Version update v4.7.12 [Master]

.distignore

@@ -1,15 +1,21 @@
 .bowerrc
+app/assets/css/sass/.bowerrc
+.distignore
+.github
 .gitattributes
 .gitignore
 .jshintrc
+.nvmrc
 .travis.yml
 CONTRIBUTING.md
 Gruntfile.js
 README.md
 bin
 deploy.sh
+node_modules
 package-lock.json
 package.json
 phpcs.xml
 phpunit.xml
+postcss.config.js
 tests

.github/workflows/copilot-code-review.yml

@@ -0,0 +1,22 @@
+name: Copilot code review setup steps
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - .github/workflows/copilot-code-review.yml
+  pull_request:
+    paths:
+      - .github/workflows/copilot-code-review.yml
+
+jobs:
+  # The job must be named `copilot-setup-steps`, or Copilot ignores this file.
+  copilot-setup-steps:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    steps:
+      - name: Start Review
+        run: echo "Starting Review."

README.md

@@ -147,6 +147,18 @@ https://www.youtube.com/watch?v=dJrykKQGDcs
 
 ## Changelog ##
 
+### 4.7.12
+* FIXED
+  * Fixed authorization checks for media, albums, comments and activity privacy so actions are limited to permitted users.
+  * Fixed privacy enforcement for media returned by the JSON API.
+  * Fixed insufficient validation and sanitization of upload targets, album selection and query parameters.
+  * Fixed missing capability and nonce verification on administrative AJAX actions.
+  * Fixed PHP 8 warnings reported on page load.
+
+* ENHANCEMENT
+  * Improved compliance with WordPress plugin coding and security standards.
+  * Removed development-only files from the distributed plugin package.
+
 ### 4.7.11
 * FIXED
   * Security enhancement: Improved data validation and sanitization for media queries and search filters.

app/admin/RTMediaAdmin.php

@@ -6,6 +6,10 @@
  * @subpackage Admin
  */
 
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
 if ( ! class_exists( 'RTMediaAdmin' ) ) {
 
 	/**
@@ -85,13 +89,11 @@ public function __construct() {
 
 			add_action( 'wp_ajax_rtmedia_submit_request', array( $this->rtmedia_support, 'submit_request' ), 1 );
 
-			add_action( 'wp_ajax_rtmedia_linkback', array( $this, 'linkback' ), 1 ); // todo: is it being used ?
 			add_action( 'wp_ajax_rtmedia_rt_album_deactivate', 'BPMediaAlbumimporter::bp_album_deactivate', 1 );
 			add_action( 'wp_ajax_rtmedia_rt_album_import', 'BPMediaAlbumimporter::bpmedia_ajax_import_callback', 1 );
 			add_action( 'wp_ajax_rtmedia_rt_album_import_favorites', 'BPMediaAlbumimporter::bpmedia_ajax_import_favorites', 1 );
 			add_action( 'wp_ajax_rtmedia_rt_album_import_step_favorites', 'BPMediaAlbumimporter::bpmedia_ajax_import_step_favorites', 1 );
 			add_action( 'wp_ajax_rtmedia_rt_album_cleanup', 'BPMediaAlbumimporter::cleanup_after_install' );
-			add_action( 'wp_ajax_rtmedia_convert_videos_form', array( $this, 'convert_videos_mailchimp_send' ), 1 ); // todo: is it being used ?
 			add_action( 'wp_ajax_rtmedia_correct_upload_filetypes', array( $this, 'correct_upload_filetypes' ), 1 );
 			add_filter( 'plugin_row_meta', array( $this, 'plugin_meta_premium_addon_link' ), 1, 2 );
 			add_action( 'wp_dashboard_setup', array( $this, 'add_dashboard_widgets' ), 0 );
@@ -335,7 +337,7 @@ public function rtmedia_admin_notices() {
 		public function rtmedia_premium_addon_notice() {
 			$site_option = rtmedia_get_site_option( 'rtmedia_premium_addon_notice' );
 
-			$premium_addon_notice = apply_filters( 'rt_premium_addon_notice', true );
+			$premium_addon_notice = apply_filters( 'rt_premium_addon_notice', true ); /* phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Legacy public naming retained for backward compatibility; renaming breaks dependent themes/add-ons. */
 			if ( ( ! $site_option || 'hide' !== $site_option ) ) {
 				if ( true === $premium_addon_notice ) {
 					rtmedia_update_site_option( 'rtmedia_premium_addon_notice', 'show' );
@@ -1225,7 +1227,7 @@ public function rtmedia_tabs() {
 				);
 			}
 
-			$tabs = apply_filters( 'media_add_tabs', $tabs );
+			$tabs = apply_filters( 'media_add_tabs', $tabs ); /* phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Legacy public naming retained for backward compatibility; renaming breaks dependent themes/add-ons. */
 
 			// Loop through tabs and build navigation.
 			foreach ( $tabs as $tab_data ) {
@@ -1433,21 +1435,6 @@ public function admin_sidebar() {
 			do_action( 'rtmedia_after_default_admin_widgets' );
 		}
 
-		/**
-		 * Function to save linkback.
-		 *
-		 * @return bool
-		 */
-		public function linkback() {
-			// todo: remove code looks like old setting save code new code at app/helper/RTMediaSettings.php.
-			$linkback = filter_input( INPUT_POST, 'linkback' );
-			if ( isset( $linkback ) && $linkback ) {
-				return rtmedia_update_site_option( 'rtmedia-add-linkback', true );
-			} else {
-				return rtmedia_update_site_option( 'rtmedia-add-linkback', false );
-			}
-		}
-
 		/**
 		 * Export rtMedia Settings
 		 *
@@ -1536,39 +1523,6 @@ public function import_settings( $file_path ) {
 			wp_send_json( $response );
 		}
 
-		/**
-		 * Ajax callback function Convert videos mailchimp.
-		 */
-		public function convert_videos_mailchimp_send() {
-			// todo: nonce required. -- Not required since this AJAX action is not being used anymore and will be removed in future version.
-
-			$interested = sanitize_text_field( filter_input( INPUT_POST, 'linkback', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) );
-			$choice     = sanitize_text_field( filter_input( INPUT_POST, 'choice', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) );
-			$url        = filter_input( INPUT_POST, 'url', FILTER_SANITIZE_URL );
-			$email      = filter_input( INPUT_POST, 'email', FILTER_SANITIZE_EMAIL );
-
-			if ( 'Yes' === $interested && ! empty( $choice ) ) {
-				wp_remote_get(
-					esc_url_raw(
-						add_query_arg(
-							array(
-								'rtmedia-convert-videos-form' => 1,
-								'choice' => $choice,
-								'url'    => $url,
-								'email'  => $email,
-							),
-							esc_url( 'https://rtmedia.io/' )
-						)
-					)
-				);
-			} else {
-				rtmedia_update_site_option( 'rtmedia-survey', 0 );
-			}
-
-			esc_html_e( 'Thank you for your time.', 'buddypress-media' );
-			wp_die();
-		}
-
 		/**
 		 * Function to save Video transcoding survey response.
 		 */
@@ -1615,6 +1569,10 @@ public function upload_filetypes_error() {
 		 * Correct upload filetypes.
 		 */
 		public function correct_upload_filetypes() {
+			if ( ! current_user_can( 'manage_options' ) ) {
+				wp_send_json( false );
+			}
+
 			if ( ! check_ajax_referer( '_rtm_file_type_error_', '_rtm_nonce' ) ) {
 				wp_send_json( false );
 			}

app/admin/RTMediaFormHandler.php

@@ -6,6 +6,10 @@
  * @subpackage Admin
  */
 
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
 /**
  * Class for different form elements display.
  *

app/admin/RTMediaUploadTermsAdmin.php

@@ -7,6 +7,10 @@
  * @author  Malav Vasita <malav.vasita@rtcamp.com>
  */
 
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
 /**
  * We will first check if rtmedia-upload-terms plugin is activate before putting this code in action.
  * RTMediaUploadTermsAdmin class would come in picture if and only if rtmedia-upload-terms plugin is deactivated.

app/admin/templates/dashboard-widgets/right-now.php

@@ -5,6 +5,10 @@
  * @package rtMedia
  */
 
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
 ?>
 
 <div class="clearfix">
@@ -17,14 +21,14 @@
 			<?php
 			$rtmedia_model = new RTMediaModel();
 			global $wpdb;
-			$results = wp_cache_get( 'rt-stats', 'rt-dashboard' );
+			$results = wp_cache_get( 'rt-stats', 'rt-dashboard' ); /* phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Legacy public naming retained for backward compatibility; renaming breaks dependent themes/add-ons. */
 			if ( false === $results ) {
-				// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Direct query required; safe because table name is trusted.
+				// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.InterpolatedNotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter, WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Direct query required; safe because table name is trusted.
 				$results = $wpdb->get_results( $wpdb->prepare( "SELECT media_type, count(id) as count FROM {$rtmedia_model->table_name} WHERE blog_id=%d GROUP BY media_type", get_current_blog_id() ) );
 				wp_cache_set( 'stats', $results, 'rt-dashboard', HOUR_IN_SECONDS );
 			}
 			if ( $results ) {
-				foreach ( $results as $media ) {
+				foreach ( $results as $media ) { /* phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Legacy public naming retained for backward compatibility; renaming breaks dependent themes/add-ons. */
 					if ( defined( strtoupper( 'RTMEDIA_' . $media->media_type . '_PLURAL_LABEL' ) ) ) {
 						?>
 						<tr>
@@ -46,9 +50,9 @@
 		<table>
 			<tbody>
 			<?php
-			$total_count = wp_cache_get( 'total_count', 'rt-dashboard' );
+			$total_count = wp_cache_get( 'total_count', 'rt-dashboard' ); /* phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Legacy public naming retained for backward compatibility; renaming breaks dependent themes/add-ons. */
 			if ( false === $total_count ) {
-				// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared -- Direct query required; safe because table name is trusted.
+				// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Direct query required; safe because table name is trusted.
 				$total_count = $wpdb->get_var( "select count(*) from {$wpdb->users}" );
 				wp_cache_set( 'total_count', $total_count, 'rt-dashboard', HOUR_IN_SECONDS );
 			}
@@ -58,9 +62,9 @@
 				<td class="t"><?php esc_html_e( 'Total ', 'buddypress-media' ); ?></td>
 			</tr>
 			<?php
-			$with_media_count = wp_cache_get( 'with_media', 'rt-dashboard' );
+			$with_media_count = wp_cache_get( 'with_media', 'rt-dashboard' ); /* phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Legacy public naming retained for backward compatibility; renaming breaks dependent themes/add-ons. */
 			if ( false === $with_media_count ) {
-				// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Direct query required; safe because table name is trusted.
+				// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter, WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Direct query required; safe because table name is trusted.
 				$with_media_count = $wpdb->get_var( "SELECT count(distinct media_author) FROM {$rtmedia_model->table_name}" );
 				wp_cache_set( 'with_media', $with_media_count, 'rt-dashboard', HOUR_IN_SECONDS );
 			}
@@ -72,7 +76,7 @@
 			<?php
 			$comments = wp_cache_get( 'comments', 'rt-dashboard' ); // phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited
 			if ( false === $comments ) {
-				// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, WordPress.WP.GlobalVariablesOverride.Prohibited, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
+				// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, WordPress.WP.GlobalVariablesOverride.Prohibited, WordPress.DB.PreparedSQL.InterpolatedNotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter
 				$comments = $wpdb->get_var( "SELECT count(*) FROM {$wpdb->comments} WHERE comment_post_ID IN ( SELECT media_id FROM {$rtmedia_model->table_name} )" );
 				wp_cache_set( 'comments', $comments, 'rt-dashboard', HOUR_IN_SECONDS );
 			}
@@ -82,9 +86,9 @@
 				<td class="t"><?php esc_html_e( 'Comments ', 'buddypress-media' ); ?></td>
 			</tr>
 			<?php
-			$likes = wp_cache_get( 'likes', 'rt-dashboard' );
+			$likes = wp_cache_get( 'likes', 'rt-dashboard' ); /* phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Legacy public naming retained for backward compatibility; renaming breaks dependent themes/add-ons. */
 			if ( false === $likes ) {
-    			// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Direct query required; safe because table name is trusted.
+    			// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter, WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Direct query required; safe because table name is trusted.
 				$likes = $wpdb->get_var( "SELECT sum(likes) FROM {$rtmedia_model->table_name}" );
 				wp_cache_set( 'likes', $likes, 'rt-dashboard', HOUR_IN_SECONDS );
 			}

app/admin/templates/notices/addon-update.php

@@ -5,12 +5,16 @@
  * @package rtMedia
  */
 
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
 ?>
 
 <div class="notice error is-dismissible rtmedia-addon-update-notice">
 	<p>
 		<?php
-		$message = apply_filters( 'rt_addon_update_notice', sprintf( __( ' rtMedia Premium update is available. Please update it from the plugins or download it from <a href = "https://rtmedia.io/my-account/" target="_blank" >your account</a>', 'buddypress-media' ) ) );
+		$message = apply_filters( 'rt_addon_update_notice', sprintf( __( ' rtMedia Premium update is available. Please update it from the plugins or download it from <a href = "https://rtmedia.io/my-account/" target="_blank" >your account</a>', 'buddypress-media' ) ) ); /* phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound, WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Legacy public naming retained for backward compatibility; renaming breaks dependent themes/add-ons. */
 		?>
 		<b><?php esc_html_e( 'rtMedia: ', 'buddypress-media' ); ?></b>
 		<?php

app/admin/templates/notices/inspirebook-release.php

@@ -5,6 +5,10 @@
  * @package rtMedia
  */
 
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
 ?>
 
 <div class="notice is-dismissible updated rtmedia-inspire-book-notice">

app/admin/templates/notices/premium-addon.php

@@ -5,17 +5,21 @@
  * @package rtMedia
  */
 
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
 ?>
 
 <div class="notice is-dismissible updated rtmedia-pro-split-notice">
 	<?php wp_nonce_field( 'rtcamp_pro_split', 'rtm_nonce' ); ?>
 	<p>
 		<span>
 			<?php
-			$product_page = esc_url( 'https://rtmedia.io/products/?utm_source=dashboard&utm_medium=plugin&utm_campaign=buddypress-media' );
+			$product_page = esc_url( 'https://rtmedia.io/products/?utm_source=dashboard&utm_medium=plugin&utm_campaign=buddypress-media' ); /* phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Legacy public naming retained for backward compatibility; renaming breaks dependent themes/add-ons. */
 
-			$message = apply_filters(
-				'rt_premium_addon_notice_message',
+			$message = apply_filters( /* phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Legacy public naming retained for backward compatibility; renaming breaks dependent themes/add-ons. */
+				'rt_premium_addon_notice_message', /* phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Legacy public naming retained for backward compatibility; renaming breaks dependent themes/add-ons. */
 				sprintf(
 						/* translators: %s: Product page link. */
 					__( 'Check 30+ premium rtMedia add-ons on our <a href="%s">store</a>.', 'buddypress-media' ),

app/admin/templates/notices/transcoder.php

@@ -5,6 +5,10 @@
  * @package rtMedia
  */
 
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
 // Include plugin.php if not already loaded.
 if ( ! function_exists( 'is_plugin_active' ) ) {
 	include_once ABSPATH . 'wp-admin/includes/plugin.php';
@@ -26,7 +30,7 @@
 	<?php wp_nonce_field( '_install_transcoder_hide_notice_', 'install_transcoder_hide_notice_nonce' ); ?>
 	<p>
 		<?php
-		$allowed_tags = array(
+		$allowed_tags = array( /* phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Legacy public naming retained for backward compatibility; renaming breaks dependent themes/add-ons. */
 			'a' => array(
 				'href'   => array(),
 				'target' => array(),

app/admin/templates/notices/update-template.php

@@ -5,6 +5,10 @@
  * @package rtMedia
  */
 
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
 ?>
 
 <div class="error rtmedia-update-template-notice">

app/admin/templates/notices/upload-file-types.php

@@ -5,8 +5,12 @@
  * @package rtMedia
  */
 
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
 if ( ! empty( $rtmedia->options['images_enabled'] ) ) {
-	$not_supported_image = array_diff( array( 'jpg', 'jpeg', 'png', 'gif' ), $upload_filetypes );
+	$not_supported_image = array_diff( array( 'jpg', 'jpeg', 'png', 'gif' ), $upload_filetypes ); /* phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Legacy public naming retained for backward compatibility; renaming breaks dependent themes/add-ons. */
 	if ( ! empty( $not_supported_image ) ) {
 		?>
 		<div class="error upload-filetype-network-settings-error">