Don't allow albums/photos/movies to end in "." because it risks

securit issues (and so Kohana won't route them, see
http://dev.kohanaphp.com/issues/684).

Partial fix for ticket #248.

3 files changed, 23 insertions, 1 deletions

diff --git a/core/helpers/album.php b/core/helpers/album.php
index c60527b2..1e0d1f7d 100644
--- a/core/helpers/album.php
+++ b/core/helpers/album.php
@@ -41,6 +41,12 @@ class album_Core {
       throw new Exception("@todo NAME_CANNOT_CONTAIN_SLASH");
     }
 
+    // We don't allow trailing periods as a security measure
+    // ref: http://dev.kohanaphp.com/issues/684
+    if (rtrim($name, ".") != $name) {
+      throw new Exception("@todo NAME_CANNOT_END_IN_PERIOD");
+    }
+
     $album = ORM::factory("item");
     $album->type = "album";
     $album->title = $title;
diff --git a/core/helpers/movie.php b/core/helpers/movie.php
index 15ac554f..3293d4ac 100644
--- a/core/helpers/movie.php
+++ b/core/helpers/movie.php
@@ -43,6 +43,16 @@ class movie_Core {
       throw new Exception("@todo MISSING_MOVIE_FILE");
     }
 
+    if (strpos($name, "/")) {
+      throw new Exception("@todo NAME_CANNOT_CONTAIN_SLASH");
+    }
+
+    // We don't allow trailing periods as a security measure
+    // ref: http://dev.kohanaphp.com/issues/684
+    if (rtrim($name, ".") != $name) {
+      throw new Exception("@todo NAME_CANNOT_END_IN_PERIOD");
+    }
+
     $movie_info = movie::getmoviesize($filename);
 
     // Force an extension onto the name
@@ -93,7 +103,7 @@ class movie_Core {
     graphics::generate($movie);
 
     // If the parent has no cover item, make this it.
-    if ($parent->album_cover_item_id == null)  {
+    if (access::can("edit", $parent) && $parent->album_cover_item_id == null)  {
       item::make_album_cover($movie);
     }
 
diff --git a/core/helpers/photo.php b/core/helpers/photo.php
index 0015bd99..8b0e1eab 100644
--- a/core/helpers/photo.php
+++ b/core/helpers/photo.php
@@ -47,6 +47,12 @@ class photo_Core {
       throw new Exception("@todo NAME_CANNOT_CONTAIN_SLASH");
     }
 
+    // We don't allow trailing periods as a security measure
+    // ref: http://dev.kohanaphp.com/issues/684
+    if (rtrim($name, ".") != $name) {
+      throw new Exception("@todo NAME_CANNOT_END_IN_PERIOD");
+    }
+
     $image_info = getimagesize($filename);
 
     // Force an extension onto the name