Skip to content

Fix - Enforce Album permissions, allowlist, sanitization on media edit #2373

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Intenzi merged 3 commits into from
Sep 30, 2026
+13 −4
Merged

Fix - Enforce Album permissions, allowlist, sanitization on media edit #2373

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a6e6bc4
fix: validate album permissions before updating media album in save_s…
Intenzi Sep 29, 2026
db2a01c
fix: enforce allowlist via exceptions param in rtmedia_sanitize_objec…
Intenzi Sep 29, 2026
be9386a
fix: sanitize and validate privacy level against allowed values
Intenzi Sep 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion app/main/controllers/template/RTMediaTemplate.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -364,7 +364,7 @@ public function save_single_edit() {
$data_array = array( 'media_title', 'description', 'privacy' );
$_album_id = filter_input( INPUT_POST, 'album_id', FILTER_SANITIZE_NUMBER_INT );
// for medias except album and playlist, if album_is is found, then update album_id for the media also.
if ( ! empty( $_album_id ) ) {
if ( ! empty( $_album_id ) && rtmedia_current_user_can_add_to_album( $_album_id ) ) {
$data_array[] = 'album_id';

// check it has an media id.
Expand All @@ -373,6 +373,8 @@ public function save_single_edit() {
// update the comment media album.
$comment->update_comment_media_album( $rtmedia_query->media[0]->media_id );
}
} else {
unset( $_POST['album_id'] );
}

$data = rtmedia_sanitize_object( $_POST, $data_array ); // Properly Sanitized.
Expand Down
12 changes: 9 additions & 3 deletions app/main/controllers/template/rtmedia-functions.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -971,16 +971,22 @@ function rtmedia_duration( $id = false ) {
* Sanitizing object
*
* @param array $data Array of data.
* @param array $exceptions Exception array.
* @param array $exceptions Allowlist of allowed keys to be sanitized.
*
* @return array
*/
function rtmedia_sanitize_object( $data, $exceptions = array() ) {
$allowed_keys = array_merge( RTMediaMedia::$default_object, $exceptions );
if ( empty( $exceptions ) || ! is_array( $exceptions ) ) {
return array();
}

$allowed_keys = $exceptions;
$sanitized = array();
foreach ( $data as $key => $value ) {
if ( in_array( $key, $allowed_keys, true ) ) {
if ( is_array( $value ) ) {
if ( 'privacy' === $key ) {
$sanitized[ $key ] = rtmedia_sanitize_privacy_level( $value );
} elseif ( is_array( $value ) ) {
$sanitized[ $key ] = rtmedia_sanitize_object( $value );
} elseif ( is_numeric( $value ) ) {
$sanitized[ $key ] = absint( $value );
Expand Down
1 change: 1 addition & 0 deletions app/main/controllers/upload/RTMediaUploadEndpoint.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -267,6 +267,7 @@ public function template_redirect( $create_activity = true ) {
if ( empty( $privacy ) ) {
$privacy = 0;
}
$privacy = rtmedia_sanitize_privacy_level( $privacy );
$obj_activity = new RTMediaActivity( $update_activity_media, $privacy, false );

if ( ! empty( $same_medias[0] ) && ! empty( $activity_id ) ) {
Expand Down
Loading