← All changes
|
Modules/Integrations/FluentPlayer/Http/Controllers/MediaController.php
+26
-4
2.7.7
→
2.10.0
View file →
| @@ -2,8 +2,9 @@ | ||
| 2 | 2 | |
| 3 | 3 | namespace FluentCommunity\Modules\Integrations\FluentPlayer\Http\Controllers; |
| 4 | 4 | |
| 5 | 5 | use FluentCommunity\App\Http\Controllers\Controller; |
| 6 | +use FluentCommunity\App\Models\Feed; | |
| 6 | 7 | use FluentCommunity\App\Models\Media; |
| 7 | 8 | use FluentCommunity\App\Services\Helper; |
| 8 | 9 | use FluentCommunity\App\Services\Libs\FileSystem; |
| 9 | 10 | use FluentCommunity\Framework\Http\Request\Request; |
| @@ -234,14 +235,34 @@ | ||
| 234 | 235 | ]; |
| 235 | 236 | } |
| 236 | 237 | $mediaId = intval($request->get('media_id')); |
| 237 | 238 | $instanceKey = sanitize_key($request->get('player_instance_key')); |
| 238 | - $shareUrl = esc_url_raw($request->get('share_url')); | |
| 239 | + $shareUrl = esc_url_raw((string) $request->get('share_url', '')); | |
| 239 | 240 | $media = Media::find($mediaId); |
| 240 | 241 | if (!$media) { |
| 241 | - $media = (object) $request->all(); | |
| 242 | - } else if ($shareUrl) { | |
| 243 | - $media->share_url = $shareUrl; | |
| 242 | + // Non-DB media (external embed / share URL) from a synthetic hash id: build from | |
| 243 | + // allowlisted scalars only. Never trust request `settings`/`layers` — accepting | |
| 244 | + // them lets an anon caller inject shortcode layers into FluentPlayer's renderer. | |
| 245 | + $media = (object) [ | |
| 246 | + 'url' => esc_url_raw((string) $request->get('url', '')), | |
| 247 | + 'title' => sanitize_text_field($request->get('title')), | |
| 248 | + 'image' => esc_url_raw((string) $request->get('image', '')), | |
| 249 | + 'share_url' => esc_url_raw((string) $request->get('share_url', '')), | |
| 250 | + 'provider' => sanitize_text_field($request->get('provider')), | |
| 251 | + 'type' => sanitize_text_field($request->get('type')), | |
| 252 | + ]; | |
| 253 | + } else { | |
| 254 | + $currentUserId = get_current_user_id(); | |
| 255 | + $canView = ($currentUserId && (int) $media->user_id === $currentUserId) | |
| 256 | + || ($media->feed_id && Feed::byUserAccess($currentUserId) | |
| 257 | + ->byContentModerationAccessStatus($this->getUser()) | |
| 258 | + ->find($media->feed_id)); | |
| 259 | + if (!$canView) { | |
| 260 | + return ['html' => '']; | |
| 261 | + } | |
| 262 | + if ($shareUrl) { | |
| 263 | + $media->share_url = $shareUrl; | |
| 264 | + } | |
| 244 | 265 | } |
| 245 | 266 | return $this->generateFluentPlayerHtml($mediaId, $media, $instanceKey); |
| 246 | 267 | } |
| 247 | 268 | |
| @@ -576,8 +597,9 @@ | ||
| 576 | 597 | 'viewType' => 'video', |
| 577 | 598 | 'brandColor' => '#4a90e2', |
| 578 | 599 | 'aspectRatio' => 'original', |
| 579 | 600 | 'playerWidth' => '', |
| 601 | + 'playsInline' => true | |
| 580 | 602 | ]; |
| 581 | 603 | $mediaSettings = Bootstrap::getSettings(); |
| 582 | 604 | if (Arr::isTrue($mediaSettings, 'behaviors.muted_autoplay')) { |
| 583 | 605 | $mediaSettings['autoplay'] = true; |