| Age | Commit message (Collapse) | Author |
|
If you can change the extension, then you can alter the way the server
handles the file, which is a security problem. So for example, you
can change a .JPG to a .PHP and then if you put some malicious PHP
code in the EXIF data, you can get the server to execute
it. Vulnerability is low because only users who have edit permissions
could do this.
Fixes ticket #846
|
|
Make the filename field required for photos/movies.
Fixes ticket #838
|
|
shared images from wind to lib. Deleted unused images in the admin_wind. This will likely break a few ajax features.
|
|
the movie edit form. Fixes ticket #726.
|
|
component for that given item. Album hierarchies are represented by
nested slugs. By default, we convert the filename to a slug when you
create an album, photo or movie.
|
|
|
|
related events from within the model handling code. The only
exception to this currently is item_created which is challenging
because we have to save the item using ORM_MPTT::add_to_parent()
before the object itself is fully set up. When we get that down to
one call to save() we can publish that event from within the model
also.
|
|
|
|
|
|
Fixes ticket #423.
|
|
exception which would get silently swallowed by swfUpload.
|
|
|
|
empty (to make it easier for folks to change it in Admin > Settings >
Advanced)
|
|
the new version of ffmpeg that I have on my dev box (ffmpeg
0.5-svn17737+3:0.svn20090303-1)
|
|
gallery module. This type of mass update is prone to some small bugs.
|
|
Kohana makes this type of transition fairly straightforward in that
all controllers/helpers/etc are still located in the cascading
filesystem without any extra effort, except that I've temporarily
added a hack to force modules/gallery into the module path.
Rename what's left of "core" to be "application" so that it conforms
more closely to the Kohana standard (basically, just
application/config/config.php which is the minimal thing that you need
in the application directory)
There's still considerable work left to be done here.
|