Fix: Enforce media ownership verification for activity and comment attachments

[Intenzi]

Description

Prior to this fix, an authenticated user could submit someone else's media ID inside rtMedia_attached_files when posting a status update or replying to a comment. This resulted in two security issues:

1. Activity Hijacking in Database: The media's activity_id in the relevant table could be reassigned to the attacker's activity post or comment.
2. Unauthorized Media Rendering: The comment/activity content filters generated HTML embedding the victim's media item into the attacker's activity or comment thread without checking ownership.

This PR introduces an explicit media ownership check across all entry points where rtMedia_attached_files is processed, ensuring that only media authored by the posting user can be linked or embedded.

---

Details

1. app/main/controllers/template/rtmedia-functions.php

   • Added a new helper function rtmedia_is_media_owner( $media_id, $user_id = 0 ).
   • Reason: The logic to query RTMediaModel and verify media_author === $user_id was needed across multiple controllers and callbacks. Centralizing it here keeps the codebase DRY, avoids duplicate database query logic and safely handles default user ID fallbacks.

2. app/main/controllers/activity/RTMediaBuddyPressActivity.php

   • bp_activity_content_before_save(): Added rtmedia_is_media_owner() check before calling $obj_activity->create_activity_html(). This prevents unauthorized media HTML from being injected into the content before saving.
   • bp_activity_posted_update(): Added and media_author = %d to the raw batch SQL UPDATE statement linking media to the newly posted activity ID.
   • bp_activity_comment_posted_update(): Checked ownership using rtmedia_is_media_owner( ..., $user_id ) before building the comment media HTML and updating comments.

3. app/main/controllers/template/rtmedia-ajax-actions.php

   • rtmedia_bp_activity_after_save_callback(): Added an early return if ! rtmedia_is_media_owner( $rtmedia_attached_files[0] ), this prevents unauthorized updates to the media row's activity_id on AJAX replies.
   • rtmedia_bp_activity_comment_content_callback(): Added ownership verification before generating comment media HTML.

4. app/main/controllers/template/RTMediaTemplate.php

   • save_single_edit(): Verified media ownership before constructing comment media HTML when commenting on single media pages.

[Copilot]

🟡 Changes recommended

Several paths still permit unauthorized rendering or metadata mutation, and one guard can bypass privacy inheritance.

3 open findings

• Validate ownership of every submitted media ID · New
• Reject unauthorized attachments before adding comments · New
• Preserve parent privacy when attachment validation fails · New

What changed in this PR

Adds ownership validation to prevent unauthorized rtMedia attachments in activities and comments.

Changes:

• Introduces a reusable media ownership helper.
• Guards attachment rendering and metadata updates.
• Restricts activity linkage SQL by media author.

File	Description
RTMediaTemplate.php	Checks ownership for media comments.
rtmedia-functions.php	Adds the ownership helper.
rtmedia-ajax-actions.php	Guards AJAX comment processing.
RTMediaBuddyPressActivity.php	Protects activity rendering and linkage.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[rtBot]

Unable to PHPCS or SVG scan one or more files due to error running PHPCS/SVG scanner:

• app/main/controllers/activity/RTMediaBuddyPressActivity.php
• app/main/controllers/media/RTMediaComment.php
• app/main/controllers/template/RTMediaTemplate.php
• app/main/controllers/template/rtmedia-ajax-actions.php
• app/main/controllers/template/rtmedia-functions.php

The error may be temporary. If the error persists, please contact a human (commit-ID: 6fd5cb7).

[Intenzi]

The flagged reviews by Copilot are correct, they are followups to the fixes and I have resolved them with the newly pushed commits.