLv2 or later.
msgid ""
msgstr ""
"Project-Id-Version: rtMedia for WordPress, BuddyPress and bbPress 4.7.12\n"
"Project-Id-Version: rtMedia for WordPress, BuddyPress and bbPress 4.7.13\n"
"Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/buddypress-media\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: LANGUAGE <LL@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"POT-Creation-Date: 2026-08-17T13:32:53+00:00\n"
"POT-Creation-Date: 2026-08-27T11:14:49+00:00\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"X-Generator: WP-CLI 2.12.0\n"
"X-Domain: buddypress-media\n"
Expand Down Expand Up @@ -2261,217 +2261,217 @@ msgstr ""
msgid "%1$s commented on %2$s's %3$s"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:307
#: app/main/controllers/api/RTMediaJsonApi.php:321
msgid "username/password empty"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:310
msgid "incorrect username"
#: app/main/controllers/api/RTMediaJsonApi.php:324
msgid "invalid username or password"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:313
msgid "incorrect password"
#: app/main/controllers/api/RTMediaJsonApi.php:327
msgid "too many login attempts; please try again later"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:316
#: app/main/controllers/api/RTMediaJsonApi.php:330
msgid "login success"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:365
#: app/main/controllers/api/RTMediaJsonApi.php:384
msgid "fields empty"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:368
#: app/main/controllers/api/RTMediaJsonApi.php:387
msgid "invalid email"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:371
#: app/main/controllers/api/RTMediaJsonApi.php:390
msgid "password do not match"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:374
#: app/main/controllers/api/RTMediaJsonApi.php:393
msgid "username already registered"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:377
#: app/main/controllers/api/RTMediaJsonApi.php:396
msgid "email already exists"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:380
#: app/main/controllers/api/RTMediaJsonApi.php:399
msgid "new user created"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:383
#: app/main/controllers/api/RTMediaJsonApi.php:402
msgid "user registration is not allowed"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:457
#: app/main/controllers/api/RTMediaJsonApi.php:476
msgid "email empty"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:460
#: app/main/controllers/api/RTMediaJsonApi.php:479
msgid "username/email not registered"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:463
#: app/main/controllers/api/RTMediaJsonApi.php:482
msgid "reset link sent"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:497
#: app/main/controllers/api/RTMediaJsonApi.php:516
msgid "Someone has asked to reset the password for the following site and username."
msgstr ""

#. translators: 1: Username.
#: app/main/controllers/api/RTMediaJsonApi.php:501
#: app/main/controllers/api/RTMediaJsonApi.php:520
#, php-format
msgid "Username: %s"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:502
#: app/main/controllers/api/RTMediaJsonApi.php:521
msgid "To reset your password visit the following address, otherwise just ignore this email and nothing will happen."
msgstr ""

#. translators: 1: Blog name.
#: app/main/controllers/api/RTMediaJsonApi.php:507
#: app/main/controllers/api/RTMediaJsonApi.php:526
#, php-format
msgid "[%s] Password Reset"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:523
#: app/main/controllers/api/RTMediaJsonApi.php:542
msgid "bp activities"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:526
#: app/main/controllers/api/RTMediaJsonApi.php:545
msgid "user activities"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:535
#: app/main/controllers/api/RTMediaJsonApi.php:554
msgid "no updates"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:558
#: app/main/controllers/api/RTMediaJsonApi.php:577
msgid "comment content missing"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:561
#: app/main/controllers/api/RTMediaJsonApi.php:580
msgid "comment posted"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:609
#: app/main/controllers/api/RTMediaJsonApi.php:628
msgid "unliked media"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:612
#: app/main/controllers/api/RTMediaJsonApi.php:631
msgid "liked media"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:704
#: app/main/controllers/api/RTMediaJsonApi.php:723
msgid "no comments"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:707
#: app/main/controllers/api/RTMediaJsonApi.php:726
msgid "media comments"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:771
#: app/main/controllers/api/RTMediaJsonApi.php:790
msgid "no likes"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:774
#: app/main/controllers/api/RTMediaJsonApi.php:793
msgid "media likes"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:835
#: app/main/controllers/api/RTMediaJsonApi.php:854
msgid "invalid comment/media id"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:838
#: app/main/controllers/api/RTMediaJsonApi.php:857
msgid "no comment id"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:841
#: app/main/controllers/api/RTMediaJsonApi.php:860
msgid "comment deleted"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:945
#: app/main/controllers/api/RTMediaJsonApi.php:964
msgid "no profile found"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:948
#: app/main/controllers/api/RTMediaJsonApi.php:967
msgid "profile fields"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:1050
#: app/main/controllers/api/RTMediaJsonApi.php:1069
msgid "follow user id missing"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:1053
#: app/main/controllers/api/RTMediaJsonApi.php:1072
msgid "started following"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:1056
#: app/main/controllers/api/RTMediaJsonApi.php:1075
msgid "already following"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:1089
#: app/main/controllers/api/RTMediaJsonApi.php:1108
msgid "unfollow id missing"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:1092
#: app/main/controllers/api/RTMediaJsonApi.php:1111
msgid "stopped following"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:1095
#: app/main/controllers/api/RTMediaJsonApi.php:1114
msgid "not following"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:1128
#: app/main/controllers/api/RTMediaJsonApi.php:1147
msgid "name/location empty"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:1131
#: app/main/controllers/api/RTMediaJsonApi.php:1150
msgid "profile updated"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:1160
#: app/main/controllers/api/RTMediaJsonApi.php:1188
#: app/main/controllers/api/RTMediaJsonApi.php:1179
#: app/main/controllers/api/RTMediaJsonApi.php:1207
msgid "no file"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:1163
#: app/main/controllers/api/RTMediaJsonApi.php:1200
#: app/main/controllers/api/RTMediaJsonApi.php:1182
#: app/main/controllers/api/RTMediaJsonApi.php:1219
msgid "upload failed, check size and file type"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:1166
#: app/main/controllers/api/RTMediaJsonApi.php:1185
msgid "avatar updated"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:1191
#: app/main/controllers/api/RTMediaJsonApi.php:1210
msgid "invalid file type. jpeg and png are allowed."
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:1194
#: app/main/controllers/api/RTMediaJsonApi.php:1213
msgid "image type missing"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:1197
#: app/main/controllers/api/RTMediaJsonApi.php:1216
msgid "no title"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:1203
#: app/main/controllers/api/RTMediaJsonApi.php:1222
msgid "media updated"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:1417
#: app/main/controllers/api/RTMediaJsonApi.php:1436
msgid "media list"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:1420
#: app/main/controllers/api/RTMediaJsonApi.php:1439
msgid "no media found for requested media type"
msgstr ""

#: app/main/controllers/api/RTMediaJsonApi.php:1538
#: app/main/controllers/api/RTMediaJsonApi.php:1557
msgid "single media"
msgstr ""

Expand Down
Loading