3 files changed, 22 insertions, 10 deletions
diff --git a/modules/gallery/helpers/MY_url.php b/modules/gallery/helpers/MY_url.php
index 74284951..8a7909b6 100644
--- a/modules/gallery/helpers/MY_url.php
+++ b/modules/gallery/helpers/MY_url.php
@@ -89,4 +89,18 @@ class url extends url_Core {
   static function abs_current($qs=false) {
     return self::abs_site(url::current($qs));
   }
+
+  /**
+   * Just like url::merge except that it escapes any XSS in the path.
+   */
+  static function merge($params) {
+    return htmlspecialchars(parent::merge($params));
+  }
+
+  /**
+   * Just like url::current except that it escapes any XSS in the path.
+   */
+  static function current($qs=false, $suffix=false) {
+    return htmlspecialchars(parent::current($qs, $suffix));
+  }
 }
diff --git a/modules/gallery/helpers/access.php b/modules/gallery/helpers/access.php
index 8ce7e436..e0a0e979 100644
--- a/modules/gallery/helpers/access.php
+++ b/modules/gallery/helpers/access.php
@@ -66,8 +66,8 @@
  *   the Access_Intent_Model
  */
 class access_Core {
-  const DENY      = false;
-  const ALLOW     = true;
+  const DENY      = "0";
+  const ALLOW     = "1";
   const INHERIT   = null; // access_intent
   const UNKNOWN   = null; // cache (access_cache, items)
 
diff --git a/modules/gallery/helpers/model_cache.php b/modules/gallery/helpers/model_cache.php
index 302e42d9..88756407 100644
--- a/modules/gallery/helpers/model_cache.php
+++ b/modules/gallery/helpers/model_cache.php
@@ -18,27 +18,25 @@
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
 class model_cache_Core {
-  private static $cache;
+  private static $cache = array();
 
   static function get($model_name, $id, $field_name="id") {
-    if (TEST_MODE || empty(self::$cache->$model_name->$field_name->$id)) {
+    if (TEST_MODE || empty(self::$cache[$model_name][$field_name][$id])) {
       $model = ORM::factory($model_name)->where($field_name, "=", $id)->find();
       if (!$model->loaded()) {
         throw new Exception("@todo MISSING_MODEL $model_name:$id");
       }
-      self::$cache->$model_name->$field_name->$id = $model;
+      self::$cache[$model_name][$field_name][$id] = $model;
     }
 
-    return self::$cache->$model_name->$field_name->$id;
+    return self::$cache[$model_name][$field_name][$id];
   }
 
   static function clear() {
-    self::$cache = new stdClass();
+    self::$cache = array();
   }
 
   static function set($model) {
-    self::$cache->{$model->object_name}
-      ->{$model->primary_key}
-      ->{$model->{$model->primary_key}} = $model;
+    self::$cache[$model->object_name][$model->primary_key][$model->{$model->primary_key}] = $model;
   }
 }