Fix security vulnerabilities SQLi and 2x Broken Access Control

[the-hercules]

Summary

Fixes the 3 security vulnerabilities. Each fix is its own commit with before/after verification.

Issues fixed

1. Unauthenticated SQL Injection (CVSS 9.3) — 7b0e50fc2

On any public [rtmedia_gallery] page, ?rtmedia_shortcode=1 merges $_REQUEST
into the media query args. The compare operator for array-shaped filters
(e.g. id[compare]) was interpolated into the SQL WHERE clause after only
esc_sql(), which does not protect an operator position — allowing arbitrary
SQL. Verified time-based (SLEEP) and boolean-blind extraction of
wp_users.user_pass over unauthenticated HTTP.

Fix: validate compare against a fixed allowlist of SQL operators
(shared helper RTDBModel::sanitize_sql_compare_operator(), applied to every
sink: RTMediaModel::get(), get_counts(), the meta_query branch, and the
base RTDBModel::get()); escape the value in the IS NOT branch; reject
array-shaped values from the $_REQUEST merge so public params are scalar-only.

2. Broken Access Control — rtMedia privacy bypass via JSON/Mobile API — 88e2d1115

rtMedia's privacy filter is only registered when RTMediaQuery is constructed
during normal page rendering. The JSON/mobile API never constructs it, so
rtmedia_get_media_details returned any media by numeric ID — including
another user's Private media with a direct download URL — to any authenticated
API caller. IDs are small sequential integers, making site-wide enumeration
of private media trivial.

Fix: explicit authorization check (rtmedia_api_current_user_can_view_media())
mirroring RTMediaQuery::privacy_filter()'s tiers (admin / public / logged-in /
owner / friends) before returning media; response is scoped to only the
requested media id (a sibling media/comments in the same activity can no
longer leak); fixed two related bugs in the comments lookup found during the fix
(wrong get_comments() arg key, uninitialized array).

3. Broken Access Control — arbitrary album/author/group injection on upload — 987efeca4

The upload pipeline trusted client-supplied album_id, media_author,
context/context_id from raw $_POST; the only gate, has_album_permissions(),
was a permanent stub returning true. Any authenticated user could inject
media into another user's (including private) album, attribute media to
another user, or upload into a BuddyPress group they were not a member of —
via the front-end upload flow, the comment-media flow, and the JSON API.

Fix: implemented real album/context/group authorization (owner, global
album, group membership via the existing rtm_can_user_upload_in_group
filter, or admin); force media_author to the acting user; clamp privacy
to the valid set; re-authorize at the final upload boundary so later
reassignment (e.g. via comment_media_activity_id) can't bypass the check;
applied the same checks to the JSON API's base64 upload path.

Verification

• PHP lint clean on all changed files.
• Each fix reproduced against a live local WP + BuddyPress + rtMedia install
  before the fix (exploit confirmed), then re-verified after

Not included in this PR

• WordPress.org Plugin Check findings (coding-standards scan, ~372 errors /
  649 warnings) — mostly pre-existing legacy issues unrelated to these 3
  vulnerabilities;
• Version bump / readme "Tested up to" update — tracked separately for the
  final resubmission commit.

[rtBot]

Unable to PHPCS or SVG scan one or more files due to error running PHPCS/SVG scanner:

• app/helper/RTMediaModel.php
• app/helper/db/RTDBModel.php
• app/main/controllers/api/RTMediaJsonApi.php
• app/main/controllers/api/RTMediaJsonApiFunctions.php
• app/main/controllers/upload/RTMediaUploadEndpoint.php
• app/main/controllers/upload/RTMediaUploadModel.php
• app/main/routers/query/RTMediaQuery.php

The error may be temporary. If the error persists, please contact a human (commit-ID: 987efec).