5 files changed, 42 insertions, 13 deletions

diff --git a/modules/gallery/helpers/MY_url.php b/modules/gallery/helpers/MY_url.php
index 74284951..8a7909b6 100644
--- a/modules/gallery/helpers/MY_url.php
+++ b/modules/gallery/helpers/MY_url.php
@@ -89,4 +89,18 @@ class url extends url_Core {
   static function abs_current($qs=false) {
     return self::abs_site(url::current($qs));
   }
+
+  /**
+   * Just like url::merge except that it escapes any XSS in the path.
+   */
+  static function merge($params) {
+    return htmlspecialchars(parent::merge($params));
+  }
+
+  /**
+   * Just like url::current except that it escapes any XSS in the path.
+   */
+  static function current($qs=false, $suffix=false) {
+    return htmlspecialchars(parent::current($qs, $suffix));
+  }
 }
diff --git a/modules/gallery/helpers/access.php b/modules/gallery/helpers/access.php
index 8ce7e436..e0a0e979 100644
--- a/modules/gallery/helpers/access.php
+++ b/modules/gallery/helpers/access.php
@@ -66,8 +66,8 @@
  *   the Access_Intent_Model
  */
 class access_Core {
-  const DENY      = false;
-  const ALLOW     = true;
+  const DENY      = "0";
+  const ALLOW     = "1";
   const INHERIT   = null; // access_intent
   const UNKNOWN   = null; // cache (access_cache, items)
 
diff --git a/modules/gallery/helpers/gallery_installer.php b/modules/gallery/helpers/gallery_installer.php
index 410b6413..1e0ad28c 100644
--- a/modules/gallery/helpers/gallery_installer.php
+++ b/modules/gallery/helpers/gallery_installer.php
@@ -240,7 +240,7 @@ class gallery_installer {
       100);
     graphics::add_rule(
       "gallery", "resize", "gallery_graphics::resize",
-      array("width" => 640, "height" => 480, "master" => Image::AUTO),
+      array("width" => 640, "height" => 640, "master" => Image::AUTO),
       100);
 
     // Instantiate default themes (site and admin)
@@ -440,6 +440,22 @@ class gallery_installer {
       module::set_var("gallery", "simultaneous_upload_limit", 5);
       module::set_version("gallery", $version = 21);
     }
+
+    // Update the graphics rules table so that the maximum height for resizes is 640 not 480.
+    // Fixes ticket #671
+    if ( $version == 21) {
+      $resize_rule = ORM::factory("graphics_rule")
+        ->where("id", "=", "2")
+        ->find();
+      // make sure it hasn't been changed already
+      $args = unserialize($resize_rule->args);
+      if ($args["height"] == 480 && $args["width"] == 640) {
+        $args["height"] = 640;
+        $resize_rule->args = serialize($args);
+        $resize_rule->save();
+      }
+      module::set_version("gallery", $version = 22);
+    }
   }
 
   static function uninstall() {
diff --git a/modules/gallery/helpers/graphics.php b/modules/gallery/helpers/graphics.php
index 7577d7ac..5a290905 100644
--- a/modules/gallery/helpers/graphics.php
+++ b/modules/gallery/helpers/graphics.php
@@ -60,11 +60,12 @@ class graphics_Core {
    * @param string  $operation   the name of the operation(<defining class>::method)
    */
   static function remove_rule($module_name, $target, $operation) {
-    ORM::factory("graphics_rule")
+    db::build()
+      ->delete("graphics_rules")
       ->where("module_name", "=", $module_name)
       ->where("target", "=", $target)
       ->where("operation", "=", $operation)
-      ->delete_all();
+      ->execute();
 
     self::mark_dirty($target == "thumb", $target == "resize");
   }
diff --git a/modules/gallery/helpers/model_cache.php b/modules/gallery/helpers/model_cache.php
index 302e42d9..88756407 100644
--- a/modules/gallery/helpers/model_cache.php
+++ b/modules/gallery/helpers/model_cache.php
@@ -18,27 +18,25 @@
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
 class model_cache_Core {
-  private static $cache;
+  private static $cache = array();
 
   static function get($model_name, $id, $field_name="id") {
-    if (TEST_MODE || empty(self::$cache->$model_name->$field_name->$id)) {
+    if (TEST_MODE || empty(self::$cache[$model_name][$field_name][$id])) {
       $model = ORM::factory($model_name)->where($field_name, "=", $id)->find();
       if (!$model->loaded()) {
         throw new Exception("@todo MISSING_MODEL $model_name:$id");
       }
-      self::$cache->$model_name->$field_name->$id = $model;
+      self::$cache[$model_name][$field_name][$id] = $model;
     }
 
-    return self::$cache->$model_name->$field_name->$id;
+    return self::$cache[$model_name][$field_name][$id];
   }
 
   static function clear() {
-    self::$cache = new stdClass();
+    self::$cache = array();
   }
 
   static function set($model) {
-    self::$cache->{$model->object_name}
-      ->{$model->primary_key}
-      ->{$model->{$model->primary_key}} = $model;
+    self::$cache[$model->object_name][$model->primary_key][$model->{$model->primary_key}] = $model;
   }
 }