Skip to content

hotfix- Security array lookup - #2362

Merged
the-hercules merged 1 commit into
developfrom
hotfix
Aug 17, 2026
Merged

hotfix- Security array lookup#2362
the-hercules merged 1 commit into
developfrom
hotfix

Conversation

@the-hercules

Copy link
Copy Markdown
Contributor

What

One-line fix in app/main/controllers/api/RTMediaJsonApiFunctions.php.

RTMediaModel::get_by_activity_id() returns ARRAY_A rows, but the media-id extraction added in b289b1d (merged via #2357) reads $media_row->id on an array.

Impact

Every JSON API call that builds a media feed (rtmedia_get_media_details, and any feed path where the activity has media rows):

  • emits PHP Warning: Attempt to read property "id" on array
  • computes intval(null) = 0, so RTMediaActivity is constructed with [0] and activity_content renders as an empty media list

Before:

"activity_content": "<div class=\"rtmedia-activity-container\"><ul class=\"... rtmedia-activity-media-length-0 rtm-activity-mixed-list\"></ul></div>"

After:

"activity_content": "<div class=\"rtmedia-activity-container\"><ul class=\"... rtmedia-activity-media-length-1 rtm-activity-photo-list\"><li ...><img .../></li></ul></div>"

The media array in the response was always correct — only activity_content was affected.

Security

None. The privacy gate immediately above this loop casts to object via (object) $media, so it handles both row shapes and visibility filtering was never affected. Verified after the fix:

user media 8 (privacy 60, alice) media 12 (privacy 80, alice) media 10 (public)
bob (non-owner) FALSE FALSE TRUE
alice (owner) TRUE TRUE TRUE

Testing

Reproduced and verified against a local BuddyPress + rtMedia site with token-authenticated API calls: warning count for RTMediaJsonApiFunctions dropped to 0, activity_content renders the correct thumbnail, and the privacy matrix above is unchanged.

🤖 Generated with Claude Code

RTMediaModel::get_by_activity_id() returns ARRAY_A rows, so the media-id
extraction added in b289b1d read `$media_row->id` on an array. Every API
call that builds a media feed emitted "Attempt to read property id on array"
and passed [0] to RTMediaActivity, so activity_content rendered as an empty
media list.

The privacy gate above this loop already casts to object, so visibility was
unaffected; only the id extraction was wrong.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Copilot AI balanced review requested due to automatic review settings August 17, 2026 12:11
@rtBot

rtBot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

Unable to PHPCS or SVG scan one or more files due to error running PHPCS/SVG scanner:

  • app/main/controllers/api/RTMediaJsonApiFunctions.php

The error may be temporary. If the error persists, please contact a human (commit-ID: c624a02).

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes media feed rendering by correctly extracting IDs from array-based database rows.

Changes:

  • Supports array and object media rows when building activity media IDs.
  • Prevents empty activity_content and related PHP warnings.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@the-hercules the-hercules changed the title hotfix hotfix- Security array lookup Aug 17, 2026
@the-hercules
the-hercules merged commit 9083afe into develop Aug 17, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants