← All changes
|
Modules/Integrations/FluentPlayer/Http/Controllers/MediaController.php
+35
-20
2.7.5
→
2.10.0
View file →
| @@ -2,8 +2,9 @@ | ||
| 2 | 2 | |
| 3 | 3 | namespace FluentCommunity\Modules\Integrations\FluentPlayer\Http\Controllers; |
| 4 | 4 | |
| 5 | 5 | use FluentCommunity\App\Http\Controllers\Controller; |
| 6 | +use FluentCommunity\App\Models\Feed; | |
| 6 | 7 | use FluentCommunity\App\Models\Media; |
| 7 | 8 | use FluentCommunity\App\Services\Helper; |
| 8 | 9 | use FluentCommunity\App\Services\Libs\FileSystem; |
| 9 | 10 | use FluentCommunity\Framework\Http\Request\Request; |
| @@ -234,14 +235,34 @@ | ||
| 234 | 235 | ]; |
| 235 | 236 | } |
| 236 | 237 | $mediaId = intval($request->get('media_id')); |
| 237 | 238 | $instanceKey = sanitize_key($request->get('player_instance_key')); |
| 238 | - $shareUrl = esc_url_raw($request->get('share_url')); | |
| 239 | + $shareUrl = esc_url_raw((string) $request->get('share_url', '')); | |
| 239 | 240 | $media = Media::find($mediaId); |
| 240 | 241 | if (!$media) { |
| 241 | - $media = (object) $request->all(); | |
| 242 | - } else if ($shareUrl) { | |
| 243 | - $media->share_url = $shareUrl; | |
| 242 | + // Non-DB media (external embed / share URL) from a synthetic hash id: build from | |
| 243 | + // allowlisted scalars only. Never trust request `settings`/`layers` — accepting | |
| 244 | + // them lets an anon caller inject shortcode layers into FluentPlayer's renderer. | |
| 245 | + $media = (object) [ | |
| 246 | + 'url' => esc_url_raw((string) $request->get('url', '')), | |
| 247 | + 'title' => sanitize_text_field($request->get('title')), | |
| 248 | + 'image' => esc_url_raw((string) $request->get('image', '')), | |
| 249 | + 'share_url' => esc_url_raw((string) $request->get('share_url', '')), | |
| 250 | + 'provider' => sanitize_text_field($request->get('provider')), | |
| 251 | + 'type' => sanitize_text_field($request->get('type')), | |
| 252 | + ]; | |
| 253 | + } else { | |
| 254 | + $currentUserId = get_current_user_id(); | |
| 255 | + $canView = ($currentUserId && (int) $media->user_id === $currentUserId) | |
| 256 | + || ($media->feed_id && Feed::byUserAccess($currentUserId) | |
| 257 | + ->byContentModerationAccessStatus($this->getUser()) | |
| 258 | + ->find($media->feed_id)); | |
| 259 | + if (!$canView) { | |
| 260 | + return ['html' => '']; | |
| 261 | + } | |
| 262 | + if ($shareUrl) { | |
| 263 | + $media->share_url = $shareUrl; | |
| 264 | + } | |
| 244 | 265 | } |
| 245 | 266 | return $this->generateFluentPlayerHtml($mediaId, $media, $instanceKey); |
| 246 | 267 | } |
| 247 | 268 | |
| @@ -343,28 +364,21 @@ | ||
| 343 | 364 | width: " . $playerWidth . 'px' . "; |
| 344 | 365 | } |
| 345 | 366 | "; |
| 346 | 367 | } |
| 347 | - $brandingColor = Bootstrap::sanitizeColor(Arr::get($settings, 'brandColor', '')); | |
| 348 | - if ($brandingColor) { | |
| 368 | + $colorVars = array_filter([ | |
| 369 | + '--media-brand' => Bootstrap::sanitizeColor(Arr::get($settings, 'brandColor', '')), | |
| 370 | + '--fp-control-bar-bg' => Bootstrap::sanitizeColor(Arr::get($settings, 'controlBarColor', '')), | |
| 371 | + '--media-play-color' => Bootstrap::sanitizeColor(Arr::get($settings, 'playButtonColor', '')), | |
| 372 | + '--media-play-bg' => Bootstrap::sanitizeColor(Arr::get($settings, 'playButtonBgColor', '')) | |
| 373 | + ]); | |
| 374 | + if ($colorVars) { | |
| 349 | 375 | $customCss .= " |
| 350 | - #fluent_player_" . esc_attr($instanceId) . " { | |
| 351 | - --media-brand: " . esc_attr($brandingColor) . "; | |
| 352 | - } | |
| 353 | - "; | |
| 354 | - } | |
| 355 | - $controlBarColor = Bootstrap::sanitizeColor(Arr::get($settings, 'controlBarColor', '')); | |
| 356 | - if ($brandingColor || $controlBarColor) { | |
| 357 | - $customCss .= " | |
| 358 | 376 | #fluent_player_" . esc_attr($instanceId) . " {"; |
| 359 | - if ($brandingColor) { | |
| 377 | + foreach ($colorVars as $varName => $varValue) { | |
| 360 | 378 | $customCss .= " |
| 361 | - --media-brand: " . esc_attr($brandingColor) . ";"; | |
| 379 | + " . $varName . ": " . esc_attr($varValue) . ";"; | |
| 362 | 380 | } |
| 363 | - if ($controlBarColor) { | |
| 364 | - $customCss .= " | |
| 365 | - --fp-control-bar-bg: " . esc_attr($controlBarColor) . ";"; | |
| 366 | - } | |
| 367 | 381 | $customCss .= " |
| 368 | 382 | } |
| 369 | 383 | "; |
| 370 | 384 | } |
| @@ -583,8 +597,9 @@ | ||
| 583 | 597 | 'viewType' => 'video', |
| 584 | 598 | 'brandColor' => '#4a90e2', |
| 585 | 599 | 'aspectRatio' => 'original', |
| 586 | 600 | 'playerWidth' => '', |
| 601 | + 'playsInline' => true | |
| 587 | 602 | ]; |
| 588 | 603 | $mediaSettings = Bootstrap::getSettings(); |
| 589 | 604 | if (Arr::isTrue($mediaSettings, 'behaviors.muted_autoplay')) { |
| 590 | 605 | $mediaSettings['autoplay'] = true; |