| @@ -43,9 +43,9 @@ | ||
| 43 | 43 | $this->app->addFilter('fluent_community/feed/new_feed_data', [$this, 'maybeAddFluentPlayerMedia'], 10, 2); |
| 44 | 44 | $this->app->addFilter('fluent_community/feed/update_feed_data', [$this, 'maybeUpdateFluentPlayerMedia'], 10, 2); |
| 45 | 45 | $this->app->addFilter('fluent_community/feed/uploaded_feed_medias', [$this, 'maybeUpdateUploadedMedia'], 10, 2); |
| 46 | 46 | } |
| 47 | - | |
| 47 | + | |
| 48 | 48 | /** |
| 49 | 49 | * Get FluentPlayer plugin status |
| 50 | 50 | * |
| 51 | 51 | * @return string 'active', 'installed', or 'not_installed' |
| @@ -432,11 +432,17 @@ | ||
| 432 | 432 | } |
| 433 | 433 | if ($media && is_array($media) && Arr::get($media, 'player') == 'fluent_player' && $mediaId = Arr::get($media, 'media_id')) { |
| 434 | 434 | $mediaId = intval($mediaId); |
| 435 | 435 | if ($mediaId) { |
| 436 | - $media = Media::find($mediaId); | |
| 437 | - if ($media) { | |
| 438 | - $uploadedMedias[] = $media; | |
| 436 | + $currentUserId = (int) get_current_user_id(); | |
| 437 | + $mediaModel = Media::find($mediaId); | |
| 438 | + // Owner, or a moderator/admin who can edit the media's feed — never cross-user. | |
| 439 | + $canAttach = $mediaModel && $currentUserId && ( | |
| 440 | + (int) $mediaModel->user_id === $currentUserId | |
| 441 | + || ($mediaModel->feed_id && $mediaModel->feed && $mediaModel->feed->hasEditAccess($currentUserId)) | |
| 442 | + ); | |
| 443 | + if ($canAttach) { | |
| 444 | + $uploadedMedias[] = $mediaModel; | |
| 439 | 445 | } |
| 440 | 446 | } |
| 441 | 447 | } |
| 442 | 448 | $audioMedias = $this->sanitizeAudioMedias($requestData); |
