Skip to content

Commit 8639be4

Browse files
pavanpatil1pavanpatil1
authored
Merge pull request #2018 from rtCamp/develop
Release version 4.6.16
2 parents bf24d06 + 559b6b6 commit 8639be4

20 files changed

+274
-191
lines changed

‎Gruntfile.js

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ module.exports = function ( grunt ) {
3232
dist: {
3333
options: {
3434
style: 'expanded',
35-
sourcemap: 'none'
35+
sourceMap: false
3636
},
3737
files: {
3838
'app/assets/admin/css/admin.css': 'app/assets/admin/css/sass/admin.scss',
@@ -43,7 +43,7 @@ module.exports = function ( grunt ) {
4343
minify: {
4444
options: {
4545
style: 'compressed',
46-
sourcemap: 'none'
46+
sourceMap: false
4747
},
4848
files: {
4949
'app/assets/admin/css/admin.min.css': 'app/assets/admin/css/sass/admin.scss',

‎README.md

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,19 @@ https://www.youtube.com/watch?v=dJrykKQGDcs
152152

153153
## Changelog ##
154154

155+
### 4.6.16 [November 16, 2023] ###
156+
157+
* Enhancement
158+
159+
* Compatible with WordPress latest version 6.4
160+
161+
* Fixed
162+
163+
* Fixed PHP deprecation warnings.
164+
* Fixed BuddyPress Versioning issue
165+
* Fixed Security issue.
166+
* Fixed Video player UI issues.
167+
155168
### 4.6.15 [September 4, 2023] ###
156169

157170
* Fixed

‎SECURITY.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# Security Policy
2+
3+
## Reporting a Vulnerability
4+
5+
Please report security bugs found in this plugin's source code through the
6+
[Patchstack Vulnerability Disclosure
7+
Program](https://patchstack.com/database/vdp/buddypress-media). The Patchstack team will
8+
assist you with verification, and CVE assignment, and notify the
9+
developers of this plugin.

‎app/admin/RTMediaAdmin.php

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1434,10 +1434,8 @@ public function import_settings( $file_path ) {
14341434
wp_send_json( $response );
14351435
}
14361436

1437-
ob_start();
1438-
include $file_path;
1439-
1440-
$settings_data_json = ob_get_clean();
1437+
$settings_data_json_string = file_get_contents( $file_path );
1438+
$settings_data_json = json_decode( $settings_data_json_string, true );
14411439
wp_delete_file( $file_path );
14421440

14431441
if ( empty( $settings_data_json ) ) {

‎app/assets/css/rtmedia.css

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3109,6 +3109,10 @@ a.rtmedia-upload-media-link {
31093109
padding: 4px 8px;
31103110
border: none;
31113111
background: rgba(0, 0, 0, 0) url("../../../lib/media-element/mejs-controls.png") no-repeat;
3112+
width: 20px;
3113+
}
3114+
#buddypress .mejs-controls button:hover, #buddypress .mejs-controls button:focus, #buddypress .mejs-controls button:active {
3115+
background: rgba(0, 0, 0, 0.2) url("../../../lib/media-element/mejs-controls.png") no-repeat;
31123116
}
31133117
#buddypress .mejs-controls .mejs-play > button {
31143118
background-position: 0 0;

‎app/assets/css/rtmedia.css.map

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎app/assets/css/rtmedia.min.css

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎app/assets/css/rtmedia.min.css.map

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎app/assets/css/sass/_media-element.scss

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,11 @@
1111
padding: 4px 8px;
1212
border: none;
1313
background: rgba(0, 0, 0, 0) url('../../../lib/media-element/mejs-controls.png') no-repeat;
14+
width: 20px;
15+
16+
&:hover, &:focus, &:active {
17+
background: rgba(0, 0, 0, 0.2) url('../../../lib/media-element/mejs-controls.png') no-repeat;
18+
}
1419
}
1520

1621
.mejs-play > button {

‎app/assets/js/rtMedia.activity.js

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
( function() {
2+
if( bp && bp.Nouveau && bp.Nouveau.inject ) {
3+
callback = bp.Nouveau.inject;
4+
5+
// Overwrite the inject function and apply mediaelement library player after adding activity.
6+
bp.Nouveau.inject = function( selector, content, method ) {
7+
callback( selector, content, method );
8+
9+
if ( 'function' === typeof rtmedia_on_activity_add ) {
10+
rtmedia_on_activity_add();
11+
}
12+
};
13+
}
14+
})();

‎app/assets/js/rtMedia.backbone.js

Lines changed: 5 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1751,20 +1751,8 @@ jQuery( document ).ready( function( $ ) {
17511751
objUploadView.uploader.refresh();
17521752
$( '#rtmedia-whts-new-upload-container > div' ).css( { 'top': '0', 'left': '0' } );
17531753
$( '#whats-new-form #rtMedia-update-queue-list' ).html( '' );
1754-
//$("#div-attache-rtmedia").hide();
1754+
17551755
apply_rtMagnificPopup( jQuery( '.rtmedia-list-media, .rtmedia-activity-container ul.rtmedia-list, #bp-media-list,.widget-item-listing,.bp-media-sc-list, li.media.album_updated ul,ul.bp-media-list-media, li.activity-item div.activity-content div.activity-inner div.bp_media_content' ) );
1756-
jQuery( 'ul.activity-list li.rtmedia_update:first-child .wp-audio-shortcode, ul.activity-list li.rtmedia_update:first-child .wp-video-shortcode' ).mediaelementplayer( {
1757-
// This is required to work with new MediaElement version.
1758-
classPrefix: 'mejs-',
1759-
// If the <video width> is not specified, this is the default
1760-
defaultVideoWidth: 480,
1761-
// If the <video height> is not specified, this is the default
1762-
defaultVideoHeight: 270
1763-
// If set, overrides <video width>
1764-
//videoWidth: 1,
1765-
// if set, overrides <video height>
1766-
//videoHeight: 1
1767-
} );
17681756

17691757
// For BuddyPress New Template hacks
17701758
jQuery( '.plupload_filelist_content.rtm-plupload-list' ).html('');
@@ -1776,7 +1764,7 @@ jQuery( document ).ready( function( $ ) {
17761764
rtmedia_add_media_button_post_update.removeAttr( 'disabled' );
17771765
}
17781766

1779-
rtmedia_on_activity_add();
1767+
// rtmedia_on_activity_add();
17801768

17811769
$( '#whats-new-post-in' ).removeAttr( 'disabled' );
17821770
if ( ! rtmedia_add_media_button_post_update ) {
@@ -2272,14 +2260,11 @@ function rtmedia_reset_video_and_audio(){
22722260

22732261

22742262
function rtmedia_on_activity_add(){
2275-
setTimeout( function() {
2276-
rtmedia_activity_stream_comment_media();
2277-
2278-
rtmedia_reset_video_and_audio();
2263+
rtmedia_activity_stream_comment_media();
22792264

2280-
rtmedia_apply_popup_to_media();
2265+
rtmedia_reset_video_and_audio();
22812266

2282-
}, 1500 );
2267+
rtmedia_apply_popup_to_media();
22832268
}
22842269

22852270

‎app/main/RTMedia.php

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -449,9 +449,7 @@ public function custom_style_for_activity_image_size() {
449449
height: 100% !important;
450450
}
451451

452-
.rtmedia-activity-container li.media-type-video div.rtmedia-item-thumbnail .mejs-video,
453-
.rtmedia-activity-container li.media-type-video div.rtmedia-item-thumbnail .mejs-video video,
454-
.rtmedia-activity-container li.media-type-video div.rtmedia-item-thumbnail .mejs-video .mejs-overlay-play{
452+
.rtmedia-activity-container li.media-type-video div.rtmedia-item-thumbnail .mejs-video video {
455453
width: 100% !important;
456454
height: 100% !important;
457455
}
@@ -1671,6 +1669,17 @@ public function enqueue_scripts_styles() {
16711669

16721670
wp_localize_script( 'rtmedia-backbone', 'rtMedia_update_plupload_config', $params );
16731671
}
1672+
1673+
wp_enqueue_script(
1674+
'rtmedia-activity',
1675+
RTMEDIA_URL . 'app/assets/js/rtMedia.activity.js',
1676+
array(
1677+
'bp-nouveau',
1678+
'rtmedia-backbone'
1679+
),
1680+
RTMEDIA_VERSION,
1681+
true
1682+
);
16741683
}
16751684

16761685
/**

‎app/main/controllers/api/RTMediaJsonApi.php

Lines changed: 30 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1085,8 +1085,8 @@ public function rtmedia_api_process_rtmedia_upload_media_request() {
10851085
$ec_no_file = 140001;
10861086
$msg_no_file = esc_html__( 'no file', 'buddypress-media' );
10871087

1088-
$ec_invalid_file_string = 140005;
1089-
$msg_invalid_file_string = esc_html__( 'invalid file string', 'buddypress-media' );
1088+
$ec_invalid_file_type = 140007;
1089+
$msg_invalid_file_type = esc_html__( 'invalid file type. jpeg and png are allowed.', 'buddypress-media' );
10901090

10911091
$ec_image_type_missing = 140006;
10921092
$msg_image_type_missing = esc_html__( 'image type missing', 'buddypress-media' );
@@ -1100,11 +1100,23 @@ public function rtmedia_api_process_rtmedia_upload_media_request() {
11001100
$ec_look_updated = 140004;
11011101
$msg_look_updated = esc_html__( 'media updated', 'buddypress-media' );
11021102

1103-
$rtmedia_file = sanitize_text_field( filter_input( INPUT_POST, 'rtmedia_file', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) );
11041103
$image_type = sanitize_text_field( filter_input( INPUT_POST, 'image_type', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) );
1105-
$title = sanitize_text_field( filter_input( INPUT_POST, 'title', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) );
1104+
$mime_type = "";
1105+
1106+
if ( in_array( $image_type, array( 'jpeg', 'jpg' ), true ) ) {
1107+
$mime_type = 'image/jpeg';
1108+
}
1109+
else if ( 'png' === $image_type ) {
1110+
$mime_type = 'image/png';
1111+
} else {
1112+
wp_send_json( $this->rtmedia_api_response_object( 'FALSE', $ec_invalid_file_type, $msg_invalid_file_type ) );
1113+
}
1114+
1115+
$title = sanitize_title( filter_input( INPUT_POST, 'title', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) );
11061116
$description = sanitize_text_field( filter_input( INPUT_POST, 'description', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) );
11071117

1118+
$rtmedia_file = sanitize_text_field( filter_input( INPUT_POST, 'rtmedia_file', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) );
1119+
11081120
$updated = false;
11091121
$uploaded_look = false;
11101122

@@ -1118,6 +1130,8 @@ public function rtmedia_api_process_rtmedia_upload_media_request() {
11181130
}
11191131
if ( empty( $title ) ) {
11201132
wp_send_json( $this->rtmedia_api_response_object( 'FALSE', $ec_no_file_title, $msg_no_file_title ) );
1133+
} else {
1134+
$title .= wp_generate_password( 12, false );
11211135
}
11221136
}
11231137

@@ -1137,23 +1151,30 @@ public function rtmedia_api_process_rtmedia_upload_media_request() {
11371151

11381152
// Process rtmedia_file.
11391153
$img = $rtmedia_file;
1140-
$str_replace = 'data:image/' . $image_type . ';base64,';
1154+
$str_replace = 'data:' . $mime_type . ';base64,';
11411155
$img = str_replace( $str_replace, '', $img );
11421156
$rtmedia_file = base64_decode( $img ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
11431157

1144-
if ( ! $rtmedia_file ) {
1145-
wp_send_json( $this->rtmedia_api_response_object( 'FALSE', $ec_invalid_file_string, $msg_invalid_file_string ) );
1158+
// check if file is valid image.
1159+
$actual_file_info = getimagesizefromstring( $rtmedia_file );
1160+
1161+
if ( ! $actual_file_info || ! isset( $actual_file_info['mime'] ) || ! in_array( $actual_file_info['mime'], array( 'image/jpeg', 'image/png' ), true ) ) {
1162+
wp_send_json( $this->rtmedia_api_response_object( 'FALSE', $ec_invalid_image, $msg_invalid_image ) );
11461163
}
11471164

1148-
define( 'UPLOAD_DIR_LOOK', sys_get_temp_dir() . '/' );
1165+
define( 'UPLOAD_DIR_LOOK', sys_get_temp_dir() );
11491166

11501167
$tmp_name = UPLOAD_DIR_LOOK . $title;
11511168
$file = $tmp_name . '.' . $image_type;
11521169
$success = file_put_contents( $file, $rtmedia_file ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_read_file_put_contents
11531170

1171+
if ( ! $success ) {
1172+
wp_send_json( $this->rtmedia_api_response_object( 'FALSE', $ec_invalid_image, $msg_invalid_image ) );
1173+
}
1174+
11541175
add_filter( 'upload_dir', array( $this, 'api_new_media_upload_dir' ) );
11551176
$new_look = wp_upload_bits( $title . '.' . $image_type, null, $rtmedia_file );
1156-
$new_look['type'] = 'image/' . $image_type;
1177+
$new_look['type'] = $mime_type;
11571178
remove_filter( 'upload_dir', array( $this, 'api_new_media_upload_dir' ) );
11581179

11591180
foreach ( $new_look as $key => $value ) {

‎app/main/controllers/media/RTMediaComment.php

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -199,8 +199,14 @@ public static function pre_comment_render( $attr ) {
199199
$template = 'comment-media';
200200
}
201201

202+
ob_start();
203+
202204
$view = new RTMediaUploadView( $attr );
203-
echo wp_kses( $view->render( $template ), RTMedia::expanded_allowed_tags() );
205+
$view->render( $template );
206+
207+
$buffer = ob_get_clean();
208+
209+
echo wp_kses( $buffer, RTMedia::expanded_allowed_tags() );
204210

205211
}
206212
} else {

‎app/main/controllers/template/RTMediaNav.php

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -131,8 +131,6 @@ public function custom_media_nav_tab() {
131131
$media_tab_position = apply_filters( 'rtmedia_group_media_tab_position', 99 );
132132

133133
// to solve an issue of Media Tab is not showing in version 10.0.0.
134-
$bp->version = floatval( $bp->version );
135-
136134
if ( isset( $bp->version ) && version_compare( $bp->version, '2.5.3', 'gt' ) ) {
137135

138136
/**

‎app/main/controllers/template/rtmedia-filters.php

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -758,7 +758,13 @@ function rtmedia_search_fillter_where_query( $where, $table_name ) {
758758

759759
if ( function_exists( 'rtmedia_media_search_enabled' ) && rtmedia_media_search_enabled() ) {
760760

761-
$search = sanitize_text_field( urldecode( wp_unslash( filter_input( INPUT_GET, 'search', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) ) ) );
761+
$raw_search = wp_unslash( filter_input( INPUT_GET, 'search', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) );
762+
763+
if ( 'string' !== gettype( $raw_search ) ) {
764+
$raw_search = "";
765+
}
766+
767+
$search = sanitize_text_field( urldecode( $raw_search ) );
762768
$search_by = sanitize_text_field( wp_unslash( filter_input( INPUT_GET, 'search_by', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) ) );
763769
$media_type = sanitize_text_field( wp_unslash( filter_input( INPUT_GET, 'media_type', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) ) );
764770
$rtmedia_current_album = sanitize_text_field( wp_unslash( filter_input( INPUT_GET, 'rtmedia-current-album', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) ) );

‎app/main/controllers/template/rtmedia-functions.php

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -950,8 +950,7 @@ function rtmedia_duration( $id = false ) {
950950

951951
if ( ! empty( $rtmedia_backbone['backbone'] ) ) {
952952
echo '<%= duration %>';
953-
954-
return;
953+
return '';
955954
}
956955

957956
if ( $id ) {
@@ -965,7 +964,7 @@ function rtmedia_duration( $id = false ) {
965964
if ( isset( $media[0] ) ) {
966965
$media_object = $media[0];
967966
} else {
968-
return false;
967+
return '';
969968
}
970969
} else {
971970
global $rtmedia_media;

‎index.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
* Plugin Name: rtMedia for WordPress, BuddyPress and bbPress
44
* Plugin URI: https://rtmedia.io/?utm_source=dashboard&utm_medium=plugin&utm_campaign=buddypress-media
55
* Description: This plugin adds missing media rich features like photos, videos and audio uploading to BuddyPress which are essential if you are building social network, seriously!
6-
* Version: 4.6.15
6+
* Version: 4.6.16
77
* Author: rtCamp
88
* Text Domain: buddypress-media
99
* Author URI: http://rtcamp.com/?utm_source=dashboard&utm_medium=plugin&utm_campaign=buddypress-media
@@ -19,7 +19,7 @@
1919
/**
2020
* The version of the plugin
2121
*/
22-
define( 'RTMEDIA_VERSION', '4.6.15' );
22+
define( 'RTMEDIA_VERSION', '4.6.16' );
2323
}
2424

2525
if ( ! defined( 'RTMEDIA_PATH' ) ) {

0 commit comments

Comments
 (0)