← All changes
|
Modules/Integrations/FluentPlayer/Http/Controllers/MediaController.php
+4
-4
2.8.0
→
2.10.0
View file →
| @@ -235,9 +235,9 @@ | ||
| 235 | 235 | ]; |
| 236 | 236 | } |
| 237 | 237 | $mediaId = intval($request->get('media_id')); |
| 238 | 238 | $instanceKey = sanitize_key($request->get('player_instance_key')); |
| 239 | - $shareUrl = esc_url_raw($request->get('share_url')); | |
| 239 | + $shareUrl = esc_url_raw((string) $request->get('share_url', '')); | |
| 240 | 240 | $media = Media::find($mediaId); |
| 241 | 241 | if (!$media) { |
| 242 | 242 | // Non-DB media (external embed / share URL) from a synthetic hash id: build from |
| 243 | 243 | // allowlisted scalars only. Never trust request `settings`/`layers` — accepting |
| @@ -242,12 +242,12 @@ | ||
| 242 | 242 | // Non-DB media (external embed / share URL) from a synthetic hash id: build from |
| 243 | 243 | // allowlisted scalars only. Never trust request `settings`/`layers` — accepting |
| 244 | 244 | // them lets an anon caller inject shortcode layers into FluentPlayer's renderer. |
| 245 | 245 | $media = (object) [ |
| 246 | - 'url' => esc_url_raw($request->get('url')), | |
| 246 | + 'url' => esc_url_raw((string) $request->get('url', '')), | |
| 247 | 247 | 'title' => sanitize_text_field($request->get('title')), |
| 248 | - 'image' => esc_url_raw($request->get('image')), | |
| 249 | - 'share_url' => esc_url_raw($request->get('share_url')), | |
| 248 | + 'image' => esc_url_raw((string) $request->get('image', '')), | |
| 249 | + 'share_url' => esc_url_raw((string) $request->get('share_url', '')), | |
| 250 | 250 | 'provider' => sanitize_text_field($request->get('provider')), |
| 251 | 251 | 'type' => sanitize_text_field($request->get('type')), |
| 252 | 252 | ]; |
| 253 | 253 | } else { |