Skip to content

Fix: Add authorization checks for media deletion#2321

Merged
krishana7911 merged 4 commits into
developfrom
fix/media-delete-permissions
Apr 6, 2026
Merged

Fix: Add authorization checks for media deletion#2321
krishana7911 merged 4 commits into
developfrom
fix/media-delete-permissions

Conversation

@krishana7911
Copy link
Copy Markdown
Contributor

Summary

Issue Resolved: https://github.com/rtCamp/rtmedia-io/issues/1900
This PR improves permission handling in the media deletion flow by adding proper authorization checks before allowing a media item to be deleted.

Changes

  • Validate that the current user is authorized to delete the requested media

  • Allow deletion only if the user is:

    • The owner of the media
    • A site administrator
    • A group administrator (for group media)
  • Return an error response when an unauthorized deletion is attempted

Impact

  • Prevents unintended deletion of media by users without appropriate permissions
  • Ensures media deletion behavior aligns with expected access control rules

Testing

  • Verified that users can delete their own media
  • Verified that administrators can delete any media
  • Verified that unauthorized users cannot delete media belonging to others

Notes

This change does not affect existing functionality for authorized users and maintains backward compatibility.

Comment thread app/main/controllers/template/rtmedia-ajax-actions.php Outdated
Comment thread app/main/controllers/template/rtmedia-ajax-actions.php
@rtBot
Copy link
Copy Markdown
Contributor

rtBot commented Apr 6, 2026

Unable to PHPCS or SVG scan one or more files due to error running PHPCS/SVG scanner:

  • app/main/controllers/template/rtmedia-ajax-actions.php

The error may be temporary. If the error persists, please contact a human (commit-ID: 93bf771).

@krishana7911 krishana7911 requested a review from thelovekesh April 6, 2026 13:38
@krishana7911 krishana7911 merged commit 55d9c92 into develop Apr 6, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants