[Intenzi]

Summary

This PR applies targeted security hardening and access-control fixes across core rtMedia components to align with WordPress security best practices.

---

Key Changes

1. Access Control & Permissions:

   • Media Deletion: Enforced rtmedia_current_user_can_manage_media() check in RTMediaTemplate::single_delete() before deletion, preventing unauthorized deletion of other users' media.
   • Network Options: Added current_user_can( 'manage_network_options' ) and check_admin_referer() in save_multisite_options().
   • Settings & Notices: Added admin referer nonces and manage_options capability checks for option updates on admin_init and migration notice dismissals.
   • GoDAM Activity Comments: Added parent activity visibility checks in rtmedia_user_can_view_activity() for activity comments.

2. Privacy Boundary Enforcement:

   • Private Group Media: Updated RTMediaQuery::privacy_filter() so that media belonging to private BuddyPress groups (privacy = 20) is only queryable by active group members (groups_get_user_groups()).
   • Album Search: Preserved active SQL privacy clauses during album search queries by preventing $where from being reset to an empty string.

3. Authentication & Rate Limiting:

   • Password Reset Enumeration: Normalized wp_forgot_password JSON API response to a uniform success payload (status_code: 500003) regardless of whether the account exists, preventing username/email harvesting.
   • Rate Limiting: Enforced rate limiting on password reset attempts using RTMediaApiRateLimiter with dedicated reset bucket keys to prevent email flooding without impacting regular login attempts.

4. Input Sanitization & Injection Prevention:

   • Comment Attribution: Bound user_id, comment_author, and comment_post_ID directly to the authenticated session and route in the web template, strictly allowlisting attributes passed to wp_insert_comment().
   • Query Builder: Added an allowlist of valid filter columns in RTMediaModel::get_counts() with an rtmedia_allowed_counts_columns extensibility filter to prevent identifier injection.
   • Path Traversal: Cast context_id to integer via absint() in group upload handling to eliminate path traversal risks.
   • DOM Attribute Escaping: Escaped album context strings before appending <optgroup> markup in rtMedia.js and regenerated rtmedia.min.js.

---

Verification & Testing

• Tested locally on WordPress with BuddyPress enabled:
  • Verified media deletion fails with HTTP 403 when attempted by non-owners.
  • Verified password reset API returns uniform responses for registered and unregistered accounts.
  • Verified password reset rate limiting triggers HTTP 429 after 5 consecutive requests without locking out API login.
  • Verified comment attribution records the authenticated user and ignores spoofed POST parameters.
  • Verified private group media is excluded from sitewide queries for non-group members.
• Grunt build executed cleanly for minified JavaScript assets.

AI Usage

Hermes with Gemini Flash 3.8 (High) and an agentic review loop via headless DeepSeek Harness on DeepSeek-V4.1-Flash (High Effort).
I have ensured to manually validate and fix all changes accordingly.

[rtBot]

Unable to PHPCS or SVG scan one or more files due to error running PHPCS/SVG scanner:

• app/admin/RTMediaAdmin.php
• app/assets/js/rtMedia.js
• app/assets/js/rtmedia.min.js
• app/helper/RTMediaModel.php
• app/helper/RTMediaSettings.php
• app/importers/RTMediaMigration.php
• app/main/controllers/api/RTMediaApiRateLimiter.php
• app/main/controllers/api/RTMediaJsonApi.php
• app/main/controllers/media/RTMediaComment.php
• app/main/controllers/template/RTMediaTemplate.php
• app/main/controllers/template/rtmedia-filters.php
• app/main/controllers/upload/RTMediaUploadModel.php
• app/main/controllers/upload/processors/RTMediaUploadFile.php
• app/main/routers/query/RTMediaQuery.php
• templates/media/godam-integration.php

The error may be temporary. If the error persists, please contact a human (commit-ID: 8903bb2).