Merge pull request #2189 from rtCamp/revert-2185-fix/nonce-verification-issues

Vedant-Gandhi · web-flow · commit 982741f66a38 · 2025-10-14T17:54:35.000+05:30
Revert "Fix Nonce Verification flags in the Codebase"
diff --git a/app/admin/RTMediaAdmin.php b/app/admin/RTMediaAdmin.php
@@ -779,7 +779,6 @@ public function ui( $hook ) {
 					'RTMedia_Admin_Settings_JS',
 					array(
 						'rtmedia_default_sizes_error_message' => esc_html__( 'Invalid value for [default_size_property].', 'buddypress-media' ),
-						'rtmedia_buddypress_convert_nonce'    => wp_create_nonce( 'rtmedia_buddypress_convert_nonce' ),
 					)
 				);
 
@@ -1350,7 +1349,7 @@ public function settings_sub_tabs() {
 		 */
 		public function save_multisite_options() {
 			global $rtmedia_admin;
-			do_action( 'rtmedia_sanitize_settings', wp_unslash( $_POST ) ); // phpcs:ignore WordPress.Security.NonceVerification.NoNonceVerification, WordPress.Security.NonceVerification.Missing -- Nonce verification is handled by network_admin_edit_ action hook which requires valid nonce and proper capabilities.
+			do_action( 'rtmedia_sanitize_settings', wp_unslash( $_POST ) ); // phpcs:ignore WordPress.Security.NonceVerification.NoNonceVerification, WordPress.Security.NonceVerification.Missing
 
 			$rtmedia_options = filter_input( INPUT_POST, 'rtmedia_options' );
 			if ( isset( $rtmedia_options ) ) {
@@ -1516,13 +1515,7 @@ public function import_settings( $file_path ) {
 		 * Ajax callback function Convert videos mailchimp.
 		 */
 		public function convert_videos_mailchimp_send() {
-			$nonce = sanitize_text_field( wp_unslash( $_POST['wp_nonce'] ) );
-
-			if( ! wp_verify_nonce( $nonce, 'rtmedia_buddypress_convert_nonce' ) ) {
-				esc_html_e( 'Invalid Request.', 'buddypress-media' );
-				wp_die();
-			}
-
+			// todo: nonce required.
 			$interested = sanitize_text_field( filter_input( INPUT_POST, 'linkback', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) );
 			$choice     = sanitize_text_field( filter_input( INPUT_POST, 'choice', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) );
 			$url        = filter_input( INPUT_POST, 'url', FILTER_SANITIZE_URL );
diff --git a/app/admin/templates/settings/main.php b/app/admin/templates/settings/main.php
@@ -24,7 +24,6 @@
 						</div>
 					<?php } ?>
 					<input type="hidden" name="rtmedia-options-save" value="true">
-					<?php wp_nonce_field( 'rtmedia_settings', 'wp_nonce' ); ?>
 					<input type="submit" class="rtmedia-settings-submit button button-primary button-big" value="<?php esc_attr_e( 'Save Settings', 'buddypress-media' ); ?>">
 				</div>
 				<?php
@@ -56,7 +55,6 @@
 					</div>
 
 					<input type="hidden" name="rtmedia-options-save" value="true">
-					<?php wp_nonce_field( 'rtmedia_settings', 'wp_nonce' ); ?>
 					<input type="submit" class="rtmedia-settings-submit button button-primary button-big" value="<?php esc_attr_e( 'Save Settings', 'buddypress-media' ); ?>">
 				</div>
 			</div>
diff --git a/app/assets/admin/js/settings.js b/app/assets/admin/js/settings.js
@@ -810,10 +810,8 @@ jQuery( document ).ready( function ( $ ) {
 			email: jQuery( '.email' ).val(),
 			url: jQuery( '.url' ).val(),
 			choice: jQuery( 'input[name="choice"]:checked' ).val(),
-			interested: jQuery( 'input[name="interested"]:checked' ).val(),
-			wp_nonce: RTMedia_Admin_Settings_JS?.rtmedia_buddypress_convert_nonce ?? ''
+			interested: jQuery( 'input[name="interested"]:checked' ).val()
 		};
-		
 		jQuery.post( ajaxurl, data, function ( response ) {
 			var p_data = {
 				msg :response,
diff --git a/app/assets/js/rtMedia.backbone.js b/app/assets/js/rtMedia.backbone.js
@@ -256,7 +256,6 @@ jQuery(function ($) {
             backbone: true,
             is_album: o_is_album,
             is_edit_allowed: o_is_edit_allowed,
-            wp_nonce: rtmedia_backbone_strings?.rtmedia_album_gallery_nonce,
           },
           function () {
             rtmedia_load_template_flag = false;
diff --git a/app/helper/RTMediaSettings.php b/app/helper/RTMediaSettings.php
@@ -20,17 +20,12 @@ class RTMediaSettings {
 		 * @access public
 		 */
 		public function __construct() {
-
+			// todo: nonce required.
 			if ( ! ( defined( 'DOING_AJAX' ) && DOING_AJAX ) ) {
 				add_action( 'admin_init', array( $this, 'settings' ) );
 
-				$rtmedia_option_save = filter_input( INPUT_POST, 'rtmedia-options-save', FILTER_SANITIZE_FULL_SPECIAL_CHARS ); // phpcs:ignore WordPress.Security.NonceVerification.NoNonceVerification, WordPress.Security.NonceVerification.Missing -- Not required since we are only checking if it is a save action.
+				$rtmedia_option_save = filter_input( INPUT_POST, 'rtmedia-options-save', FILTER_SANITIZE_FULL_SPECIAL_CHARS );
 				if ( isset( $rtmedia_option_save ) ) {
-					
-					if( ! isset( $_POST ) || !array_key_exists( 'wp_nonce', $_POST ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['wp_nonce'] ) ), 'rtmedia_settings' ) ) {
-						return;
-					}
-
 					add_action( 'init', array( $this, 'settings' ) );
 				}
 			}
@@ -213,15 +208,15 @@ public function sanitize_before_save_options( $options ) {
 		 * @return void
 		 */
 		public function settings() {
-			
+			// todo: nonce required.
 			global $rtmedia, $rtmedia_addon, $rtmedia_save_setting_single;
 			$options          = rtmedia_get_site_option( 'rtmedia-options' );
 			$options          = $this->sanitize_options( $options );
 			$rtmedia->options = $options;
 			// Save Settings first then proceed.
-			$rtmedia_option_save = filter_input( INPUT_POST, 'rtmedia-options-save', FILTER_SANITIZE_FULL_SPECIAL_CHARS ); // phpcs:ignore WordPress.Security.NonceVerification.NoNonceVerification, WordPress.Security.NonceVerification.Missing -- Not required since it is the responsibility of caller function to verify nonce.
+			$rtmedia_option_save = filter_input( INPUT_POST, 'rtmedia-options-save', FILTER_SANITIZE_FULL_SPECIAL_CHARS );
 			if ( isset( $rtmedia_option_save ) && current_user_can( 'manage_options' ) ) {
-				$options               = filter_input( INPUT_POST, 'rtmedia-options', FILTER_DEFAULT, FILTER_REQUIRE_ARRAY ); // phpcs:ignore WordPress.Security.NonceVerification.NoNonceVerification, WordPress.Security.NonceVerification.Missing -- Not required since it is the responsibility of caller function to verify nonce.
+				$options               = filter_input( INPUT_POST, 'rtmedia-options', FILTER_DEFAULT, FILTER_REQUIRE_ARRAY );
 				$options               = $this->sanitize_before_save_options( $options );
 				$options               = apply_filters( 'rtmedia_pro_options_save_settings', $options );
 				$is_rewrite_rule_flush = apply_filters( 'rtmedia_flush_rewrite_rule', false );
@@ -231,7 +226,7 @@ public function settings() {
 					flush_rewrite_rules( false );
 				}
 				$settings_saved = '';
-				$setting_save   = filter_input( INPUT_GET, 'settings-saved', FILTER_SANITIZE_FULL_SPECIAL_CHARS ); // phpcs:ignore WordPress.Security.NonceVerification.NoNonceVerification, WordPress.Security.NonceVerification.Missing -- Not required since it is the responsibility of caller function to verify nonce.
+				$setting_save   = filter_input( INPUT_GET, 'settings-saved', FILTER_SANITIZE_FULL_SPECIAL_CHARS );
 				if ( ! isset( $setting_save ) ) {
 					$settings_saved = '&settings-saved=true';
 				}
@@ -410,7 +405,7 @@ public function sanitize( $input ) {
 				rtmedia_update_site_option( 'rtm-settings-saved', esc_html__( 'Settings saved.', 'buddypress-media' ) );
 			}
 
-			do_action( 'rtmedia_sanitize_settings', $_POST, $input ); // phpcs:ignore WordPress.Security.NonceVerification.NoNonceVerification, WordPress.Security.NonceVerification.Missing -- Not required since this function is responsible only for sanitization of data.
+			do_action( 'rtmedia_sanitize_settings', $_POST, $input ); // phpcs:ignore WordPress.Security.NonceVerification.NoNonceVerification, WordPress.Security.NonceVerification.Missing
 
 			return $input;
 		}
diff --git a/app/helper/RTMediaSupport.php b/app/helper/RTMediaSupport.php
@@ -179,7 +179,7 @@ public function render_support( $page = '' ) {
 		 * @return void
 		 */
 		public function service_selector() {
-			// phpcs:ignore WordPress.Security.NonceVerification.NoNonceVerification, WordPress.Security.NonceVerification.Missing -- Not required since we are only checking which tab is checked in the settings.
+			// todo: nonce required.
 			$form = filter_input( INPUT_POST, 'form', FILTER_SANITIZE_FULL_SPECIAL_CHARS );
 
 			include RTMEDIA_PATH . 'app/helper/templates/service-sector.php';
@@ -411,9 +411,9 @@ public function migration_html( $page = '' ) {
 		 * @return void
 		 */
 		public function get_form( $form = '' ) {
-
+			// todo: nonce required.
 			if ( empty( $form ) ) {
-				$form = filter_input( INPUT_POST, 'form' . FILTER_SANITIZE_FULL_SPECIAL_CHARS ); // phpcs:ignore WordPress.Security.NonceVerification.NoNonceVerification, WordPress.Security.NonceVerification.Missing -- Not required since we are only checking which tab is selected and send the form for it.
+				$form = filter_input( INPUT_POST, 'form' . FILTER_SANITIZE_FULL_SPECIAL_CHARS );
 				$form = isset( $form ) ? $form : 'premium_support';
 			}
 			$meta_title = '';
diff --git a/app/main/RTMedia.php b/app/main/RTMedia.php
@@ -1121,15 +1121,16 @@ public static function load_translation() {
 	 * @return bool
 	 */
 	public function check_global_album() {
+		// todo: Nonce required.
 		$album        = new RTMediaAlbum();
 		$global_album = $album->get_default();
 
-		$action = sanitize_text_field( filter_input( INPUT_POST, 'action', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.NoNonceVerification -- We are just intercepting if a action is for a different kind of upload and removing a field based on it.
-		$mode   = sanitize_text_field( filter_input( INPUT_POST, 'mode', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) );   // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.NoNonceVerification -- We are just intercepting if a action is for a different kind of upload and removing a field based on it.
+		$action = sanitize_text_field( filter_input( INPUT_POST, 'action', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) );
+		$mode   = sanitize_text_field( filter_input( INPUT_POST, 'mode', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) );
 
 		// Hack for plupload default name.
 		if ( ! empty( $action ) && ! empty( $mode ) && 'file_upload' === $mode ) {
-			unset( $_POST['name'] ); // phpcs:ignore WordPress.Security.NonceVerification.NoNonceVerification, WordPress.Security.NonceVerification.Missing -- We are removing the value from the $_POST.
+			unset( $_POST['name'] ); // phpcs:ignore WordPress.Security.NonceVerification.NoNonceVerification, WordPress.Security.NonceVerification.Missing
 		}
 
 		global $rtmedia_error;
@@ -1490,8 +1491,7 @@ public function enqueue_scripts_styles() {
 
 		// Localizing strings for rtMedia.backbone.js.
 		$rtmedia_backbone_strings = array(
-			'rtm_edit_file_name'          => esc_html__( 'Edit File Name', 'buddypress-media' ),
-			'rtmedia_album_gallery_nonce' => wp_create_nonce( 'rtmedia_album_gallery' ),
+			'rtm_edit_file_name' => esc_html__( 'Edit File Name', 'buddypress-media' ),
 		);
 
 		// Localise fot rtmedia-backcone js.
diff --git a/app/main/controllers/activity/RTMediaBuddyPressActivity.php b/app/main/controllers/activity/RTMediaBuddyPressActivity.php
@@ -1493,7 +1493,8 @@ public function bp_before_activity_post_update_parse_args( $args ) {
 		// if content is non-breaking space then set it to empty.
 		if ( isset( $args['content'] ) && '' === $args['content'] ) {
 
-			if ( ! empty( $_POST['rtMedia_attached_files'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Not needed since we  are only checking if the field exists and it is done already.
+			// Nonce verification is not required here as it is already done in previously.
+			if ( ! empty( $_POST['rtMedia_attached_files'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
 				$args['content'] = '&nbsp;';
 			}
 		}
diff --git a/app/main/controllers/api/RTMediaJsonApi.php b/app/main/controllers/api/RTMediaJsonApi.php
@@ -1082,11 +1082,11 @@ public function rtmedia_api_process_update_avatar_request() {
 		$ec_avatar_updated  = 130003;
 		$msg_avatar_updated = esc_html__( 'avatar updated', 'buddypress-media' );
 
-		if ( empty( $_FILES['file'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Not needed since we are only checking if the value exists.
+		if ( empty( $_FILES['file'] ) ) {
 			wp_send_json( $this->rtmedia_api_response_object( 'FALSE', $ec_no_file, $msg_no_file ) );
 		}
 
-		$uploaded = bp_core_avatar_handle_upload( $_FILES, 'xprofile_avatar_upload_dir' ); // phpcs:ignore WordPress.Security.NonceVerification.Missing -- It is verified by the external plugin function.
+		$uploaded = bp_core_avatar_handle_upload( $_FILES, 'xprofile_avatar_upload_dir' );
 		if ( ! $uploaded ) {
 			wp_send_json( $this->rtmedia_api_response_object( 'FALSE', $ec_invalid_image, $msg_invalid_image ) );
 		} else {
@@ -1139,7 +1139,7 @@ public function rtmedia_api_process_rtmedia_upload_media_request() {
 		$updated       = false;
 		$uploaded_look = false;
 
-		if ( empty( $rtmedia_file ) && empty( $_FILES['rtmedia_file'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing -- We are only checking presence of a data.
+		if ( empty( $rtmedia_file ) && empty( $_FILES['rtmedia_file'] ) ) {
 			wp_send_json( $this->rtmedia_api_response_object( 'FALSE', $ec_no_file, $msg_no_file ) );
 		}
 
@@ -1154,7 +1154,7 @@ public function rtmedia_api_process_rtmedia_upload_media_request() {
 			}
 		}
 
-		if ( ! empty( $_FILES['rtmedia_file'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing -- We are only checking presence of a data.
+		if ( ! empty( $_FILES['rtmedia_file'] ) ) {
 			// phpcs:disable Squiz.PHP.DisallowMultipleAssignments.Found, WordPress.Security.NonceVerification.NoNonceVerification
 			$_POST['rtmedia_upload_nonce']       = $_REQUEST['rtmedia_upload_nonce'] = wp_create_nonce( 'rtmedia_upload_nonce' );
 			$_POST['rtmedia_simple_file_upload'] = $_REQUEST['rtmedia_simple_file_upload'] = 1;
diff --git a/app/main/controllers/group/RTMediaBuddyPressGroupActivity.php b/app/main/controllers/group/RTMediaBuddyPressGroupActivity.php
@@ -32,7 +32,8 @@ public function bp_before_groups_post_update_parse_args( $args ) {
 		// if content is non-breaking space then set it to empty.
 		if ( isset( $args['content'] ) && '' === $args['content'] ) {
 
-			if ( ! empty( $_POST['rtMedia_attached_files'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Not needed since we  are only checking if the field exists and it is done already.
+			// Nonce verification is not required here as it is already done in previously.
+			if ( ! empty( $_POST['rtMedia_attached_files'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
 				$args['content'] = '&nbsp;';
 			}
 		}
diff --git a/app/main/controllers/media/RTMediaAlbum.php b/app/main/controllers/media/RTMediaAlbum.php
@@ -207,7 +207,7 @@ public function add( $title = '', $author_id = false, $new = true, $post_id = fa
 			'privacy'      => null,
 		);
 
-		$attributes  = apply_filters( 'rtmedia_before_save_album_attributes', $attributes, $_POST ); // phpcs:ignore WordPress.Security.NonceVerification.NoNonceVerification, WordPress.Security.NonceVerification.Missing -- It is the responsibility of the calling function to implement nonce verification.
+		$attributes  = apply_filters( 'rtmedia_before_save_album_attributes', $attributes, $_POST ); // phpcs:ignore WordPress.Security.NonceVerification.NoNonceVerification, WordPress.Security.NonceVerification.Missing
 		$rtmedia_id  = $this->media->insert_album( $attributes );
 		$rtmedia_nav = new RTMediaNav();
 		$media_count = $rtmedia_nav->refresh_counts(
diff --git a/app/main/controllers/shortcodes/RTMediaGalleryShortcode.php b/app/main/controllers/shortcodes/RTMediaGalleryShortcode.php
@@ -78,20 +78,17 @@ public static function register_scripts() {
 				array(
 					'action'   => 'rtmedia_get_template',
 					'template' => 'album-gallery-item',
-					'wp_nonce' => wp_create_nonce( 'rtmedia_album_gallery' ),
 				)
 			);
 
 			$template_url = esc_url( add_query_arg( $album_template_args, admin_url( 'admin-ajax.php' ) ), null, '' );
-			
 		} else {
 
 			$media_template_args = apply_filters(
 				'media_template_args',
 				array(
 					'action'   => 'rtmedia_get_template',
 					'template' => apply_filters( 'rtmedia_backbone_template_filter', 'media-gallery-item' ),
-					'wp_nonce' => wp_create_nonce( 'rtmedia_album_gallery' ),
 				)
 			);
 
@@ -233,7 +230,6 @@ public static function render( $attr ) {
 					array(
 						'action'   => 'rtmedia_get_template',
 						'template' => 'album-gallery-item',
-						'wp_nonce' => wp_create_nonce( 'rtmedia_album_gallery' ),
 					)
 				);
 
@@ -245,7 +241,6 @@ public static function render( $attr ) {
 					array(
 						'action'   => 'rtmedia_get_template',
 						'template' => apply_filters( 'rtmedia_backbone_template_filter', 'media-gallery-item' ),
-						'wp_nonce' => wp_create_nonce( 'rtmedia_album_gallery' ),
 					)
 				);
 
diff --git a/app/main/controllers/template/RTMediaTemplate.php b/app/main/controllers/template/RTMediaTemplate.php
@@ -324,7 +324,7 @@ public function check_return_edit() {
 		&& isset( $rtmedia_query->action_query )
 		&& isset( $rtmedia_query->action_query->action )
 		&& 'edit' === $rtmedia_query->action_query->action
-		&& count( $_POST ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.NoNonceVerification -- We are only fetching the count of elements in $_POST so nonce verification is not needed.
+		&& count( $_POST ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.NoNonceVerification
 			$this->save_edit();
 		}
 
@@ -614,7 +614,7 @@ public function check_return_delete() {
 			return;
 		}
 
-		if ( ! count( $_POST ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.NoNonceVerification -- We are only fetching the count of elements in $_POST so nonce verification is not needed.
+		if ( ! count( $_POST ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.NoNonceVerification
 			return;
 		}
 
diff --git a/app/main/controllers/template/rtmedia-actions.php b/app/main/controllers/template/rtmedia-actions.php
@@ -807,7 +807,7 @@ function rtmedia_addons_admin_notice() {
 
 	if ( 'rtmedia_page_rtmedia-license' === $screen->id ) {
 
-		if ( isset( $_POST ) && count( $_POST ) > 0 ) { // phpcs:ignore WordPress.Security.NonceVerification.NoNonceVerification, WordPress.Security.NonceVerification.Missing -- We are only fetching the count of elements in $_POST so nonce verification is not needed.
+		if ( isset( $_POST ) && count( $_POST ) > 0 ) { // phpcs:ignore WordPress.Security.NonceVerification.NoNonceVerification, WordPress.Security.NonceVerification.Missing
 			?>
 			<div class="notice notice-success is-dismissible">
 				<p><?php esc_html_e( 'Settings has been saved successfully.', 'buddypress-media' ); ?></p>
diff --git a/app/main/controllers/template/rtmedia-functions.php b/app/main/controllers/template/rtmedia-functions.php
@@ -3803,7 +3803,7 @@ function rtmedia_get_allowed_upload_types_array() {
 function rtmedia_add_media( $upload_params = array() ) {
 
 	if ( empty( $upload_params ) ) {
-		$upload_params = $_POST; // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Not needed since it is only used to set the global value. It is being sanitized inside set_post_object function.
+		$upload_params = $_POST; // phpcs:ignore
 	}
 
 	$upload_model = new RTMediaUploadModel();
diff --git a/app/main/controllers/upload/RTMediaUploadEndpoint.php b/app/main/controllers/upload/RTMediaUploadEndpoint.php
@@ -35,7 +35,7 @@ public function __construct() {
 	public function template_redirect( $create_activity = true ) {
 		// todo refactor below function so it takes param also and use if passed else use POST request.
 		ob_start();
-		if ( ! count( $_POST ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Not needed since we are only counting the elements in $_POST
+		if ( ! count( $_POST ) ) { // phpcs:ignore
 			include get_404_template();
 		} else {
 
diff --git a/app/main/routers/query/RTMediaQuery.php b/app/main/routers/query/RTMediaQuery.php
@@ -608,7 +608,7 @@ public function &query( $query ) {
 		$rtmedia_shortcode = sanitize_text_field( filter_input( INPUT_GET, 'rtmedia_shortcode', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) );
 
 		if ( ! empty( $rtmedia_shortcode ) ) {
-			$query_data = $_REQUEST; // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.NoNonceVerification -- We are just replacing the args so nonce verification is not needed.
+			$query_data = $_REQUEST; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 			foreach ( $query_data as $key => $val ) {
 				if ( ! in_array( $key, $allowed_query, true ) ) {
 					unset( $query_data[ $key ] );
diff --git a/templates/media/album-gallery-item.php b/templates/media/album-gallery-item.php
@@ -13,10 +13,7 @@
 	'is_edit_allowed' => false,
 );
 
-if( ! isset( $_POST ) || !array_key_exists( 'wp_nonce', $_POST ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['wp_nonce'] ) ), 'rtmedia_album_gallery' ) ) {
-	return;
-}
-
+// todo: nonce verification.
 $rtmedia_backbone['backbone'] = filter_input( INPUT_POST, 'backbone', FILTER_VALIDATE_BOOLEAN );
 
 $is_album = filter_input( INPUT_POST, 'is_album', FILTER_DEFAULT, FILTER_REQUIRE_ARRAY );
diff --git a/templates/media/media-gallery-item.php b/templates/media/media-gallery-item.php
@@ -12,11 +12,7 @@
 	'is_album'        => false,
 	'is_edit_allowed' => false,
 );
-
-if( ! isset( $_POST ) || !array_key_exists( 'wp_nonce', $_POST ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['wp_nonce'] ) ), 'rtmedia_album_gallery' ) ) {
-	return;
-}
-
+// todo: nonce verification.
 $rtmedia_backbone['backbone'] = filter_input( INPUT_POST, 'backbone', FILTER_VALIDATE_BOOLEAN );
 
 $is_album = filter_input( INPUT_POST, 'is_album', FILTER_DEFAULT, FILTER_REQUIRE_ARRAY );

Original file line number	Diff line number	Diff line change
`@@ -1493,7 +1493,8 @@ public function bp_before_activity_post_update_parse_args( $args ) {`
`1493`	`1493`	`// if content is non-breaking space then set it to empty.`
`1494`	`1494`	`if ( isset( $args['content'] ) && '' === $args['content'] ) {`
`1495`	`1495`
`1496`		`- if ( ! empty( $_POST['rtMedia_attached_files'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Not needed since we are only checking if the field exists and it is done already.`
	`1496`	`+ // Nonce verification is not required here as it is already done in previously.`
	`1497`	`+ if ( ! empty( $_POST['rtMedia_attached_files'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing`
`1497`	`1498`	`$args['content'] = ' ';`
`1498`	`1499`	`}`
`1499`	`1500`	`}`
Original file line number	Diff line number	Diff line change
`@@ -32,7 +32,8 @@ public function bp_before_groups_post_update_parse_args( $args ) {`
`32`	`32`	`// if content is non-breaking space then set it to empty.`
`33`	`33`	`if ( isset( $args['content'] ) && '' === $args['content'] ) {`
`34`	`34`
`35`		`- if ( ! empty( $_POST['rtMedia_attached_files'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Not needed since we are only checking if the field exists and it is done already.`
	`35`	`+ // Nonce verification is not required here as it is already done in previously.`
	`36`	`+ if ( ! empty( $_POST['rtMedia_attached_files'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing`
`36`	`37`	`$args['content'] = ' ';`
`37`	`38`	`}`
`38`	`39`	`}`