Skip to content

Version update v4.7.12 [Master] - #2364

Merged
nazmulthenomad merged 37 commits into
masterfrom
develop
Aug 18, 2026
Merged

Version update v4.7.12 [Master]#2364
nazmulthenomad merged 37 commits into
masterfrom
develop

Conversation

@the-hercules

Copy link
Copy Markdown
Contributor

= 4.7.12 [August 18, 2026] =

  • FIXED

    • Fixed authorization checks for media, albums, comments and activity privacy so actions are limited to permitted users.
    • Fixed privacy enforcement for media returned by the JSON API.
    • Fixed insufficient validation and sanitization of upload targets, album selection and query parameters.
    • Fixed missing capability and nonce verification on administrative AJAX actions.
    • Fixed PHP 8 warnings reported on page load.
  • ENHANCEMENT

    • Improved compliance with WordPress plugin coding and security standards.
    • Removed development-only files from the distributed plugin package.

NoumaanAhamed and others added 30 commits July 21, 2026 14:26
chore: remove obsolete Codeception acceptance tests
update dependency versions in package.json
…late files

Add `if ( ! defined( 'ABSPATH' ) ) { exit; }` to 71 procedural and template
PHP files flagged by Plugin Check (missing_direct_file_access_protection).
The guard is inserted right after each file's docblock (after the plugin
header in index.php). No behavior change: these files are only ever reached
via WordPress includes where ABSPATH is already defined.

Clears all own-code direct-file-access errors (remaining ones are in bundled
third-party libraries under lib/).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The plugin already calls WordPress functions introduced up to 4.9.6
(wp_get_upload_dir 4.5, wp_delete_file 4.2, wp_parse_url 4.4, get_sites 4.6,
wp_add_inline_script 4.5, wp_add_privacy_policy_content 4.9.6). The declared
minimum of 4.1 was inaccurate.

Metadata-only change (plugin header + readme.txt) — no code or behaviour
change. Clears all own-code wp_function_not_compatible_with_requires_wp
errors (the 2 remaining are utf8_encode/decode in bundled lib/getid3).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Drop the now-restricted term "WordPress" from the plugin display name
  ("rtMedia for WordPress, BuddyPress and bbPress" -> "rtMedia for BuddyPress
  and bbPress"), clearing the trademarked-term name warnings. Display name
  only; the slug (buddypress-media) is unchanged and is grandfathered.
- Bump "Tested up to" 6.9 -> 7.0 to match the current WordPress release,
  clearing outdated_tested_upto_header.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Run Copilot code review on GitHub-hosted runners
… and add group privacy level retrieval function
the-hercules and others added 7 commits August 17, 2026 17:13
RTMediaModel::get_by_activity_id() returns ARRAY_A rows, so the media-id
extraction added in b289b1d read `$media_row->id` on an array. Every API
call that builds a media feed emitted "Attempt to read property id on array"
and passed [0] to RTMediaActivity, so activity_content rendered as an empty
media list.

The privacy gate above this loop already casts to object, so visibility was
unaffected; only the id extraction was wrong.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
hotfix- Security array lookup
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
languages/buddypress-media.pot (the name matching the plugin text domain)
was stale at 4.7.10 and missing the strings added in #2357, while releases
have been maintaining the misspelled languages/buddpress-media.pot.

Regenerate it with WP-CLI 2.12.0 so both templates carry the same 4.7.12
strings. Content is now byte-identical between the two files apart from
the creation timestamp.

Consolidating onto the correctly-spelled name and removing the duplicate is
deliberately left to a follow-up, so this release does not change the
documented release procedure.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@rtBot

rtBot commented Aug 18, 2026

Copy link
Copy Markdown
Contributor

Unable to PHPCS or SVG scan one or more files due to error running PHPCS/SVG scanner:

  • app/admin/RTMediaAdmin.php
  • app/admin/RTMediaFormHandler.php
  • app/admin/RTMediaUploadTermsAdmin.php
  • app/admin/templates/dashboard-widgets/right-now.php
  • app/admin/templates/notices/addon-update.php
  • app/admin/templates/notices/inspirebook-release.php
  • app/admin/templates/notices/premium-addon.php
  • app/admin/templates/notices/transcoder.php
  • app/admin/templates/notices/update-template.php
  • app/admin/templates/notices/upload-file-types.php
  • app/admin/templates/settings/admin-ui.php
  • app/admin/templates/settings/main.php
  • app/admin/templates/settings/media-sizes.php
  • app/admin/templates/settings/media-types.php
  • app/admin/templates/settings/render-option.php
  • app/admin/templates/settings/sidebar-addons.php
  • app/admin/templates/settings/sidebar-branding.php
  • app/admin/templates/tmpl-rtm-album-favourites-importer.php
  • app/admin/templates/tmpl-rtm-image.php
  • app/admin/templates/tmpl-rtm-map-mapping-failure.php
  • app/admin/templates/tmpl-rtm-msg-div.php
  • app/admin/templates/tmpl-rtm-p-tag.php
  • app/admin/templates/tmpl-rtm-theme-overlay.php
  • app/assets/admin/js/importer.js
  • app/assets/admin/js/importer.min.js
  • app/assets/admin/js/migration.js
  • app/assets/admin/js/migration.min.js
  • app/assets/admin/js/rtmedia-admin.js
  • app/assets/admin/js/rtmedia-admin.min.js
  • app/assets/js/rtMedia.backbone.js
  • app/helper/RTMediaAddon.php
  • app/helper/RTMediaAdminWidget.php
  • app/helper/RTMediaModel.php
  • app/helper/RTMediaSettings.php
  • app/helper/RTMediaSupport.php
  • app/helper/RTMediaUploadException.php
  • app/helper/db/RTDBModel.php
  • app/helper/db/RTDBUpdate.php
  • app/helper/db/rt_plugin_info.php
  • app/helper/rtDimensions.php
  • app/helper/rtForm.php
  • app/helper/rtFormInvalidArgumentsException.php
  • app/helper/rtPluginUpdateChecker.php
  • app/helper/rtProgress.php
  • app/helper/templates/3rd-party-themes-content.php
  • app/helper/templates/addon.php
  • app/helper/templates/debug-info.php
  • app/helper/templates/service-sector.php
  • app/helper/templates/submit-request.php
  • app/helper/templates/support-form.php
  • app/helper/templates/themes-content.php
  • app/importers/BPMediaAlbumimporter.php
  • app/importers/BPMediaImporter.php
  • app/importers/RTMediaActivityUpgrade.php
  • app/importers/RTMediaMediaSizeImporter.php
  • app/importers/RTMediaMigration.php
  • app/importers/templates/activity-upgrade.php
  • app/importers/templates/media-size-importer.php
  • app/main/RTMedia.php
  • app/main/RTMediaUploadTerms.php
  • app/main/controllers/activity/RTMediaBuddyPressActivity.php
  • app/main/controllers/api/RTMediaJsonApi.php
  • app/main/controllers/api/RTMediaJsonApiFunctions.php
  • app/main/controllers/group/RTMediaGroupExtension.php
  • app/main/controllers/media/RTMediaComment.php
  • app/main/controllers/media/RTMediaFeatured.php
  • app/main/controllers/media/RTMediaGroupFeatured.php
  • app/main/controllers/media/RTMediaLoginPopup.php
  • app/main/controllers/media/RTMediaMedia.php
  • app/main/controllers/media/RTMediaMeta.php
  • app/main/controllers/privacy/RTMediaPrivacy.php
  • app/main/controllers/shortcodes/RTMediaGalleryShortcode.php
  • app/main/controllers/shortcodes/RTMediaUploadShortcode.php
  • app/main/controllers/template/RTMediaAJAX.php
  • app/main/controllers/template/RTMediaNav.php
  • app/main/controllers/template/RTMediaTemplate.php
  • app/main/controllers/template/RTMediaUploadTemplate.php
  • app/main/controllers/template/rtmedia-actions.php
  • app/main/controllers/template/rtmedia-ajax-actions.php
  • app/main/controllers/template/rtmedia-filters.php
  • app/main/controllers/template/rtmedia-functions.php
  • app/main/controllers/upload/RTMediaUpload.php
  • app/main/controllers/upload/RTMediaUploadEndpoint.php
  • app/main/controllers/upload/RTMediaUploadModel.php
  • app/main/controllers/upload/RTMediaUploadView.php
  • app/main/controllers/upload/processors/RTMediaUploadFile.php
  • app/main/routers/RTMediaRouter.php
  • app/main/routers/query/RTMediaQuery.php
  • app/main/templates/admin-pages-content.php
  • app/main/templates/create-album-modal.php
  • app/main/templates/image-editor-content.php
  • app/main/templates/media-group-create-screen.php
  • app/main/templates/media-group-edit-screen.php
  • app/main/templates/media-pagination.php
  • app/main/templates/media-upload-terms.php
  • app/main/templates/merge-album-modal.php
  • app/main/templates/policy-information.php
  • app/main/templates/privacy-content.php
  • index.php
  • templates/main.php
  • templates/media/album-gallery-item.php
  • templates/media/album-gallery.php
  • templates/media/album-single-edit.php
  • templates/media/godam-integration.php
  • templates/media/media-gallery-item.php
  • templates/media/media-gallery.php
  • templates/media/media-single-edit.php
  • templates/media/media-single.php
  • templates/upload/comment-media.php
  • templates/upload/uploader.php

The error may be temporary. If the error persists, please contact a human (commit-ID: 4dea7df).

@the-hercules the-hercules changed the title Version update v4.7.12 Version update v4.7.12 [Master] Aug 18, 2026
@nazmulthenomad
nazmulthenomad merged commit 0d8e969 into master Aug 18, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants