From 975178196aee117474e8b817c2cc8f99c96f6905 Mon Sep 17 00:00:00 2001 From: Intenzi Date: Tue, 6 Oct 2026 14:42:08 +0530 Subject: [PATCH] fix: disallow privacy modification on single media and album edit when UI is not exposed --- .../controllers/template/RTMediaTemplate.php | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/app/main/controllers/template/RTMediaTemplate.php b/app/main/controllers/template/RTMediaTemplate.php index 8946245ca..c058aee2f 100755 --- a/app/main/controllers/template/RTMediaTemplate.php +++ b/app/main/controllers/template/RTMediaTemplate.php @@ -361,7 +361,21 @@ public function save_single_edit() { do_action( 'rtmedia_before_update_media', $rtmedia_query->action_query->id ); - $data_array = array( 'media_title', 'description', 'privacy' ); + // Privacy should not be editable for group media, moderated media and when privacy override is disabled. + if ( ( isset( $rtmedia_query->query['context'] ) && 'group' === $rtmedia_query->query['context'] ) + || ( isset( $rtmedia_query->media[0]->context ) && 'group' === $rtmedia_query->media[0]->context ) + // Moderated media privacy is not editable. + || ( isset( $rtmedia_query->media[0]->privacy ) && 80 === intval( $rtmedia_query->media[0]->privacy ) ) + || ! is_rtmedia_privacy_enable() + || ! is_rtmedia_privacy_user_overide() ) { + unset( $_POST['privacy'] ); + } + + $data_array = array( 'media_title', 'description' ); + + if ( isset( $_POST['privacy'] ) ) { + $data_array[] = 'privacy'; + } $_album_id = filter_input( INPUT_POST, 'album_id', FILTER_SANITIZE_NUMBER_INT ); // for medias except album and playlist, if album_is is found, then update album_id for the media also. if ( ! empty( $_album_id ) && rtmedia_current_user_can_add_to_album( $_album_id ) ) { @@ -541,7 +555,8 @@ public function save_album_edit() { $_selected_arr = filter_input_array( INPUT_POST, $filters ); $_selected = $_selected_arr['selected']; if ( ! empty( $submit ) ) { - $data_array = array( 'media_title', 'description', 'privacy' ); + $data_array = array( 'media_title', 'description' ); + unset( $_POST['privacy'] ); $data = rtmedia_sanitize_object( $_POST, $data_array ); // Properly Sanitized. $album = $model->get_media( array( 'id' => $rtmedia_query->media_query['album_id'] ), false, false ); $state = $media->update( $album[0]->id, $data, $album[0]->media_id );