Merge branch 'master' of git://github.com/gallery/gallery3

10 files changed, 369 insertions, 89 deletions

diff --git a/modules/gallery/tests/File_Proxy_Controller_Test.php b/modules/gallery/tests/File_Proxy_Controller_Test.php
index 562100e4..06068d62 100644
--- a/modules/gallery/tests/File_Proxy_Controller_Test.php
+++ b/modules/gallery/tests/File_Proxy_Controller_Test.php
@@ -66,7 +66,7 @@ class File_Proxy_Controller_Test extends Gallery_Unit_Test_Case {
   public function movie_thumbnails_are_jpgs_test() {
     $movie = test::random_movie();
     $name = legal_file::change_extension($movie->name, "jpg");
-    $_SERVER["REQUEST_URI"] = url::file("var/thumbs/{$movie->name}");
+    $_SERVER["REQUEST_URI"] = url::file("var/thumbs/$name");
     $controller = new File_Proxy_Controller();
     $this->assert_same($movie->thumb_path(), $controller->__call("", array()));
   }
diff --git a/modules/gallery/tests/Html_Helper_Test.php b/modules/gallery/tests/Html_Helper_Test.php
index 476faa5a..4643e6fd 100644
--- a/modules/gallery/tests/Html_Helper_Test.php
+++ b/modules/gallery/tests/Html_Helper_Test.php
@@ -27,7 +27,7 @@ class Html_Helper_Test extends Gallery_Unit_Test_Case {
 
   public function purify_test() {
     $safe_string = html::purify("hello <p  >world</p>");
-    $expected = method_exists("purifier", "purify")
+    $expected = (class_exists("purifier") && method_exists("purifier", "purify"))
       ? "hello <p>world</p>"
       : "hello &lt;p  &gt;world&lt;/p&gt;";
     $this->assert_equal($expected, $safe_string->unescaped());
diff --git a/modules/gallery/tests/Item_Helper_Test.php b/modules/gallery/tests/Item_Helper_Test.php
index f5b99bec..f4995c53 100644
--- a/modules/gallery/tests/Item_Helper_Test.php
+++ b/modules/gallery/tests/Item_Helper_Test.php
@@ -164,11 +164,9 @@ class Item_Helper_Test extends Gallery_Unit_Test_Case {
     $this->assert_same(item::root()->id, item::find_by_path("")->id);
 
     // Verify that we don't get confused by the part names, using the fallback code.
-    db::build()
-      ->update("items")
-      ->set(array("relative_path_cache" => null))
-      ->where("id", "IN", array($level3->id, $level3b->id))
-      ->execute();
+    self::_remove_relative_path_caches();
+    self::_remove_relative_path_caches();
+
     $this->assert_same(
       $level3->id,
       item::find_by_path("{$level1->name}/{$level2->name}/{$level3->name}")->id);
@@ -180,11 +178,154 @@ class Item_Helper_Test extends Gallery_Unit_Test_Case {
     // Verify that we don't get false positives
     $this->assert_false(
       item::find_by_path("foo/bar/baz")->loaded());
+  }
 
-    // Verify that the fallback code works
-    $this->assert_same(
-      $level3b->id,
-      item::find_by_path("{$level1->name}/{$level2b->name}/{$level3b->name}")->id);
+  public function find_by_path_with_jpg_test() {
+    $parent = test::random_album();
+    $jpg = test::random_photo($parent);
+
+    $jpg_path = "{$parent->name}/{$jpg->name}";
+    $flv_path = legal_file::change_extension($jpg_path, "flv");
+
+    // Check normal operation.
+    $this->assert_equal($jpg->id, item::find_by_path($jpg_path, "albums")->id);
+    $this->assert_equal($jpg->id, item::find_by_path($jpg_path, "resizes")->id);
+    $this->assert_equal($jpg->id, item::find_by_path($jpg_path, "thumbs")->id);
+    $this->assert_equal($jpg->id, item::find_by_path($jpg_path)->id);
+
+    // Check that we don't get false positives.
+    $this->assert_equal(null, item::find_by_path($flv_path, "albums")->id);
+    $this->assert_equal(null, item::find_by_path($flv_path, "resizes")->id);
+    $this->assert_equal(null, item::find_by_path($flv_path, "thumbs")->id);
+    $this->assert_equal(null, item::find_by_path($flv_path)->id);
+
+    // Check normal operation without relative path cache.
+    self::_remove_relative_path_caches();
+    $this->assert_equal($jpg->id, item::find_by_path($jpg_path, "albums")->id);
+    self::_remove_relative_path_caches();
+    $this->assert_equal($jpg->id, item::find_by_path($jpg_path, "resizes")->id);
+    self::_remove_relative_path_caches();
+    $this->assert_equal($jpg->id, item::find_by_path($jpg_path, "thumbs")->id);
+    self::_remove_relative_path_caches();
+    $this->assert_equal($jpg->id, item::find_by_path($jpg_path)->id);
+
+    // Check that we don't get false positives without relative path cache.
+    self::_remove_relative_path_caches();
+    $this->assert_equal(null, item::find_by_path($flv_path, "albums")->id);
+    $this->assert_equal(null, item::find_by_path($flv_path, "resizes")->id);
+    $this->assert_equal(null, item::find_by_path($flv_path, "thumbs")->id);
+    $this->assert_equal(null, item::find_by_path($flv_path)->id);
+  }
+
+  public function find_by_path_with_png_test() {
+    $parent = test::random_album();
+    $png = test::random_photo_unsaved($parent);
+    $png->set_data_file(MODPATH . "gallery/images/graphicsmagick.png");
+    $png->save();
+
+    $png_path = "{$parent->name}/{$png->name}";
+    $jpg_path = legal_file::change_extension($png_path, "jpg");
+
+    // Check normal operation.
+    $this->assert_equal($png->id, item::find_by_path($png_path, "albums")->id);
+    $this->assert_equal($png->id, item::find_by_path($png_path, "resizes")->id);
+    $this->assert_equal($png->id, item::find_by_path($png_path, "thumbs")->id);
+    $this->assert_equal($png->id, item::find_by_path($png_path)->id);
+
+    // Check that we don't get false positives.
+    $this->assert_equal(null, item::find_by_path($jpg_path, "albums")->id);
+    $this->assert_equal(null, item::find_by_path($jpg_path, "resizes")->id);
+    $this->assert_equal(null, item::find_by_path($jpg_path, "thumbs")->id);
+    $this->assert_equal(null, item::find_by_path($jpg_path)->id);
+
+    // Check normal operation without relative path cache.
+    self::_remove_relative_path_caches();
+    $this->assert_equal($png->id, item::find_by_path($png_path, "albums")->id);
+    self::_remove_relative_path_caches();
+    $this->assert_equal($png->id, item::find_by_path($png_path, "resizes")->id);
+    self::_remove_relative_path_caches();
+    $this->assert_equal($png->id, item::find_by_path($png_path, "thumbs")->id);
+    self::_remove_relative_path_caches();
+    $this->assert_equal($png->id, item::find_by_path($png_path)->id);
+
+    // Check that we don't get false positives without relative path cache.
+    self::_remove_relative_path_caches();
+    $this->assert_equal(null, item::find_by_path($jpg_path, "albums")->id);
+    $this->assert_equal(null, item::find_by_path($jpg_path, "resizes")->id);
+    $this->assert_equal(null, item::find_by_path($jpg_path, "thumbs")->id);
+    $this->assert_equal(null, item::find_by_path($jpg_path)->id);
+  }
+
+  public function find_by_path_with_flv_test() {
+    $parent = test::random_album();
+    $flv = test::random_movie($parent);
+
+    $flv_path = "{$parent->name}/{$flv->name}";
+    $jpg_path = legal_file::change_extension($flv_path, "jpg");
+
+    // Check normal operation.
+    $this->assert_equal($flv->id, item::find_by_path($flv_path, "albums")->id);
+    $this->assert_equal($flv->id, item::find_by_path($jpg_path, "thumbs")->id);
+    $this->assert_equal($flv->id, item::find_by_path($flv_path)->id);
+
+    // Check that we don't get false positives.
+    $this->assert_equal(null, item::find_by_path($jpg_path, "albums")->id);
+    $this->assert_equal(null, item::find_by_path($flv_path, "thumbs")->id);
+    $this->assert_equal(null, item::find_by_path($jpg_path)->id);
+
+    // Check normal operation without relative path cache.
+    self::_remove_relative_path_caches();
+    $this->assert_equal($flv->id, item::find_by_path($flv_path, "albums")->id);
+    self::_remove_relative_path_caches();
+    $this->assert_equal($flv->id, item::find_by_path($jpg_path, "thumbs")->id);
+    self::_remove_relative_path_caches();
+    $this->assert_equal($flv->id, item::find_by_path($flv_path)->id);
+
+    // Check that we don't get false positives without relative path cache.
+    self::_remove_relative_path_caches();
+    $this->assert_equal(null, item::find_by_path($jpg_path, "albums")->id);
+    $this->assert_equal(null, item::find_by_path($flv_path, "thumbs")->id);
+    $this->assert_equal(null, item::find_by_path($jpg_path)->id);
+  }
+
+  public function find_by_path_with_album_test() {
+    $parent = test::random_album();
+    $album = test::random_movie($parent);
+
+    $album_path = "{$parent->name}/{$album->name}";
+    $thumb_path = "{$album_path}/.album.jpg";
+
+    // Check normal operation.
+    $this->assert_equal($album->id, item::find_by_path($album_path, "albums")->id);
+    $this->assert_equal($album->id, item::find_by_path($thumb_path, "thumbs")->id);
+    $this->assert_equal($album->id, item::find_by_path($album_path)->id);
+
+    // Check that we don't get false positives.
+    $this->assert_equal(null, item::find_by_path($thumb_path, "albums")->id);
+    $this->assert_equal(null, item::find_by_path($album_path, "thumbs")->id);
+    $this->assert_equal(null, item::find_by_path($thumb_path)->id);
+
+    // Check normal operation without relative path cache.
+    self::_remove_relative_path_caches();
+    $this->assert_equal($album->id, item::find_by_path($album_path, "albums")->id);
+    self::_remove_relative_path_caches();
+    $this->assert_equal($album->id, item::find_by_path($thumb_path, "thumbs")->id);
+    self::_remove_relative_path_caches();
+    $this->assert_equal($album->id, item::find_by_path($album_path)->id);
+
+    // Check that we don't get false positives without relative path cache.
+    self::_remove_relative_path_caches();
+    $this->assert_equal(null, item::find_by_path($thumb_path, "albums")->id);
+    $this->assert_equal(null, item::find_by_path($album_path, "thumbs")->id);
+    $this->assert_equal(null, item::find_by_path($thumb_path)->id);
+  }
+
+  private function _remove_relative_path_caches() {
+    // This gets used *many* times in the find_by_path tests above to check the fallback code.
+    db::build()
+      ->update("items")
+      ->set("relative_path_cache", null)
+      ->execute();
   }
 
   public function find_by_relative_url_test() {
diff --git a/modules/gallery/tests/Item_Model_Test.php b/modules/gallery/tests/Item_Model_Test.php
index fcb5c2ad..b6849413 100644
--- a/modules/gallery/tests/Item_Model_Test.php
+++ b/modules/gallery/tests/Item_Model_Test.php
@@ -124,11 +124,124 @@ class Item_Model_Test extends Gallery_Unit_Test_Case {
     $this->assert_equal($fullsize_file, file_get_contents($photo->file_path()));
   }
 
-  public function item_rename_wont_accept_slash_test() {
-    $item = test::random_photo();
+  public function photo_rename_wont_accept_slash_test() {
+    $item = test::random_photo_unsaved();
     $item->name = "/no_slashes/allowed/";
+    // Should fail on validate.
+    try {
+      $item->validate();
+      $this->assert_true(false, "Shouldn't get here");
+    } catch (ORM_Validation_Exception $e) {
+      $errors = $e->validation->errors();
+      $this->assert_same("no_slashes", $errors["name"]);
+    }
+    // Should be corrected on save.
     $item->save();
     $this->assert_equal("no_slashes_allowed.jpg", $item->name);
+    // Should be corrected on update.
+    $item->name = "/no_slashes/allowed/";
+    $item->save();
+    $this->assert_equal("no_slashes_allowed.jpg", $item->name);
+  }
+
+  public function photo_rename_wont_accept_backslash_test() {
+    $item = test::random_photo_unsaved();
+    $item->name = "\\no_backslashes\\allowed\\";
+    // Should fail on validate.
+    try {
+      $item->validate();
+      $this->assert_true(false, "Shouldn't get here");
+    } catch (ORM_Validation_Exception $e) {
+      $errors = $e->validation->errors();
+      $this->assert_same("no_backslashes", $errors["name"]);
+    }
+    // Should be corrected on save.
+    $item->save();
+    $this->assert_equal("no_backslashes_allowed.jpg", $item->name);
+    // Should be corrected on update.
+    $item->name = "\\no_backslashes\\allowed\\";
+    $item->save();
+    $this->assert_equal("no_backslashes_allowed.jpg", $item->name);
+  }
+
+  public function photo_rename_wont_accept_trailing_period_test() {
+    $item = test::random_photo_unsaved();
+    $item->name = "no_trailing_period_allowed.";
+    // Should fail on validate.
+    try {
+      $item->validate();
+      $this->assert_true(false, "Shouldn't get here");
+    } catch (ORM_Validation_Exception $e) {
+      $errors = $e->validation->errors();
+      $this->assert_same("no_trailing_period", $errors["name"]);
+    }
+    // Should be corrected on save.
+    $item->save();
+    $this->assert_equal("no_trailing_period_allowed.jpg", $item->name);
+    // Should be corrected on update.
+    $item->name = "no_trailing_period_allowed.";
+    $item->save();
+    $this->assert_equal("no_trailing_period_allowed.jpg", $item->name);
+  }
+
+  public function album_rename_wont_accept_slash_test() {
+    $item = test::random_album_unsaved();
+    $item->name = "/no_album_slashes/allowed/";
+    // Should fail on validate.
+    try {
+      $item->validate();
+      $this->assert_true(false, "Shouldn't get here");
+    } catch (ORM_Validation_Exception $e) {
+      $errors = $e->validation->errors();
+      $this->assert_same("no_slashes", $errors["name"]);
+    }
+    // Should be corrected on save.
+    $item->save();
+    $this->assert_equal("no_album_slashes_allowed", $item->name);
+    // Should be corrected on update.
+    $item->name = "/no_album_slashes/allowed/";
+    $item->save();
+    $this->assert_equal("no_album_slashes_allowed", $item->name);
+  }
+
+  public function album_rename_wont_accept_backslash_test() {
+    $item = test::random_album_unsaved();
+    $item->name = "\\no_album_backslashes\\allowed\\";
+    // Should fail on validate.
+    try {
+      $item->validate();
+      $this->assert_true(false, "Shouldn't get here");
+    } catch (ORM_Validation_Exception $e) {
+      $errors = $e->validation->errors();
+      $this->assert_same("no_backslashes", $errors["name"]);
+    }
+    // Should be corrected on save.
+    $item->save();
+    $this->assert_equal("no_album_backslashes_allowed", $item->name);
+    // Should be corrected on update.
+    $item->name = "\\no_album_backslashes\\allowed\\";
+    $item->save();
+    $this->assert_equal("no_album_backslashes_allowed", $item->name);
+  }
+
+  public function album_rename_wont_accept_trailing_period_test() {
+    $item = test::random_album_unsaved();
+    $item->name = ".no_trailing_period.allowed.";
+    // Should fail on validate.
+    try {
+      $item->validate();
+      $this->assert_true(false, "Shouldn't get here");
+    } catch (ORM_Validation_Exception $e) {
+      $errors = $e->validation->errors();
+      $this->assert_same("no_trailing_period", $errors["name"]);
+    }
+    // Should be corrected on save.
+    $item->save();
+    $this->assert_equal(".no_trailing_period.allowed", $item->name);
+    // Should be corrected on update.
+    $item->name = ".no_trailing_period.allowed.";
+    $item->save();
+    $this->assert_equal(".no_trailing_period.allowed", $item->name);
   }
 
   public function move_album_test() {
@@ -362,6 +475,7 @@ class Item_Model_Test extends Gallery_Unit_Test_Case {
     $response = item::root()->as_restful_array();
     $this->assert_true($response["can_edit"]);
 
+    access::deny(identity::everybody(), "edit", item::root());
     identity::set_active_user(identity::guest());
     $response = item::root()->as_restful_array();
     $this->assert_false($response["can_edit"]);
@@ -371,6 +485,7 @@ class Item_Model_Test extends Gallery_Unit_Test_Case {
     $response = item::root()->as_restful_array();
     $this->assert_true($response["can_add"]);
 
+    access::deny(identity::everybody(), "add", item::root());
     identity::set_active_user(identity::guest());
     $response = item::root()->as_restful_array();
     $this->assert_false($response["can_add"]);
diff --git a/modules/gallery/tests/Legal_File_Helper_Test.php b/modules/gallery/tests/Legal_File_Helper_Test.php
index 7ed5214b..aab41c41 100644
--- a/modules/gallery/tests/Legal_File_Helper_Test.php
+++ b/modules/gallery/tests/Legal_File_Helper_Test.php
@@ -37,7 +37,7 @@ class Legal_File_Helper_Test extends Gallery_Unit_Test_Case {
     $this->assert_equal(null, legal_file::get_movie_types_by_extension("php.flv")); // invalid w/ .
 
     // No extension returns full array
-    $this->assert_equal(3, count(legal_file::get_movie_types_by_extension()));
+    $this->assert_equal(5, count(legal_file::get_movie_types_by_extension()));
   }
 
   public function get_types_by_extension_test() {
@@ -47,7 +47,7 @@ class Legal_File_Helper_Test extends Gallery_Unit_Test_Case {
     $this->assert_equal(null, legal_file::get_types_by_extension("php.flv"));      // invalid w/ .
 
     // No extension returns full array
-    $this->assert_equal(7, count(legal_file::get_types_by_extension()));
+    $this->assert_equal(9, count(legal_file::get_types_by_extension()));
   }
 
   public function get_photo_extensions_test() {
@@ -69,7 +69,7 @@ class Legal_File_Helper_Test extends Gallery_Unit_Test_Case {
     $this->assert_equal(false, legal_file::get_movie_extensions("php.jpg")); // invalid w/ .
 
     // No extension returns full array
-    $this->assert_equal(3, count(legal_file::get_movie_extensions()));
+    $this->assert_equal(5, count(legal_file::get_movie_extensions()));
   }
 
   public function get_extensions_test() {
@@ -79,12 +79,12 @@ class Legal_File_Helper_Test extends Gallery_Unit_Test_Case {
     $this->assert_equal(false, legal_file::get_extensions("php.jpg")); // invalid w/ .
 
     // No extension returns full array
-    $this->assert_equal(7, count(legal_file::get_extensions()));
+    $this->assert_equal(9, count(legal_file::get_extensions()));
   }
 
   public function get_filters_test() {
-    // All 7 extensions both uppercase and lowercase
-    $this->assert_equal(14, count(legal_file::get_filters()));
+    // All 9 extensions both uppercase and lowercase
+    $this->assert_equal(18, count(legal_file::get_filters()));
   }
 
   public function get_photo_types_test() {
@@ -94,7 +94,7 @@ class Legal_File_Helper_Test extends Gallery_Unit_Test_Case {
 
   public function get_movie_types_test() {
     // Note that this is one *more* than movie extensions since video/flv is added.
-    $this->assert_equal(4, count(legal_file::get_movie_types()));
+    $this->assert_equal(6, count(legal_file::get_movie_types()));
   }
 
   public function change_extension_test() {
@@ -194,4 +194,22 @@ class Legal_File_Helper_Test extends Gallery_Unit_Test_Case {
       }
     }
   }
+
+  public function sanitize_dirname_with_no_rename_test() {
+    $this->assert_equal("foo", legal_file::sanitize_dirname("foo"));
+    $this->assert_equal("foo.bar", legal_file::sanitize_dirname("foo.bar"));
+    $this->assert_equal(".foo.bar...baz", legal_file::sanitize_dirname(".foo.bar...baz"));
+    $this->assert_equal("foo bar  spaces", legal_file::sanitize_dirname("foo bar  spaces"));
+    $this->assert_equal("j'écris@un#nom_bizarre(mais quand_même_ça_passe \$ÇÀ@€",
+      legal_file::sanitize_dirname("j'écris@un#nom_bizarre(mais quand_même_ça_passe \$ÇÀ@€"));
+  }
+
+  public function sanitize_filename_with_corrections_test() {
+    $this->assert_equal("foo_bar", legal_file::sanitize_dirname("/foo/bar/"));
+    $this->assert_equal("foo_bar", legal_file::sanitize_dirname("\\foo\\bar\\"));
+    $this->assert_equal(".foo..bar", legal_file::sanitize_dirname(".foo..bar."));
+    $this->assert_equal("foo_bar", legal_file::sanitize_dirname("_foo__bar_"));
+    $this->assert_equal("album", legal_file::sanitize_dirname("_"));
+    $this->assert_equal("album", legal_file::sanitize_dirname(null));
+  }
 }
\ No newline at end of file
diff --git a/modules/gallery/tests/Movie_Helper_Test.php b/modules/gallery/tests/Movie_Helper_Test.php
index 03fa2da9..9107827a 100644
--- a/modules/gallery/tests/Movie_Helper_Test.php
+++ b/modules/gallery/tests/Movie_Helper_Test.php
@@ -71,6 +71,7 @@ class Movie_Helper_Test extends Gallery_Unit_Test_Case {
     } catch (Exception $e) {
       // pass
     }
+    unlink(TMPPATH . "test_flv_with_no_extension");
   }
 
   public function get_file_metadata_with_illegal_extension_test() {
@@ -91,6 +92,7 @@ class Movie_Helper_Test extends Gallery_Unit_Test_Case {
     } catch (Exception $e) {
       // pass
     }
+    unlink(TMPPATH . "test_flv_with_php_extension.php");
   }
 
   public function get_file_metadata_with_valid_extension_but_illegal_file_contents_test() {
@@ -101,5 +103,6 @@ class Movie_Helper_Test extends Gallery_Unit_Test_Case {
     // therefore will never be executed.
     $this->assert_equal(array(0, 0, "video/x-flv", "flv", 0),
                         movie::get_file_metadata(TMPPATH . "test_php_with_flv_extension.flv"));
+    unlink(TMPPATH . "test_php_with_flv_extension.flv");
   }
 }
diff --git a/modules/gallery/tests/Photo_Helper_Test.php b/modules/gallery/tests/Photo_Helper_Test.php
index 79b5ccfd..7ba8324f 100644
--- a/modules/gallery/tests/Photo_Helper_Test.php
+++ b/modules/gallery/tests/Photo_Helper_Test.php
@@ -37,6 +37,7 @@ class Photo_Helper_Test extends Gallery_Unit_Test_Case {
     copy(MODPATH . "gallery/tests/test.jpg", TMPPATH . "test_jpg_with_no_extension");
     $this->assert_equal(array(1024, 768, "image/jpeg", "jpg"),
                         photo::get_file_metadata(TMPPATH . "test_jpg_with_no_extension"));
+    unlink(TMPPATH . "test_jpg_with_no_extension");
   }
 
   public function get_file_metadata_with_illegal_extension_test() {
@@ -56,6 +57,7 @@ class Photo_Helper_Test extends Gallery_Unit_Test_Case {
     copy(MODPATH . "gallery/tests/test.jpg", TMPPATH . "test_jpg_with_php_extension.php");
     $this->assert_equal(array(1024, 768, "image/jpeg", "jpg"),
                         photo::get_file_metadata(TMPPATH . "test_jpg_with_php_extension.php"));
+    unlink(TMPPATH . "test_jpg_with_php_extension.php");
   }
 
   public function get_file_metadata_with_valid_extension_but_illegal_file_contents_test() {
@@ -66,5 +68,6 @@ class Photo_Helper_Test extends Gallery_Unit_Test_Case {
     } catch (Exception $e) {
       // pass
     }
+    unlink(TMPPATH . "test_php_with_jpg_extension.jpg");
   }
 }
diff --git a/modules/gallery/tests/SafeString_Test.php b/modules/gallery/tests/SafeString_Test.php
index 946410d4..dab7d7df 100644
--- a/modules/gallery/tests/SafeString_Test.php
+++ b/modules/gallery/tests/SafeString_Test.php
@@ -91,7 +91,7 @@ class SafeString_Test extends Gallery_Unit_Test_Case {
 
   public function purify_test() {
     $safe_string = SafeString::purify("hello <p  >world</p>");
-    $expected = method_exists("purifier", "purify")
+    $expected = (class_exists("purifier") && method_exists("purifier", "purify"))
       ? "hello <p>world</p>"
       : "hello &lt;p  &gt;world&lt;/p&gt;";
     $this->assert_equal($expected, $safe_string);
@@ -100,7 +100,7 @@ class SafeString_Test extends Gallery_Unit_Test_Case {
   public function purify_twice_test() {
     $safe_string = SafeString::purify("hello <p  >world</p>");
     $safe_string_2 = SafeString::purify($safe_string);
-    $expected = method_exists("purifier", "purify")
+    $expected = (class_exists("purifier") && method_exists("purifier", "purify"))
       ? "hello <p>world</p>"
       : "hello &lt;p  &gt;world&lt;/p&gt;";
     $this->assert_equal($expected, $safe_string_2);
diff --git a/modules/gallery/tests/controller_auth_data.txt b/modules/gallery/tests/controller_auth_data.txt
index 9473f9f6..4cd9f047 100644
--- a/modules/gallery/tests/controller_auth_data.txt
+++ b/modules/gallery/tests/controller_auth_data.txt
@@ -1,6 +1,5 @@
 modules/comment/controllers/admin_manage_comments.php        queue                DIRTY_CSRF
 modules/comment/helpers/comment_rss.php                      feed                 DIRTY_AUTH
-modules/digibug/controllers/digibug.php                      print_proxy          DIRTY_CSRF|DIRTY_AUTH
 modules/g2_import/controllers/admin_g2_import.php            autocomplete         DIRTY_CSRF
 modules/g2_import/controllers/g2.php                         map                  DIRTY_CSRF
 modules/gallery/controllers/admin.php                        __call               DIRTY_AUTH
diff --git a/modules/gallery/tests/xss_data.txt b/modules/gallery/tests/xss_data.txt
index 51347f86..2152858a 100644
--- a/modules/gallery/tests/xss_data.txt
+++ b/modules/gallery/tests/xss_data.txt
@@ -39,12 +39,10 @@ modules/comment/views/comments.html.php                      31  DIRTY_ATTR $com
 modules/comment/views/user_profile_comments.html.php         5   DIRTY_ATTR $comment->id
 modules/comment/views/user_profile_comments.html.php         10  DIRTY_JS $comment->item()->url()
 modules/comment/views/user_profile_comments.html.php         11  DIRTY    $comment->item()->thumb_img(array(),50)
-modules/digibug/views/digibug_form.html.php                  4   DIRTY    form::open("http://www.digibug.com/dapi/order.php")
-modules/digibug/views/digibug_form.html.php                  6   DIRTY    form::hidden($key,$value)
 modules/exif/views/exif_dialog.html.php                      14  DIRTY    $details[$i]["caption"]
 modules/exif/views/exif_dialog.html.php                      21  DIRTY    $details[$i]["caption"]
-modules/g2_import/views/admin_g2_import.html.php             7   DIRTY_JS url::site("__ARGS__")
-modules/g2_import/views/admin_g2_import.html.php             52  DIRTY    $form
+modules/g2_import/views/admin_g2_import.html.php             5   DIRTY_JS url::site("__ARGS__")
+modules/g2_import/views/admin_g2_import.html.php             47  DIRTY    $form
 modules/gallery/views/admin_advanced_settings.html.php       21  DIRTY_ATTR text::alternate("g-odd","g-even")
 modules/gallery/views/admin_block_log_entries.html.php       4   DIRTY_ATTR log::severity_class($entry->severity)
 modules/gallery/views/admin_block_log_entries.html.php       8   DIRTY_JS user_profile::url($entry->user->id)
@@ -58,7 +56,8 @@ modules/gallery/views/admin_block_photo_stream.html.php      5   DIRTY_JS $photo
 modules/gallery/views/admin_block_photo_stream.html.php      6   DIRTY    photo::img_dimensions($photo->width,$photo->height,72)
 modules/gallery/views/admin_block_photo_stream.html.php      7   DIRTY_ATTR $photo->thumb_url()
 modules/gallery/views/admin_dashboard.html.php               5   DIRTY_JS $csrf
-modules/gallery/views/admin_dashboard.html.php               35  DIRTY    $blocks
+modules/gallery/views/admin_dashboard.html.php               37  DIRTY    $obsolete_modules_message
+modules/gallery/views/admin_dashboard.html.php               42  DIRTY    $blocks
 modules/gallery/views/admin_graphics.html.php                25  DIRTY    newView("admin_graphics_none.html")
 modules/gallery/views/admin_graphics.html.php                27  DIRTY    newView("admin_graphics_$active.html",array("tk"=>$tk->$active,"is_active"=>true))
 modules/gallery/views/admin_graphics.html.php                34  DIRTY    newView("admin_graphics_$id.html",array("tk"=>$tk->$id,"is_active"=>false))
@@ -98,19 +97,21 @@ modules/gallery/views/admin_maintenance.html.php             181 DIRTY    $task-
 modules/gallery/views/admin_maintenance_show_log.html.php    8   DIRTY_JS url::site("admin/maintenance/save_log/$task->id?csrf=$csrf")
 modules/gallery/views/admin_maintenance_show_log.html.php    13  DIRTY    $task->name
 modules/gallery/views/admin_maintenance_task.html.php        75  DIRTY    $task->name
-modules/gallery/views/admin_modules.html.php                 51  DIRTY    access::csrf_form_field()
-modules/gallery/views/admin_modules.html.php                 61  DIRTY_ATTR text::alternate("g-odd","g-even")
-modules/gallery/views/admin_modules.html.php                 64  DIRTY    form::checkbox($data,'1',module::is_active($module_name))
-modules/gallery/views/admin_modules.html.php                 66  DIRTY    $module_info->version
-modules/gallery/views/admin_modules.html.php                 74  DIRTY_JS $module_info->author_url
-modules/gallery/views/admin_modules.html.php                 81  DIRTY_ATTR $module_info->author_name
-modules/gallery/views/admin_modules.html.php                 85  DIRTY    $module_info->author_name
-modules/gallery/views/admin_modules.html.php                 93  DIRTY_JS $module_info->info_url
-modules/gallery/views/admin_modules.html.php                 106 DIRTY_JS $module_info->discuss_url
+modules/gallery/views/admin_modules.html.php                 51  DIRTY    $obsolete_modules_message
+modules/gallery/views/admin_modules.html.php                 57  DIRTY    access::csrf_form_field()
+modules/gallery/views/admin_modules.html.php                 67  DIRTY_ATTR text::alternate("g-odd","g-even")
+modules/gallery/views/admin_modules.html.php                 70  DIRTY    form::checkbox($data,'1',module::is_active($module_name))
+modules/gallery/views/admin_modules.html.php                 72  DIRTY    $module_info->version
+modules/gallery/views/admin_modules.html.php                 80  DIRTY_JS $module_info->author_url
+modules/gallery/views/admin_modules.html.php                 87  DIRTY_ATTR $module_info->author_name
+modules/gallery/views/admin_modules.html.php                 91  DIRTY    $module_info->author_name
+modules/gallery/views/admin_modules.html.php                 99  DIRTY_JS $module_info->info_url
+modules/gallery/views/admin_modules.html.php                 112 DIRTY_JS $module_info->discuss_url
 modules/gallery/views/admin_modules_confirm.html.php         11  DIRTY_ATTR $css_class
 modules/gallery/views/admin_modules_confirm.html.php         11  DIRTY    $message
 modules/gallery/views/admin_modules_confirm.html.php         16  DIRTY    access::csrf_form_field()
 modules/gallery/views/admin_modules_confirm.html.php         18  DIRTY    form::hidden($module,1)
+modules/gallery/views/admin_movies.html.php                  43  DIRTY    $form
 modules/gallery/views/admin_sidebar.html.php                 50  DIRTY    $available
 modules/gallery/views/admin_sidebar.html.php                 58  DIRTY    $active
 modules/gallery/views/admin_sidebar_blocks.html.php          4   DIRTY_ATTR $ref
@@ -215,20 +216,20 @@ modules/gallery/views/menu.html.php                          18  DIRTY    $eleme
 modules/gallery/views/menu_ajax_link.html.php                3   DIRTY    $menu->css_id?"id='{$menu->css_id}'":""
 modules/gallery/views/menu_ajax_link.html.php                4   DIRTY_ATTR $menu->css_class
 modules/gallery/views/menu_ajax_link.html.php                5   DIRTY_JS $menu->url
-modules/gallery/views/menu_ajax_link.html.php                7   DIRTY    $menu->ajax_handler
+modules/gallery/views/menu_ajax_link.html.php                7   DIRTY_ATTR $menu->ajax_handler
 modules/gallery/views/menu_dialog.html.php                   3   DIRTY    $menu->css_id?"id='{$menu->css_id}'":""
 modules/gallery/views/menu_dialog.html.php                   4   DIRTY_ATTR $menu->css_class
 modules/gallery/views/menu_dialog.html.php                   5   DIRTY_JS $menu->url
 modules/gallery/views/menu_link.html.php                     3   DIRTY    $menu->css_id?"id='{$menu->css_id}'":""
 modules/gallery/views/menu_link.html.php                     4   DIRTY_ATTR $menu->css_class
 modules/gallery/views/menu_link.html.php                     5   DIRTY_JS $menu->url
-modules/gallery/views/movieplayer.html.php                   2   DIRTY    html::anchor($url,"",$attrs)
-modules/gallery/views/movieplayer.html.php                   4   DIRTY_JS $attrs["id"]
-modules/gallery/views/movieplayer.html.php                   5   DIRTY_JS $max_size
-modules/gallery/views/movieplayer.html.php                   23  DIRTY_JS url::abs_file("lib/flowplayer.swf")
-modules/gallery/views/movieplayer.html.php                   30  DIRTY_JS url::abs_file("lib/flowplayer.pseudostreaming-byterange.swf")
-modules/gallery/views/movieplayer.html.php                   48  DIRTY_JS $width
-modules/gallery/views/movieplayer.html.php                   48  DIRTY_JS $height
+modules/gallery/views/movieplayer.html.php                   2   DIRTY    html::attributes($div_attrs)
+modules/gallery/views/movieplayer.html.php                   3   DIRTY    html::attributes($video_attrs)
+modules/gallery/views/movieplayer.html.php                   4   DIRTY    html::attributes($source_attrs)
+modules/gallery/views/movieplayer.html.php                   8   DIRTY_JS $div_attrs["id"]
+modules/gallery/views/movieplayer.html.php                   10  DIRTY_JS $width
+modules/gallery/views/movieplayer.html.php                   11  DIRTY_JS $height
+modules/gallery/views/movieplayer.html.php                   14  DIRTY_JS url::abs_file("lib/mediaelementjs/")
 modules/gallery/views/permissions_browse.html.php            3   DIRTY_JS url::site("permissions/form/__ITEM__")
 modules/gallery/views/permissions_browse.html.php            16  DIRTY_JS url::site("permissions/change/__CMD__/__GROUP__/__PERM__/__ITEM__?csrf=$csrf")
 modules/gallery/views/permissions_browse.html.php            43  DIRTY_ATTR $parent->id
@@ -265,14 +266,15 @@ modules/gallery/views/quick_delete_confirm.html.php          11  DIRTY    $form
 modules/gallery/views/reauthenticate.html.php                9   DIRTY    $form
 modules/gallery/views/upgrade_checker_block.html.php         19  DIRTY    $new_version
 modules/gallery/views/upgrader.html.php                      76  DIRTY_ATTR $done?"muted":""
-modules/gallery/views/upgrader.html.php                      94  DIRTY_ATTR $done?"muted":""
-modules/gallery/views/upgrader.html.php                      102 DIRTY_ATTR $module->version==$module->code_version?"current":"upgradeable"
-modules/gallery/views/upgrader.html.php                      102 DIRTY_ATTR in_array($id,$failed)?"failed":""
-modules/gallery/views/upgrader.html.php                      103 DIRTY_ATTR $id
-modules/gallery/views/upgrader.html.php                      107 DIRTY    $module->version
-modules/gallery/views/upgrader.html.php                      110 DIRTY    $module->code_version
-modules/gallery/views/upgrader.html.php                      120 DIRTY_ATTR $done?"muted":""
-modules/gallery/views/upgrader.html.php                      123 DIRTY_ATTR $done?"muted":""
+modules/gallery/views/upgrader.html.php                      97  DIRTY    $obsolete_modules_message
+modules/gallery/views/upgrader.html.php                      103 DIRTY_ATTR $done?"muted":""
+modules/gallery/views/upgrader.html.php                      111 DIRTY_ATTR $module->version==$module->code_version?"current":"upgradeable"
+modules/gallery/views/upgrader.html.php                      111 DIRTY_ATTR in_array($id,$failed)?"failed":""
+modules/gallery/views/upgrader.html.php                      112 DIRTY_ATTR $id
+modules/gallery/views/upgrader.html.php                      116 DIRTY    $module->version
+modules/gallery/views/upgrader.html.php                      119 DIRTY    $module->code_version
+modules/gallery/views/upgrader.html.php                      129 DIRTY_ATTR $done?"muted":""
+modules/gallery/views/upgrader.html.php                      132 DIRTY_ATTR $done?"muted":""
 modules/gallery/views/user_languages_block.html.php          2   DIRTY    form::dropdown("g-select-session-locale",$installed_locales,$selected)
 modules/gallery/views/user_profile.html.php                  34  DIRTY_ATTR $user->avatar_url(40,$theme->url(,true))
 modules/gallery/views/user_profile.html.php                  43  DIRTY    $info->view
@@ -342,16 +344,15 @@ modules/rss/views/feed.mrss.php                              67  DIRTY_ATTR $ite
 modules/rss/views/feed.mrss.php                              68  DIRTY_ATTR $item->height
 modules/rss/views/feed.mrss.php                              69  DIRTY_ATTR $item->width
 modules/rss/views/rss_block.html.php                         6   DIRTY_JS rss::url($url)
-modules/search/views/search.html.php                         39  DIRTY_ATTR $item_class
-modules/search/views/search.html.php                         40  DIRTY_JS $item->url()
-modules/search/views/search.html.php                         41  DIRTY    $item->thumb_img(array("class"=>"g-thumbnail"))
 modules/search/views/search.html.php                         43  DIRTY_ATTR $item_class
-modules/search/views/search.html.php                         53  DIRTY    $theme->paginator()
-modules/search/views/search_link.html.php                    14  DIRTY_ATTR $item->id
-modules/search/views/search_link.html.php                    16  DIRTY_ATTR $item->parent_id
-modules/server_add/views/admin_server_add.html.php           8   DIRTY_JS url::site("__ARGS__")
-modules/server_add/views/admin_server_add.html.php           19  DIRTY    $form
-modules/server_add/views/admin_server_add.html.php           30  DIRTY_ATTR $id
+modules/search/views/search.html.php                         44  DIRTY_JS $item->url()
+modules/search/views/search.html.php                         45  DIRTY    $item->thumb_img(array("class"=>"g-thumbnail"))
+modules/search/views/search.html.php                         47  DIRTY_ATTR $item_class
+modules/search/views/search.html.php                         57  DIRTY    $theme->paginator()
+modules/search/views/search_link.html.php                    15  DIRTY_ATTR $album_id
+modules/server_add/views/admin_server_add.html.php           6   DIRTY_JS url::site("__ARGS__")
+modules/server_add/views/admin_server_add.html.php           14  DIRTY    $form
+modules/server_add/views/admin_server_add.html.php           25  DIRTY_ATTR $id
 modules/server_add/views/server_add_tree.html.php            20  DIRTY_ATTR is_dir($file)?"ui-icon-folder-collapsed":"ui-icon-document"
 modules/server_add/views/server_add_tree.html.php            21  DIRTY_ATTR is_dir($file)?"g-directory":"g-file"
 modules/server_add/views/server_add_tree_dialog.html.php     3   DIRTY_JS url::site("server_add/children?path=__PATH__")
@@ -359,8 +360,8 @@ modules/server_add/views/server_add_tree_dialog.html.php     4   DIRTY_JS url::s
 modules/server_add/views/server_add_tree_dialog.html.php     21  DIRTY    $tree
 modules/tag/views/admin_tags.html.php                        45  DIRTY_ATTR $tag->id
 modules/tag/views/admin_tags.html.php                        46  DIRTY    $tag->count
-modules/tag/views/tag_block.html.php                         28  DIRTY    $cloud
-modules/tag/views/tag_block.html.php                         30  DIRTY    $form
+modules/tag/views/tag_block.html.php                         26  DIRTY    $cloud
+modules/tag/views/tag_block.html.php                         28  DIRTY    $form
 modules/tag/views/tag_cloud.html.php                         4   DIRTY_ATTR (int)(($tag->count/$max_count)*7)
 modules/tag/views/tag_cloud.html.php                         5   DIRTY    $tag->count
 modules/tag/views/tag_cloud.html.php                         6   DIRTY_JS $tag->url()
@@ -387,19 +388,19 @@ modules/watermark/views/admin_watermarks.html.php            20  DIRTY_ATTR $url
 themes/admin_wind/views/admin.html.php                       4   DIRTY    $theme->html_attributes()
 themes/admin_wind/views/admin.html.php                       34  DIRTY    $theme->admin_head()
 themes/admin_wind/views/admin.html.php                       46  DIRTY_JS $theme->url()
-themes/admin_wind/views/admin.html.php                       51  DIRTY    $theme->get_combined("css")
-themes/admin_wind/views/admin.html.php                       54  DIRTY    $theme->get_combined("script")
-themes/admin_wind/views/admin.html.php                       58  DIRTY    $theme->admin_page_top()
-themes/admin_wind/views/admin.html.php                       66  DIRTY    $theme->admin_header_top()
-themes/admin_wind/views/admin.html.php                       67  DIRTY_JS item::root()->url()
-themes/admin_wind/views/admin.html.php                       70  DIRTY    $theme->user_menu()
-themes/admin_wind/views/admin.html.php                       73  DIRTY    $theme->admin_menu()
-themes/admin_wind/views/admin.html.php                       76  DIRTY    $theme->admin_header_bottom()
-themes/admin_wind/views/admin.html.php                       83  DIRTY    $content
-themes/admin_wind/views/admin.html.php                       89  DIRTY    $sidebar
-themes/admin_wind/views/admin.html.php                       94  DIRTY    $theme->admin_footer()
-themes/admin_wind/views/admin.html.php                       97  DIRTY    $theme->admin_credits()
-themes/admin_wind/views/admin.html.php                       102 DIRTY    $theme->admin_page_bottom()
+themes/admin_wind/views/admin.html.php                       50  DIRTY    $theme->get_combined("css")
+themes/admin_wind/views/admin.html.php                       51  DIRTY    $theme->get_combined("script")
+themes/admin_wind/views/admin.html.php                       55  DIRTY    $theme->admin_page_top()
+themes/admin_wind/views/admin.html.php                       63  DIRTY    $theme->admin_header_top()
+themes/admin_wind/views/admin.html.php                       64  DIRTY_JS item::root()->url()
+themes/admin_wind/views/admin.html.php                       67  DIRTY    $theme->user_menu()
+themes/admin_wind/views/admin.html.php                       70  DIRTY    $theme->admin_menu()
+themes/admin_wind/views/admin.html.php                       73  DIRTY    $theme->admin_header_bottom()
+themes/admin_wind/views/admin.html.php                       80  DIRTY    $content
+themes/admin_wind/views/admin.html.php                       86  DIRTY    $sidebar
+themes/admin_wind/views/admin.html.php                       91  DIRTY    $theme->admin_footer()
+themes/admin_wind/views/admin.html.php                       94  DIRTY    $theme->admin_credits()
+themes/admin_wind/views/admin.html.php                       99  DIRTY    $theme->admin_page_bottom()
 themes/admin_wind/views/block.html.php                       3   DIRTY_ATTR $anchor
 themes/admin_wind/views/block.html.php                       5   DIRTY    $id
 themes/admin_wind/views/block.html.php                       5   DIRTY_ATTR $css_id
@@ -434,18 +435,18 @@ themes/wind/views/page.html.php                              10  DIRTY    $page_
 themes/wind/views/page.html.php                              32  DIRTY    $new_width
 themes/wind/views/page.html.php                              33  DIRTY    $new_height
 themes/wind/views/page.html.php                              34  DIRTY    $thumb_proportion
-themes/wind/views/page.html.php                              74  DIRTY_JS $theme->url()
-themes/wind/views/page.html.php                              79  DIRTY    $theme->get_combined("css")
-themes/wind/views/page.html.php                              82  DIRTY    $theme->get_combined("script")
-themes/wind/views/page.html.php                              92  DIRTY    $header_text
-themes/wind/views/page.html.php                              94  DIRTY_JS item::root()->url()
-themes/wind/views/page.html.php                              98  DIRTY    $theme->user_menu()
-themes/wind/views/page.html.php                              113 DIRTY_ATTR $breadcrumb->last?"g-active":""
-themes/wind/views/page.html.php                              114 DIRTY_ATTR $breadcrumb->first?"g-first":""
-themes/wind/views/page.html.php                              115 DIRTY_JS $breadcrumb->url
-themes/wind/views/page.html.php                              128 DIRTY    $content
-themes/wind/views/page.html.php                              134 DIRTY    newView("sidebar.html")
-themes/wind/views/page.html.php                              141 DIRTY    $footer_text
+themes/wind/views/page.html.php                              68  DIRTY_JS $theme->url()
+themes/wind/views/page.html.php                              72  DIRTY    $theme->get_combined("css")
+themes/wind/views/page.html.php                              73  DIRTY    $theme->get_combined("script")
+themes/wind/views/page.html.php                              83  DIRTY    $header_text
+themes/wind/views/page.html.php                              85  DIRTY_JS item::root()->url()
+themes/wind/views/page.html.php                              89  DIRTY    $theme->user_menu()
+themes/wind/views/page.html.php                              104 DIRTY_ATTR $breadcrumb->last?"g-active":""
+themes/wind/views/page.html.php                              105 DIRTY_ATTR $breadcrumb->first?"g-first":""
+themes/wind/views/page.html.php                              106 DIRTY_JS $breadcrumb->url
+themes/wind/views/page.html.php                              119 DIRTY    $content
+themes/wind/views/page.html.php                              125 DIRTY    newView("sidebar.html")
+themes/wind/views/page.html.php                              132 DIRTY    $footer_text
 themes/wind/views/paginator.html.php                         33  DIRTY_JS $first_page_url
 themes/wind/views/paginator.html.php                         42  DIRTY_JS $previous_page_url
 themes/wind/views/paginator.html.php                         70  DIRTY_JS $next_page_url