4 files changed, 27 insertions, 6 deletions
diff --git a/modules/gallery/controllers/albums.php b/modules/gallery/controllers/albums.php
index 43040b67..0cfee7cd 100644
--- a/modules/gallery/controllers/albums.php
+++ b/modules/gallery/controllers/albums.php
@@ -18,7 +18,16 @@
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
 class Albums_Controller extends Items_Controller {
-  public function _show($album) {
+  public function index() {
+    $this->_show(ORM::factory("item", 1));
+  }
+
+  public function show($album) {
+    if (!is_object($album)) {
+      // show() must be public because we route to it in url::parse_url(), so make
+      // sure that we're actually receiving an object
+      Kohana::show_404();
+    }
     $page_size = module::get_var("gallery", "page_size", 9);
     if (!access::can("view", $album)) {
       if ($album->id == 1) {
diff --git a/modules/gallery/controllers/items.php b/modules/gallery/controllers/items.php
index ec3681a3..b350c5a2 100644
--- a/modules/gallery/controllers/items.php
+++ b/modules/gallery/controllers/items.php
@@ -23,10 +23,12 @@ class Items_Controller extends Controller {
     if (!$item->loaded) {
       return Kohana::show_404();
     }
+
     // Redirect to the more specific resource type, since it will render
-    // differently.  We could also just delegate here, but it feels more appropriate
-    // to have a single canonical resource mapping.
+    // differently.  We can't delegate here because we may have gotten to this
+    // page via /items/<id> which means that we don't have a type-specific controller.  Also, we
+    // want to drive a single canonical resource mapping where possible.
     access::required("view", $item);
-    return $this->_show($item);
+    url::redirect($item->abs_url());
   }
 }
diff --git a/modules/gallery/controllers/movies.php b/modules/gallery/controllers/movies.php
index 3d5eac32..575b2b60 100644
--- a/modules/gallery/controllers/movies.php
+++ b/modules/gallery/controllers/movies.php
@@ -18,7 +18,12 @@
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
 class Movies_Controller extends Items_Controller {
-  public function _show($movie) {
+  public function show($movie) {
+    if (!is_object($movie)) {
+      // show() must be public because we route to it in url::parse_url(), so make
+      // sure that we're actually receiving an object
+      Kohana::show_404();
+    }
     access::required("view", $movie);
 
     $where = array("type != " => "album");
diff --git a/modules/gallery/controllers/photos.php b/modules/gallery/controllers/photos.php
index f052eccd..ba4cfb83 100644
--- a/modules/gallery/controllers/photos.php
+++ b/modules/gallery/controllers/photos.php
@@ -18,7 +18,12 @@
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
 class Photos_Controller extends Items_Controller {
-  public function _show($photo) {
+  public function show($photo) {
+    if (!is_object($photo)) {
+      // show() must be public because we route to it in url::parse_url(), so make
+      // sure that we're actually receiving an object
+      Kohana::show_404();
+    }
     access::required("view", $photo);
 
     $where = array("type != " => "album");