From a6e6bc45f8d3858c9cbd5e38e137c413affb70f5 Mon Sep 17 00:00:00 2001 From: Intenzi Date: Tue, 29 Sep 2026 18:31:19 +0530 Subject: [PATCH 1/3] fix: validate album permissions before updating media album in save_single_edit --- app/main/controllers/template/RTMediaTemplate.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/app/main/controllers/template/RTMediaTemplate.php b/app/main/controllers/template/RTMediaTemplate.php index 2f1131a13..8946245ca 100755 --- a/app/main/controllers/template/RTMediaTemplate.php +++ b/app/main/controllers/template/RTMediaTemplate.php @@ -364,7 +364,7 @@ public function save_single_edit() { $data_array = array( 'media_title', 'description', 'privacy' ); $_album_id = filter_input( INPUT_POST, 'album_id', FILTER_SANITIZE_NUMBER_INT ); // for medias except album and playlist, if album_is is found, then update album_id for the media also. - if ( ! empty( $_album_id ) ) { + if ( ! empty( $_album_id ) && rtmedia_current_user_can_add_to_album( $_album_id ) ) { $data_array[] = 'album_id'; // check it has an media id. @@ -373,6 +373,8 @@ public function save_single_edit() { // update the comment media album. $comment->update_comment_media_album( $rtmedia_query->media[0]->media_id ); } + } else { + unset( $_POST['album_id'] ); } $data = rtmedia_sanitize_object( $_POST, $data_array ); // Properly Sanitized. From db2a01c748926227a6396ecce8967448999f7d98 Mon Sep 17 00:00:00 2001 From: Intenzi Date: Tue, 29 Sep 2026 19:42:05 +0530 Subject: [PATCH 2/3] fix: enforce allowlist via exceptions param in rtmedia_sanitize_object to prevent mass assignment --- app/main/controllers/template/rtmedia-functions.php | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/app/main/controllers/template/rtmedia-functions.php b/app/main/controllers/template/rtmedia-functions.php index 68f582578..4969fd934 100644 --- a/app/main/controllers/template/rtmedia-functions.php +++ b/app/main/controllers/template/rtmedia-functions.php @@ -971,12 +971,16 @@ function rtmedia_duration( $id = false ) { * Sanitizing object * * @param array $data Array of data. - * @param array $exceptions Exception array. + * @param array $exceptions Allowlist of allowed keys to be sanitized. * * @return array */ function rtmedia_sanitize_object( $data, $exceptions = array() ) { - $allowed_keys = array_merge( RTMediaMedia::$default_object, $exceptions ); + if ( empty( $exceptions ) || ! is_array( $exceptions ) ) { + return array(); + } + + $allowed_keys = $exceptions; $sanitized = array(); foreach ( $data as $key => $value ) { if ( in_array( $key, $allowed_keys, true ) ) { From be9386a02e571eb9052484f22b1109f8d93de6c8 Mon Sep 17 00:00:00 2001 From: Intenzi Date: Tue, 29 Sep 2026 20:03:12 +0530 Subject: [PATCH 3/3] fix: sanitize and validate privacy level against allowed values --- app/main/controllers/template/rtmedia-functions.php | 4 +++- app/main/controllers/upload/RTMediaUploadEndpoint.php | 1 + 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/app/main/controllers/template/rtmedia-functions.php b/app/main/controllers/template/rtmedia-functions.php index 4969fd934..9261f87c1 100644 --- a/app/main/controllers/template/rtmedia-functions.php +++ b/app/main/controllers/template/rtmedia-functions.php @@ -984,7 +984,9 @@ function rtmedia_sanitize_object( $data, $exceptions = array() ) { $sanitized = array(); foreach ( $data as $key => $value ) { if ( in_array( $key, $allowed_keys, true ) ) { - if ( is_array( $value ) ) { + if ( 'privacy' === $key ) { + $sanitized[ $key ] = rtmedia_sanitize_privacy_level( $value ); + } elseif ( is_array( $value ) ) { $sanitized[ $key ] = rtmedia_sanitize_object( $value ); } elseif ( is_numeric( $value ) ) { $sanitized[ $key ] = absint( $value ); diff --git a/app/main/controllers/upload/RTMediaUploadEndpoint.php b/app/main/controllers/upload/RTMediaUploadEndpoint.php index 895ab1d17..fa2d1b6fb 100755 --- a/app/main/controllers/upload/RTMediaUploadEndpoint.php +++ b/app/main/controllers/upload/RTMediaUploadEndpoint.php @@ -267,6 +267,7 @@ public function template_redirect( $create_activity = true ) { if ( empty( $privacy ) ) { $privacy = 0; } + $privacy = rtmedia_sanitize_privacy_level( $privacy ); $obj_activity = new RTMediaActivity( $update_activity_media, $privacy, false ); if ( ! empty( $same_medias[0] ) && ! empty( $activity_id ) ) {