2 files changed, 11 insertions, 6 deletions
diff --git a/modules/gallery/controllers/packager.php b/modules/gallery/controllers/packager.php
index c48965b5..d7e3cf41 100644
--- a/modules/gallery/controllers/packager.php
+++ b/modules/gallery/controllers/packager.php
@@ -88,14 +88,17 @@ class Packager_Controller extends Controller {
 
     $dbconfig = Kohana::config('database.default');
     $conn = $dbconfig["connection"];
-    $pass = $conn["pass"] ? "-p{$conn['pass']}" : "";
     $sql_file = DOCROOT . "installer/install.sql";
     if (!is_writable($sql_file)) {
       print "$sql_file is not writeable";
       return;
     }
-    $command = "mysqldump --compact --skip-extended-insert --add-drop-table -h{$conn['host']} " .
-      "-u{$conn['user']} $pass {$conn['database']} > $sql_file";
+    $command = sprintf(
+      "mysqldump --compact --skip-extended-insert --add-drop-table %s %s %s %s > $sql_file",
+      escapeshellarg("-h{$conn['host']}"),
+      escapeshellarg("-u{$conn['user']}"),
+      $conn['pass'] ? escapeshellarg("-p{$conn['pass']}") : "",
+      escapeshellarg($conn['database']));
     exec($command, $output, $status);
     if ($status) {
       print "<pre>";
diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php
index f9edd3c6..f80fc53a 100644
--- a/modules/gallery/models/item.php
+++ b/modules/gallery/models/item.php
@@ -318,9 +318,11 @@ class Item_Model_Core extends ORM_MPTT {
    */
   public function save() {
     $significant_changes = $this->changed;
-    unset($significant_changes["view_count"]);
-    unset($significant_changes["relative_url_cache"]);
-    unset($significant_changes["relative_path_cache"]);
+    foreach (array("view_count", "relative_url_cache", "relative_path_cache",
+                   "resize_width", "resize_height", "resize_dirty",
+                   "thumb_width", "thumb_height", "thumb_dirty") as $key) {
+      unset($significant_changes[$key]);
+    }
 
     if ((!empty($this->changed) && $significant_changes) || isset($this->data_file)) {
       $this->updated = time();