Repository navigation
Fix - Enforce activity ownership verification on media upload endpoint - #2380
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Unauthorized IDs remain in the upload payload, and anonymous users can match userless activities.
2 open findings
What changed in this PR
Adds ownership verification before attaching uploads to a client-supplied BuddyPress activity.
Changes:
- Fetches the requested activity.
- Compares its author with the current user.
- Falls back when verification fails.
| File | Description |
|---|---|
app/main/controllers/upload/RTMediaUploadEndpoint.php |
Adds activity ownership validation. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Contributor
|
Unable to PHPCS or SVG scan one or more files due to error running PHPCS/SVG scanner:
The error may be temporary. If the error persists, please contact a human (commit-ID: 459a282). |
the-hercules
approved these changes
Oct 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
When media is uploaded via
RTMediaUploadEndpoint, callers can pass an optional client-suppliedactivity_idparameter. Prior to this fix, rtMedia accepted this parameter without verifying whether the currently logged-in user actually created or owned that target activity.This PR introduces an explicit activity ownership check before accepting a client-supplied
activity_id. If the acting user is not the author of that activity, the parameter is rejected and rtMedia safely falls back to creating a brand-new activity for the upload, preventing unauthorized activity overwrites.Details
$_activity_idusingbp_activity_get_specific()to ensure the current logged-in user is the author of the target activity.activity_idwhen verification succeeds. If unauthorized or invalid, assignment is skipped, allowing the upload to proceed through the default standalone media flow.