From 0e3327bca70623175791ee41085d55d0cb13fe5b Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 3 Jan 2010 20:30:35 -0800
Subject: Simplify the REST API code.   Here's what I did: 1) Simplify
 gallery_rest to return flat models, no children and do no    validation for
 now. 2) Flatten the REST replies and use HTTP codes to indicate   
 success/failure instead of additional status messages. 3) Use the message and
 error code support in the base Exception class,    instead of brewing our own
 in Rest_Exception. 4) Get rid of rest::success() and rest::fail() -- we only
 need    rest::reply() since all failures are covered by throwing an   
 exception. 5) Get rid of /rest/access_key and just use /rest for
 authentication. 6) Inline and simplify rest::normalize_request since we only
 use it once 7) Change rest::set_active_user to succeed or throw an exception
 8) Extract Rest_Exception::sendHeaders into rest::send_headers()

Here's what's currently broken:
1) Data validation.  There currently is none
2) Logging.  That's gone too
3) image block and tag code is broken
4) Tests are broken
5) No movie support
---
 modules/gallery/helpers/gallery_rest.php           | 263 +++++----------------
 modules/gallery/tests/Gallery_Rest_Helper_Test.php |   3 +-
 modules/image_block/helpers/image_block_rest.php   |   4 +-
 modules/rest/controllers/rest.php                  |  60 +++--
 modules/rest/helpers/rest.php                      |  90 ++-----
 modules/rest/libraries/Rest_Exception.php          |  17 +-
 modules/rest/tests/Rest_Controller_Test.php        |  20 +-
 modules/tag/helpers/tag_rest.php                   |  14 +-
 modules/tag/tests/Tag_Rest_Helper_Test.php         |  12 +-
 9 files changed, 146 insertions(+), 337 deletions(-)

diff --git a/modules/gallery/helpers/gallery_rest.php b/modules/gallery/helpers/gallery_rest.php
index a87ebb4e..f1c8d825 100644
--- a/modules/gallery/helpers/gallery_rest.php
+++ b/modules/gallery/helpers/gallery_rest.php
@@ -17,232 +17,83 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class gallery_rest_Core {
-  static function get($request) {
-    $path = implode("/", $request->arguments);
 
-    $item = gallery_rest::_get_item($path);
+// @todo Add logging
+// @todo VALIDATION
+
+// Validation questions
+//
+// We need to be able to properly validate anything we want to enter here.  But all of our
+// validation currently happens at the controller / form level, and we're not using the same
+// controllers or forms.
+//
+// Possible solutions:
+// 1) Move validation into the model and use it both here and in the regular controllers.  But
+// if we do that, how do we translate validation failures into a user-consumable output which
+// we need so that we can return proper error responses to form submissions?
+//
+// 2) Create some kind of validation helper that can validate every field.  Wait, isn't this
+// just like #1 except in a helper instead of in the model?
 
-    $parent = $item->parent();
-    $response_data = array("type" => $item->type,
-                           "name" => $item->name,
-                           "path" => $item->relative_url(),
-                           "parent_path" => empty($parent) ? null : $parent->relative_url(),
-                           "title" => $item->title,
-                           "thumb_url" => $item->thumb_url(true),
-                           "thumb_size" => array("height" => $item->thumb_height,
-                                                 "width" => $item->thumb_width),
-                           "resize_url" => $item->resize_url(true),
-                           "resize_size" => array("height" => (int)$item->resize_height,
-                                                  "width" => (int)$item->resize_width),
-                           "url" => $item->file_url(true),
-                           "size" => array("height" => $item->height,
-                                           "width" => $item->width),
-                           "description" => $item->description,
-                           "slug" => $item->slug);
+class gallery_rest_Core {
+  static function get($request) {
+    $item = url::get_item_from_uri($request->path);
+    access::required("view", $item);
 
-    $children = self::_get_children($item, $request);
-    if (!empty($children) || $item->is_album()) {
-      $response_data["children"] = $children;
-    }
-    return rest::success(array("resource" => $response_data));
+    return json_encode($item->as_array());
   }
 
   static function put($request) {
-    if (empty($request->arguments)) {
-      throw new Rest_Exception(400, "Bad request");
-    }
-    $path = implode("/", $request->arguments);
-    $item = gallery_rest::_get_item($path, "edit");
-
-    // Validate the request data
-    $new_values = gallery_rest::_validate($request, $item->parent_id, $item->id);
-    $errors = $new_values->errors();
-    if (empty($errors)) {
-      $item->title = $new_values->title;
-      $item->description = $new_values->description;
-      if ($item->id != 1) {
-        $item->rename($new_values->name);
+    $item = url::get_item_from_uri($request->path);
+    access::required("edit", $item);
+
+    $params = $request->params;
+    foreach (array("captured", "description", "slug", "sort_column", "sort_order",
+                   "title", "view_count", "weight") as $key) {
+      if (isset($params->$key)) {
+        $item->$key = $params->$key;
       }
-      $item->slug = $new_values->slug;
-      $item->save();
-
-      log::success("content", "Updated $item->type",
-                   "<a href=\"{$item->type}s/$item->id\">view</a>");
-
-      return rest::success();
-    } else {
-      return rest::validation_error($errors);
     }
+    $item->save();
+
+    return rest::reply(array("url" => url::abs_site("/rest/gallery/" . $item->relative_url())));
   }
 
   static function post($request) {
-    if (empty($request->arguments)) {
-      throw new Rest_Exception(400, "Bad request");
-    }
+    $parent = url::get_item_from_uri($request->path);
+    access::required("edit", $parent);
 
-    $components = $request->arguments;
-    $name = urldecode(array_pop($components));
-
-    $parent = gallery_rest::_get_item(implode("/", $components), "edit");
-
-    // Validate the request data
-    $request->name = $name;
-    $new_values = gallery_rest::_validate($request, $parent->id);
-    $errors = $new_values->errors();
-    if (!empty($errors)) {
-      return rest::validation_error($errors);
-    }
+    $params = $request->params;
+    switch ($params->type) {
+    case "album":
+      $item = album::create(
+        $parent,
+        $params->name,
+        isset($params->title) ? $params->title : $name,
+        isset($params->description) ? $params->description : null);
+      break;
 
-    if (empty($new_values["image"])) {
-      $new_item = album::create(
+    case "photo":
+      $item = photo::create(
         $parent,
-        $name,
-        empty($new_values["title"]) ? $name : $new_values["title"],
-        empty($new_values["description"]) ? null : $new_values["description"],
-        identity::active_user()->id,
-        empty($new_values["slug"]) ? $name : $new_values["slug"]);
-      $log_message = t("Added an album");
-    } else {
-      $temp_filename = upload::save("image");
-      $path_info = @pathinfo($temp_filename);
-      if (array_key_exists("extension", $path_info) &&
-          in_array(strtolower($path_info["extension"]), array("flv", "mp4"))) {
-        $new_item =
-          movie::create($parent, $temp_filename, $new_values["name"], $new_values["title"]);
-        $log_message = t("Added a movie");
-      } else {
-        $new_item =
-          photo::create($parent, $temp_filename, $new_values["name"], $new_values["title"]);
-        $log_message = t("Added a photo");
-      }
-    }
+        $request->file,
+        $params->name,
+        isset($params->title) ? $params->title : $name,
+        isset($params->description) ? $params->description : null);
+      break;
 
-    log::success("content", $log_message, "<a href=\"{$new_item->type}s/$new_item->id\">view</a>");
+    default:
+      throw new Rest_Exception("Invalid type: $args->type", 400);
+    }
 
-    return rest::success(array("path" => $new_item->relative_url()));
+    return rest::reply(array("url" => url::abs_site("/rest/gallery/" . $item->relative_url())));
   }
 
   static function delete($request) {
-    if (empty($request->arguments)) {
-      throw new Rest_Exception(400, "Bad request");
-    }
-    $path = implode("/", $request->arguments);
-
-    $item = gallery_rest::_get_item($path, "edit");
-
-    if ($item->id == 1) {
-      throw new Rest_Exception(400, "Bad request");
-    }
+    $item = url::get_item_from_uri($request->path);
+    access::required("edit", $item);
 
-    $parent = $item->parent();
     $item->delete();
-
-    if ($item->is_album()) {
-      $msg = t("Deleted album <b>%title</b>", array("title" => html::purify($item->title)));
-    } else {
-      $msg = t("Deleted photo <b>%title</b>", array("title" => html::purify($item->title)));
-    }
-    log::success("content", $msg);
-
-    return rest::success(array("resource" => array("parent_path" => $parent->relative_url())));
-  }
-
-  private static function _get_item($path, $permission="view") {
-    $item = url::get_item_from_uri($path);
-
-    if (!$item->loaded()) {
-      throw new Kohana_404_Exception();
-    }
-
-    if (!access::can($permission, $item)) {
-      throw new Kohana_404_Exception();
-    }
-
-    return $item;
-  }
-
-  private static function _get_children($item, $request) {
-    $children = array();
-    $limit = empty($request->limit) ? null : $request->limit;
-    $offset = empty($request->offset) ? null : $request->offset;
-    $where = empty($request->filter) ? array() : array("type" => $request->filter);
-    foreach ($item->viewable()->children($limit, $offset, $where) as $child) {
-      $children[] = array("type" => $child->type,
-                          "has_children" => $child->children_count() > 0,
-                          "path" => $child->relative_url(),
-                          "thumb_url" => $child->thumb_url(true),
-                          "thumb_dimensions" => array("width" => $child->thumb_width,
-                                                      "height" => $child->thumb_height),
-                          "has_thumb" => $child->has_thumb(),
-                          "title" => $child->title);
-    }
-
-    return $children;
-  }
-
-  private static function _validate($request, $parent_id, $item_id=0) {
-    $item = ORM::factory("item", $item_id);
-
-    // Normalize the inputs so all fields have a value
-    $new_values = Validation::factory(array());
-    foreach ($item->form_rules as $field => $rule_set) {
-      if (isset($request->$field)) {
-        $new_values[$field] = $request->$field;
-      } else if (isset($item->$field)) {
-        $new_values[$field] = $item->$field;
-      }
-      foreach (explode("|", $rule_set) as $rule) {
-        $new_values->add_rules($field, $rule);
-      }
-    }
-    $name = $new_values["name"];
-    $new_values["title"] = empty($new_values["title"]) ? $name : $new_values["title"];
-    $new_values["description"] =
-      empty($new_values["description"]) ? null : $new_values["description"];
-    $new_values["slug"] = empty($new_values["slug"]) ? $name : $new_values["slug"];
-
-    if (!empty($request->image)) {
-      $new_values["image"] = $request->image;
-      $new_values->add_rules(
-        "image", "upload::valid", "upload::required", "upload::type[gif,jpg,jpeg,png,flv,mp4]");
-    }
-
-    if ($new_values->validate() && $item_id != 1) {
-      $errors = gallery_rest::_check_for_conflicts($parent_id, $item_id,
-                                                   $new_values["name"], $new_values["slug"]);
-      if (!empty($errors)) {
-        !empty($errors["name_conflict"]) OR $new_values->add_error("name", "Duplicate name");
-        !empty($errors["slug_conflict"]) OR
-          $new_values->add_error("slug", "Duplicate Internet address");
-      }
-    }
-
-    return $new_values;
-  }
-
-  private static function _check_for_conflicts($parent_id, $item_id, $new_name, $new_slug) {
-    $errors = array();
-
-    if ($row = db::build()
-        ->select(array("name", "slug"))
-        ->from("items")
-        ->where("parent_id", "=", $parent_id)
-        ->where("id", "<>", $item_id)
-        ->and_open()
-        ->where("name", "=", $new_name)
-        ->or_where("slug", "=", $new_slug)
-        ->close()
-        ->execute()
-        ->current()) {
-      if ($row->name == $new_name) {
-        $errors["name_conflict"] = 1;
-      }
-      if ($row->slug == $new_slug) {
-        $errors["slug_conflict"] = 1;
-      }
-    }
-
-    return $errors;
+    return rest::reply();
   }
 }
diff --git a/modules/gallery/tests/Gallery_Rest_Helper_Test.php b/modules/gallery/tests/Gallery_Rest_Helper_Test.php
index cd0aabae..c5c8a890 100644
--- a/modules/gallery/tests/Gallery_Rest_Helper_Test.php
+++ b/modules/gallery/tests/Gallery_Rest_Helper_Test.php
@@ -136,7 +136,8 @@ class Gallery_Rest_Helper_Test extends Unit_Test_Case {
     try {
       gallery_rest::put($request);
     } catch (Rest_Exception $e) {
-      $this->assert_equal("400 Bad request", $e->getMessage());
+      $this->assert_equal("Bad request", $e->getMessage());
+      $this->assert_equal(400, $e->getCode());
     } catch (Exception $e) {
       $this->assert_false(true, $e->__toString());
     }
diff --git a/modules/image_block/helpers/image_block_rest.php b/modules/image_block/helpers/image_block_rest.php
index 7afd974c..65eefb21 100644
--- a/modules/image_block/helpers/image_block_rest.php
+++ b/modules/image_block/helpers/image_block_rest.php
@@ -54,9 +54,9 @@ class image_block_rest_Core {
                              "thumb_size" => array("height" => $item->thumb_height,
                                                    "width" => $item->thumb_width));
 
-      return rest::success(array("resource" => $response_data));
+      return rest::reply(array("resource" => $response_data));
     } else {
-      return rest::fail("No Image found");
+      return rest::reply();
     }
   }
 }
diff --git a/modules/rest/controllers/rest.php b/modules/rest/controllers/rest.php
index 26e5b31a..0332e5fc 100644
--- a/modules/rest/controllers/rest.php
+++ b/modules/rest/controllers/rest.php
@@ -18,20 +18,14 @@
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
 class Rest_Controller extends Controller {
-  public function access_key() {
+  public function index() {
     try {
-      $request = (object)Input::instance()->get();
-      if (empty($request->user) || empty($request->password)) {
-        throw new Rest_Exception(403, "Forbidden");
-      }
-
-      $user = identity::lookup_user_by_name($request->user);
-      if (empty($user)) {
-        throw new Rest_Exception(403, "Forbidden");
-      }
+      $username = Input::instance()->post("user");
+      $password = Input::instance()->post("password");
 
-      if (!identity::is_correct_password($user, $request->password)) {
-        throw new Rest_Exception(403, "Forbidden");
+      $user = identity::lookup_user_by_name($username);
+      if (empty($user) || !identity::is_correct_password($user, $password)) {
+        throw new Rest_Exception("Forbidden", 403);
       }
 
       $key = ORM::factory("user_access_token")
@@ -42,27 +36,45 @@ class Rest_Controller extends Controller {
         $key->access_key = md5($user->name . rand());
         $key->save();
       }
-      print rest::success(array("token" => $key->access_key));
-    } catch (Rest_Exception $e) {
-      $e->sendHeaders();
+
+      rest::reply($key->access_key);
+    } catch (Exception $e) {
+      rest::send_headers($e);
     }
  }
 
   public function __call($function, $args) {
-    $request = rest::normalize_request($args);
+    $input = Input::instance();
+    switch ($method = strtolower($input->server("REQUEST_METHOD"))) {
+    case "get":
+      $request->params = (object) Input::instance()->get();
+      break;
+
+    case "post":
+      $request->params = (object) Input::instance()->post();
+      if (isset($_FILES["file"])) {
+        $request->file = upload::save("file");
+      }
+      break;
+    }
+
+    $request->method = strtolower($input->server("HTTP_X_GALLERY_REQUEST_METHOD", $method));
+    $request->access_token = $input->server("HTTP_X_GALLERY_REQUEST_KEY");
+    $request->path = implode("/", $args);
+
     try {
-      if (rest::set_active_user($request->access_token)) {
-        $handler_class = "{$function}_rest";
-        $handler_method = $request->method;
+      rest::set_active_user($request->access_token);
 
-        if (!method_exists($handler_class, $handler_method)) {
-          throw new Rest_Exception(403, "Forbidden");
-        }
+      $handler_class = "{$function}_rest";
+      $handler_method = $request->method;
 
-        print call_user_func(array($handler_class, $handler_method), $request);
+      if (!method_exists($handler_class, $handler_method)) {
+        throw new Rest_Exception("Forbidden", 403);
       }
+
+      print call_user_func(array($handler_class, $handler_method), $request);
     } catch (Rest_Exception $e) {
-      $e->sendHeaders();
+      rest::send_headers($e);
     }
   }
 }
\ No newline at end of file
diff --git a/modules/rest/helpers/rest.php b/modules/rest/helpers/rest.php
index be0644f2..f7f3f9fd 100644
--- a/modules/rest/helpers/rest.php
+++ b/modules/rest/helpers/rest.php
@@ -18,87 +18,37 @@
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
 class rest_Core {
-  /**
-   * Request failed
-   */
-  static function fail($log_message=null) {
-    if (!empty($log_message)) {
-      Kohana_Log::add("info", $log_message);
-    }
-    // We don't need to save the session for this request
+  static function reply($data=array()) {
     Session::abort_save();
-    return json_encode(array("status" => "ERROR", "message" => (string)$message));
-  }
 
-  /**
-   * Success
-   */
-  static function success($response_data=array(), $message=null) {
-    $response = array("status" => "OK");
-    if (!empty($message)) {
-      $response["message"] = (string)$message;
+    if ($data) {
+      print json_encode($data);
     }
-    $response = array_merge($response, $response_data);
-
-    // We don't need to save the session for this request
-    Session::abort_save();
-    return json_encode($response);
   }
 
-  /**
-   * Validation Error
-   */
-  static function validation_error($error_data) {
-    $response = array("status" => "VALIDATE_ERROR");
-    $response = array_merge($response, array("fields" => $error_data));
-
-    // We don't need to save the session for this request
-    Session::abort_save();
-    return json_encode($response);
-  }
+  static function set_active_user($access_token) {
+    if (empty($access_token)) {
+      identity::set_active_user(identity::guest());
+      return;
+    }
 
+    $key = ORM::factory("user_access_token")
+      ->where("access_key", "=", $access_token)
+      ->find();
 
-  static function normalize_request($args=array()) {
-    $input = Input::instance();
-    $method = strtolower($input->server("REQUEST_METHOD"));
-    $request = new stdClass();
-    foreach (array_keys($input->get()) as $key) {
-      $request->$key = $input->get($key);
-    }
-    if ($method != "get") {
-      foreach (array_keys($input->post()) as $key) {
-        $request->$key = $input->post($key);
-      }
-      foreach (array_keys($_FILES) as $key) {
-        $request->$key = $_FILES[$key];
-      }
+    if (!$key->loaded()) {
+      throw new Rest_Exception("Forbidden", 403);
     }
 
-    $request->method = strtolower($input->server("HTTP_X_GALLERY_REQUEST_METHOD", $method));
-    $request->access_token = $input->server("HTTP_X_GALLERY_REQUEST_KEY");
-    $request->arguments = $args;  // Let the rest handler figure out what the arguments mean
+    $user = identity::lookup_user($key->user_id);
+    if (empty($user)) {
+      throw new Rest_Exception("Forbidden", 403);
+    }
 
-    return $request;
+    identity::set_active_user($user);
   }
 
-  static function set_active_user($access_token) {
-    if (empty($access_token)) {
-      $user = identity::guest();
-    } else {
-      $key = ORM::factory("user_access_token")
-        ->where("access_key", "=", $access_token)
-        ->find();
-
-      if ($key->loaded()) {
-        $user = identity::lookup_user($key->user_id);
-        if (empty($user)) {
-          throw new Rest_Exception(403, "Forbidden");
-        }
-      } else {
-        throw new Rest_Exception(403, "Forbidden");
-      }
-    }
-    identity::set_active_user($user);
-    return true;
+  static function send_headers($exception) {
+    header("HTTP/1.1 " . $exception->getCode() . " " . $exception->getMessage());
   }
 }
diff --git a/modules/rest/libraries/Rest_Exception.php b/modules/rest/libraries/Rest_Exception.php
index 905b94a0..596b3712 100644
--- a/modules/rest/libraries/Rest_Exception.php
+++ b/modules/rest/libraries/Rest_Exception.php
@@ -18,19 +18,4 @@
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
 class Rest_Exception_Core extends Exception {
-  /**
-   * Set internal properties.
-   */
-  public function __construct($code, $text) {
-    parent::__construct("$code $text");
-  }
-
-  /**
-   * Sends the headers, to emulate server behavior.
-   *
-   * @return void
-   */
-  public function sendHeaders() {
-    header('HTTP/1.1 {$this->getMessage()}');
-  }
-} // End Rest Exception
\ No newline at end of file
+}
\ No newline at end of file
diff --git a/modules/rest/tests/Rest_Controller_Test.php b/modules/rest/tests/Rest_Controller_Test.php
index 83bd9db6..c881583c 100644
--- a/modules/rest/tests/Rest_Controller_Test.php
+++ b/modules/rest/tests/Rest_Controller_Test.php
@@ -84,7 +84,8 @@ class Rest_Controller_Test extends Unit_Test_Case {
     try {
       $this->_call_controller();
     } catch (Rest_Exception $e) {
-      $this->assert_equal("403 Forbidden", $e->getMessage());
+      $this->assert_equal(403, $e->getCode());
+      $this->assert_equal("Forbidden", $e->getMessage());
     } catch (Exception $e) {
       $this->assert_false(true, $e->__toString());
     }
@@ -97,7 +98,8 @@ class Rest_Controller_Test extends Unit_Test_Case {
     try {
       $this->_call_controller();
     } catch (Rest_Exception $e) {
-      $this->assert_equal("403 Forbidden", $e->getMessage());
+      $this->assert_equal(403, $e->getCode());
+      $this->assert_equal("Forbidden", $e->getMessage());
     } catch (Exception $e) {
       $this->assert_false(true, $e->__toString());
     }
@@ -109,7 +111,8 @@ class Rest_Controller_Test extends Unit_Test_Case {
     try {
       $this->_call_controller();
     } catch (Rest_Exception $e) {
-      $this->assert_equal("403 Forbidden", $e->getMessage());
+      $this->assert_equal(403, $e->getCode());
+      $this->assert_equal("Forbidden", $e->getMessage());
     } catch (Exception $e) {
       $this->assert_false(true, $e->__toString());
     }
@@ -137,7 +140,8 @@ class Rest_Controller_Test extends Unit_Test_Case {
     try {
       $this->_call_controller();
     } catch (Rest_Exception $e) {
-      $this->assert_equal("403 Forbidden", $e->getMessage());
+      $this->assert_equal(403, $e->getCode());
+      $this->assert_equal("Forbidden", $e->getMessage());
     } catch (Exception $e) {
       $this->assert_false(true, $e->__toString());
     }
@@ -155,7 +159,8 @@ class Rest_Controller_Test extends Unit_Test_Case {
     try {
       $this->_call_controller("rest", explode("/", $photo->relative_url()));
     } catch (Rest_Exception $e) {
-      $this->assert_equal("403 Forbidden", $e->getMessage());
+      $this->assert_equal(403, $e->getCode());
+      $this->assert_equal("Forbidden", $e->getMessage());
     } catch (Exception $e) {
       $this->assert_false(true, $e->__toString());
     }
@@ -171,7 +176,8 @@ class Rest_Controller_Test extends Unit_Test_Case {
     try {
       $this->_call_controller("rest", explode("/", $photo->relative_url()));
     } catch (Rest_Exception $e) {
-      $this->assert_equal("501 Not Implemented", $e->getMessage());
+      $this->assert_equal(501, $e->getCode());
+      $this->assert_equal("Not Implemented", $e->getMessage());
     } catch (Exception $e) {
       $this->assert_false(true, $e->__toString());
     }
@@ -218,7 +224,7 @@ class rest_rest {
     $response["thumb_url"] = $item->thumb_url();
     $response["description"] = $item->description;
     $response["internet_address"] = $item->slug;
-    return rest::success(array($item->type => $response), t("Processed"));
+    return rest::reply(array($item->type => $response));
   }
 
 }
diff --git a/modules/tag/helpers/tag_rest.php b/modules/tag/helpers/tag_rest.php
index cd1ca6c6..0c06587b 100644
--- a/modules/tag/helpers/tag_rest.php
+++ b/modules/tag/helpers/tag_rest.php
@@ -55,12 +55,12 @@ class tag_rest_Core {
       }
     }
 
-    return rest::success($resources);
+    return rest::reply($resources);
   }
 
   static function post($request) {
     if (empty($request->arguments) || count($request->arguments) != 1 || empty($request->path)) {
-      throw new Rest_Exception(400, "Bad request");
+      throw new Rest_Exception("Bad request", 400);
     }
     $path = $request->path;
     $tags = explode(",", $request->arguments[0]);
@@ -80,12 +80,12 @@ class tag_rest_Core {
     foreach ($tags as $tag) {
       tag::add($item, $tag);
     }
-    return rest::success();
+    return rest::reply();
   }
 
   static function put($request) {
     if (empty($request->arguments[0]) || empty($request->new_name)) {
-      throw new Rest_Exception(400, "Bad request");
+      throw new Rest_Exception("Bad request", 400);
     }
 
     $name = $request->arguments[0];
@@ -100,12 +100,12 @@ class tag_rest_Core {
     $tag->name = $request->new_name;
     $tag->save();
 
-    return rest::success();
+    return rest::reply();
   }
 
   static function delete($request) {
     if (empty($request->arguments[0])) {
-      throw new Rest_Exception(400, "Bad request");
+      throw new Rest_Exception("Bad request", 400);
     }
     $tags = explode(",", $request->arguments[0]);
     if (!empty($request->path)) {
@@ -127,7 +127,7 @@ class tag_rest_Core {
     };
 
     tag::compact();
-    return rest::success();
+    return rest::reply();
   }
 
   private static function _get_items($request) {
diff --git a/modules/tag/tests/Tag_Rest_Helper_Test.php b/modules/tag/tests/Tag_Rest_Helper_Test.php
index 4e8dd527..185953ab 100644
--- a/modules/tag/tests/Tag_Rest_Helper_Test.php
+++ b/modules/tag/tests/Tag_Rest_Helper_Test.php
@@ -133,7 +133,8 @@ class Tag_Rest_Helper_Test extends Unit_Test_Case {
     try {
       tag_rest::post($request);
     } catch (Rest_Exception $e) {
-      $this->assert_equal("400 Bad request", $e->getMessage());
+      $this->assert_equal(400, $e->getCode());
+      $this->assert_equal("Bad request", $e->getMessage());
     } catch (Exception $e) {
       $this->assert_false(true, $e->__toString());
     }
@@ -191,7 +192,8 @@ class Tag_Rest_Helper_Test extends Unit_Test_Case {
     try {
       tag_rest::put($request);
     } catch (Rest_Exception $e) {
-      $this->assert_equal("400 Bad request", $e->getMessage());
+      $this->assert_equal(400, $e->getCode());
+      $this->assert_equal("Bad request", $e->getMessage());
     } catch (Exception $e) {
       $this->assert_false(true, $e->__toString());
     }
@@ -202,7 +204,8 @@ class Tag_Rest_Helper_Test extends Unit_Test_Case {
     try {
       tag_rest::put($request);
     } catch (Rest_Exception $e) {
-      $this->assert_equal("400 Bad request", $e->getMessage());
+      $this->assert_equal(400, $e->getCode());
+      $this->assert_equal("Bad request", $e->getMessage());
     } catch (Exception $e) {
       $this->assert_false(true, $e->__toString());
     }
@@ -211,7 +214,8 @@ class Tag_Rest_Helper_Test extends Unit_Test_Case {
     try {
       tag_rest::put($request);
     } catch (Rest_Exception $e) {
-      $this->assert_equal("400 Bad request", $e->getMessage());
+      $this->assert_equal(400, $e->getCode());
+      $this->assert_equal("Bad request", $e->getMessage());
     } catch (Exception $e) {
       $this->assert_false(true, $e->__toString());
     }
-- 
cgit v1.2.3


From 3fffa18e650189e7f846592c9d4c3e7bbfe71c62 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Mon, 4 Jan 2010 21:48:21 -0800
Subject: Further progress on refining the REST server side code.

1) Deal in fully qualified URL resources through the rest
   interface.  All rest methods are now passed the complete url in
   request->url.

2) Create rest::resolve() which lets individual resource definition
   code convert a full url into the appropriate matching resource.
   Implement gallery_rest::resolve() and tag_rest::resolve()

3) Reimplement tag_rest's get() and post() methods.  They're much
   simpler now.

4) Implement the tags_rest helper which supports working with the
   entire tags collection.
---
 modules/gallery/helpers/gallery_rest.php | 14 ++++---
 modules/rest/controllers/rest.php        |  2 +-
 modules/rest/helpers/rest.php            | 20 +++++++++
 modules/tag/helpers/tag.php              |  2 +-
 modules/tag/helpers/tag_rest.php         | 69 ++++++++------------------------
 modules/tag/helpers/tags_rest.php        | 48 ++++++++++++++++++++++
 6 files changed, 96 insertions(+), 59 deletions(-)
 create mode 100644 modules/tag/helpers/tags_rest.php

diff --git a/modules/gallery/helpers/gallery_rest.php b/modules/gallery/helpers/gallery_rest.php
index f1c8d825..858721d0 100644
--- a/modules/gallery/helpers/gallery_rest.php
+++ b/modules/gallery/helpers/gallery_rest.php
@@ -37,14 +37,14 @@
 
 class gallery_rest_Core {
   static function get($request) {
-    $item = url::get_item_from_uri($request->path);
+    $item = rest::resolve($request->url);
     access::required("view", $item);
 
-    return json_encode($item->as_array());
+    return rest::reply($item->as_array());
   }
 
   static function put($request) {
-    $item = url::get_item_from_uri($request->path);
+    $item = rest::resolve($request->url);
     access::required("edit", $item);
 
     $params = $request->params;
@@ -60,7 +60,7 @@ class gallery_rest_Core {
   }
 
   static function post($request) {
-    $parent = url::get_item_from_uri($request->path);
+    $parent = rest::resolve($request->url);
     access::required("edit", $parent);
 
     $params = $request->params;
@@ -90,10 +90,14 @@ class gallery_rest_Core {
   }
 
   static function delete($request) {
-    $item = url::get_item_from_uri($request->path);
+    $item = rest::resolve($request->url);
     access::required("edit", $item);
 
     $item->delete();
     return rest::reply();
   }
+
+  static function resolve($path) {
+    return url::get_item_from_uri($path);
+  }
 }
diff --git a/modules/rest/controllers/rest.php b/modules/rest/controllers/rest.php
index 0332e5fc..5ef9eb84 100644
--- a/modules/rest/controllers/rest.php
+++ b/modules/rest/controllers/rest.php
@@ -60,7 +60,7 @@ class Rest_Controller extends Controller {
 
     $request->method = strtolower($input->server("HTTP_X_GALLERY_REQUEST_METHOD", $method));
     $request->access_token = $input->server("HTTP_X_GALLERY_REQUEST_KEY");
-    $request->path = implode("/", $args);
+    $request->url = url::abs_current(true);
 
     try {
       rest::set_active_user($request->access_token);
diff --git a/modules/rest/helpers/rest.php b/modules/rest/helpers/rest.php
index f7f3f9fd..b1b83e1b 100644
--- a/modules/rest/helpers/rest.php
+++ b/modules/rest/helpers/rest.php
@@ -51,4 +51,24 @@ class rest_Core {
   static function send_headers($exception) {
     header("HTTP/1.1 " . $exception->getCode() . " " . $exception->getMessage());
   }
+
+  /**
+   * Convert a REST url into an object.
+   * Eg: "http://example.com/gallery3/index.php/rest/gallery/Family/Wedding" -> Item_Model
+   *
+   * @param string  the fully qualified REST url
+   * @return mixed  the corresponding object (usually a model of some kind)
+   */
+  static function resolve($url) {
+    $components = explode("/", substr($url, strlen(url::abs_site("rest"))), 3);
+
+    // The first component will be empty because of the slash between "rest" and the
+    // resource type.
+    $class = "$components[1]_rest";
+    if (!method_exists($class, "resolve")) {
+      throw new Kohana_404_Exception($url);
+    }
+
+    return call_user_func(array($class, "resolve"), !empty($components[2]) ? $components[2] : null);
+  }
 }
diff --git a/modules/tag/helpers/tag.php b/modules/tag/helpers/tag.php
index 8075afe4..d895e08f 100644
--- a/modules/tag/helpers/tag.php
+++ b/modules/tag/helpers/tag.php
@@ -41,7 +41,7 @@ class tag_Core {
     }
 
     if (!$tag->has($item)) {
-      if (!$tag->add($item, $tag)) {
+      if (!$tag->add($item)) {
         throw new Exception("@todo {$tag->name} WAS_NOT_ADDED_TO {$item->id}");
       }
       $tag->count++;
diff --git a/modules/tag/helpers/tag_rest.php b/modules/tag/helpers/tag_rest.php
index 0c06587b..4b5103ef 100644
--- a/modules/tag/helpers/tag_rest.php
+++ b/modules/tag/helpers/tag_rest.php
@@ -18,71 +18,36 @@
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
 class tag_rest_Core {
-  // If no arguments just return all the tags.  If 2 or more then it is a path then
-  // return the tags for that item.  But if its only 1, then is it a path or a tag?
-  // Assume a tag first, if nothing is found then try finding the item.
   static function get($request) {
-    $resources = array();
-    switch (count($request->arguments)) {
-    case 0:
-      $tags = ORM::factory("tag")
-        ->select("name", "count")
-        ->order_by("count", "DESC");
-      if (!empty($request->limit)) {
-        $tags->limit($request->limit);
-      }
-      if (!empty($request->offset)) {
-        $tags->offset($request->offset);
-      }
-      $resources = array("tags" => array());
-      foreach ($tags->find_all() as $row) {
-        $resources["tags"][] = array("name" => $row->name, "count" => $row->count);
-      }
-      break;
-    case 1:
-      $resources = tag_rest::_get_items($request);
-      if (!empty($resources)) {
-        $resources = array("resources" => $resources);
-        break;
-      }
-    default:
-      $item = ORM::factory("item")
-        ->where("relative_url_cache", "=", implode("/", $request->arguments))
-        ->viewable()
-        ->find();
-      if ($item->loaded()) {
-        $resources = array("tags" => tag::item_tags($item));
-      }
-    }
-
-    return rest::reply($resources);
+    return rest::reply(rest::resolve($request->url)->as_array());
   }
 
   static function post($request) {
-    if (empty($request->arguments) || count($request->arguments) != 1 || empty($request->path)) {
+    $tag = rest::resolve($request->url);
+
+    if (empty($request->params->url)) {
       throw new Rest_Exception("Bad request", 400);
     }
-    $path = $request->path;
-    $tags = explode(",", $request->arguments[0]);
 
-    $item = ORM::factory("item")
-      ->where("relative_url_cache", "=", $path)
-      ->viewable()
-      ->find();
-    if (!$item->loaded()) {
-      throw new Kohana_404_Exception();
-    }
+    $item = rest::resolve($request->params->url);
 
-    if (!access::can("edit", $item)) {
+    access::required("edit", $item);
+    tag::add($item, $tag->name);
+
+    return rest::reply();
+  }
+
+  static function resolve($tag_name) {
+    $tag = ORM::factory("tag")->where("name", "=", $tag_name)->find();
+    if (!$tag->loaded()) {
       throw new Kohana_404_Exception();
     }
 
-    foreach ($tags as $tag) {
-      tag::add($item, $tag);
-    }
-    return rest::reply();
+    return $tag;
   }
 
+  // ------------------------------------------------------------
+
   static function put($request) {
     if (empty($request->arguments[0]) || empty($request->new_name)) {
       throw new Rest_Exception("Bad request", 400);
diff --git a/modules/tag/helpers/tags_rest.php b/modules/tag/helpers/tags_rest.php
new file mode 100644
index 00000000..d2bd28b0
--- /dev/null
+++ b/modules/tag/helpers/tags_rest.php
@@ -0,0 +1,48 @@
+<?php defined("SYSPATH") or die("No direct script access.");
+/**
+ * Gallery - a web based photo album viewer and editor
+ * Copyright (C) 2000-2009 Bharat Mediratta
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or (at
+ * your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+class tags_rest_Core {
+  static function get($request) {
+    $data = array();
+    foreach (ORM::factory("tag")->find_all() as $tag) {
+      $data[$tag->name] = url::abs_site("rest/tags/" . rawurlencode($tag->name));
+    }
+    return rest::reply($data);
+  }
+
+  static function post($request) {
+    // @todo: what permission should be required to create a tag here?
+    // for now, require edit at the top level.  Perhaps later, just require any edit perms,
+    // anywhere in the gallery?
+    access::required("edit", item::root());
+
+    if (empty($request->params->name)) {
+      throw new Rest_Exception("Bad Request", 400);
+    }
+
+    $tag = ORM::factory("tag")->where("name", "=", $request->params->name)->find();
+    if (!$tag->loaded()) {
+      $tag->name = $request->params->name;
+      $tag->count = 0;
+      $tag->save();
+    }
+
+    return rest::reply(array("url" => url::abs_site("rest/tag/" . rawurlencode($tag->name))));
+  }
+}
-- 
cgit v1.2.3


From d18be7fe550e1233e7a19184529f1b87a6249343 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 5 Jan 2010 12:05:22 -0800
Subject: $offset should be null by default, not 0.  Hold over bug from the K24
 migration.

---
 modules/tag/models/tag.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/tag/models/tag.php b/modules/tag/models/tag.php
index d0d2117c..2b33c30d 100644
--- a/modules/tag/models/tag.php
+++ b/modules/tag/models/tag.php
@@ -27,7 +27,7 @@ class Tag_Model extends ORM {
    * @param string   $type   the type of item (album, photo)
    * @return ORM_Iterator
    */
-  public function items($limit=null, $offset=0, $type=null) {
+  public function items($limit=null, $offset=null, $type=null) {
     $model = ORM::factory("item")
       ->viewable()
       ->join("items_tags", "items.id", "items_tags.item_id")
-- 
cgit v1.2.3


From 31454d37b3ea02104925f1976609576c5f09c0c6 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 5 Jan 2010 13:41:06 -0800
Subject: Improve REST tag support. - Add support for retrieving a list of
 members from a collection - Implement put(), post() and delete() for tags. -
 Use tag_rest::delete() as a way to remove members from the tag collection

---
 modules/gallery/helpers/gallery_rest.php |   7 +-
 modules/tag/helpers/tag_rest.php         | 118 ++++++++++++-------------------
 modules/tag/helpers/tags_rest.php        |   6 +-
 3 files changed, 54 insertions(+), 77 deletions(-)

diff --git a/modules/gallery/helpers/gallery_rest.php b/modules/gallery/helpers/gallery_rest.php
index 858721d0..c7b32d8c 100644
--- a/modules/gallery/helpers/gallery_rest.php
+++ b/modules/gallery/helpers/gallery_rest.php
@@ -40,7 +40,12 @@ class gallery_rest_Core {
     $item = rest::resolve($request->url);
     access::required("view", $item);
 
-    return rest::reply($item->as_array());
+    $children = array();
+    foreach ($item->children() as $child) {
+      $children[] = url::abs_site("rest/gallery/" . $child->relative_url());
+    }
+
+    return rest::reply(array("resource" => $item->as_array(), "members" => $children));
   }
 
   static function put($request) {
diff --git a/modules/tag/helpers/tag_rest.php b/modules/tag/helpers/tag_rest.php
index 4b5103ef..c1bbf4fb 100644
--- a/modules/tag/helpers/tag_rest.php
+++ b/modules/tag/helpers/tag_rest.php
@@ -19,107 +19,79 @@
  */
 class tag_rest_Core {
   static function get($request) {
-    return rest::reply(rest::resolve($request->url)->as_array());
+    $tag = rest::resolve($request->url);
+    $items = array();
+    foreach ($tag->items() as $item) {
+      $items[] = url::abs_site("rest/gallery/" . $item->relative_url());
+    }
+
+    return rest::reply(array("resource" => $tag->as_array(), "members" => $items));
   }
 
   static function post($request) {
-    $tag = rest::resolve($request->url);
-
     if (empty($request->params->url)) {
       throw new Rest_Exception("Bad request", 400);
     }
 
+    $tag = rest::resolve($request->url);
     $item = rest::resolve($request->params->url);
-
     access::required("edit", $item);
-    tag::add($item, $tag->name);
 
-    return rest::reply();
+    tag::add($item, $tag->name);
+    return rest::reply(array("url" => url::abs_site("rest/tag/" . rawurlencode($tag->name))));
   }
 
-  static function resolve($tag_name) {
-    $tag = ORM::factory("tag")->where("name", "=", $tag_name)->find();
-    if (!$tag->loaded()) {
-      throw new Kohana_404_Exception();
-    }
+  static function put($request) {
+    $tag = rest::resolve($request->url);
 
-    return $tag;
-  }
+    // @todo: what permission should be required to edit a tag?
+    // for now, require edit at the top level.  Perhaps later, just require any edit perms,
+    // anywhere in the gallery?
 
-  // ------------------------------------------------------------
+    if (isset($request->params->remove)) {
+      if (!is_array($request->params->remove)) {
+        throw new Exception("Bad request", 400);
+      }
 
-  static function put($request) {
-    if (empty($request->arguments[0]) || empty($request->new_name)) {
-      throw new Rest_Exception("Bad request", 400);
+      foreach ($request->params->remove as $item_url) {
+        $item = rest::resolve($item_url);
+        access::required("edit", $item);
+        $tag->remove($item);
+      }
     }
 
-    $name = $request->arguments[0];
-
-    $tag = ORM::factory("tag")
-      ->where("name", "=", $name)
-      ->find();
-    if (!$tag->loaded()) {
-      throw new Kohana_404_Exception();
+    if (isset($request->params->name)) {
+      $tag->name = $request->params->name;
     }
 
-    $tag->name = $request->new_name;
     $tag->save();
-
-    return rest::reply();
+    return rest::reply(array("url" => url::abs_site("rest/tag/" . rawurlencode($tag->name))));
   }
 
   static function delete($request) {
-    if (empty($request->arguments[0])) {
-      throw new Rest_Exception("Bad request", 400);
-    }
-    $tags = explode(",", $request->arguments[0]);
-    if (!empty($request->path)) {
-      $tag_list = ORM::factory("tag")
-        ->join("items_tags", "tags.id", "items_tags.tag_id")
-        ->join("items", "items.id", "items_tags.item_id")
-        ->where("tags.name", "IN",  $tags)
-        ->where("relative_url_cache", "=", $request->path)
-        ->viewable()
-        ->find_all();
-    } else {
-      $tag_list = ORM::factory("tag")
-        ->where("name", "IN", $tags)
-        ->find_all();
-    }
+    $tag = rest::resolve($request->url);
 
-    foreach ($tag_list as $row) {
-      $row->delete();
-    };
+    if (empty($request->params->url)) {
+      // Delete the tag
+      $tag->delete();
+      return rest::reply();
+    } else {
+      // Remove an item from the tag
+      $item = rest::resolve($request->params->url);
+      $tag->remove($item);
+      $tag->save();
 
-    tag::compact();
-    return rest::reply();
+      tag::compact();
+      return rest::reply(array("url" => url::abs_site("rest/tag/" . rawurlencode($tag->name))));
+    }
   }
 
-  private static function _get_items($request) {
-    $tags = explode(",", $request->arguments[0]);
-    $items = ORM::factory("item")
-      ->select_distinct("*")
-      ->join("items_tags", "items.id", "items_tags.item_id")
-      ->join("tags", "tags.id", "items_tags.tag_id")
-      ->where("tags.name", "IN",  $tags);
-    if (!empty($request->limit)) {
-      $items->limit($request->limit);
-    }
-    if (!empty($request->offset)) {
-      $items->offset($request->offset);
-    }
-    $resources = array();
-    foreach ($items->find_all() as $item) {
-      $resources[] = array("type" => $item->type,
-                           "has_children" => $item->children_count() > 0,
-                           "path" => $item->relative_url(),
-                           "thumb_url" => $item->thumb_url(true),
-                           "thumb_dimensions" => array("width" => $item->thumb_width,
-                                                       "height" => $item->thumb_height),
-                           "has_thumb" => $item->has_thumb(),
-                           "title" => $item->title);
+  static function resolve($tag_name) {
+    $tag = ORM::factory("tag")->where("name", "=", $tag_name)->find();
+    if (!$tag->loaded()) {
+      throw new Kohana_404_Exception();
     }
 
-    return $resources;
+    return $tag;
   }
 }
diff --git a/modules/tag/helpers/tags_rest.php b/modules/tag/helpers/tags_rest.php
index d2bd28b0..3ef897fd 100644
--- a/modules/tag/helpers/tags_rest.php
+++ b/modules/tag/helpers/tags_rest.php
@@ -19,11 +19,11 @@
  */
 class tags_rest_Core {
   static function get($request) {
-    $data = array();
+    $tags = array();
     foreach (ORM::factory("tag")->find_all() as $tag) {
-      $data[$tag->name] = url::abs_site("rest/tags/" . rawurlencode($tag->name));
+      $tags[$tag->name] = url::abs_site("rest/tags/" . rawurlencode($tag->name));
     }
-    return rest::reply($data);
+    return rest::reply(array("members" => $tags));
   }
 
   static function post($request) {
-- 
cgit v1.2.3


From d43badb4ecac092c897cb52cc54696d1489bc2e0 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 8 Jan 2010 11:11:38 -0800
Subject: Change url parsing in resolve() to ignore the query string.

---
 modules/rest/helpers/rest.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/rest/helpers/rest.php b/modules/rest/helpers/rest.php
index b1b83e1b..121191f2 100644
--- a/modules/rest/helpers/rest.php
+++ b/modules/rest/helpers/rest.php
@@ -60,10 +60,10 @@ class rest_Core {
    * @return mixed  the corresponding object (usually a model of some kind)
    */
   static function resolve($url) {
-    $components = explode("/", substr($url, strlen(url::abs_site("rest"))), 3);
+    $relative_url = substr($url, strlen(url::abs_site("rest")));
+    $path = parse_url($relative_url, PHP_URL_PATH);
+    $components = explode("/", $path, 3);
 
-    // The first component will be empty because of the slash between "rest" and the
-    // resource type.
     $class = "$components[1]_rest";
     if (!method_exists($class, "resolve")) {
       throw new Kohana_404_Exception($url);
-- 
cgit v1.2.3


From 14f6e5f6d3933b958fa61b83c627412282610dee Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 8 Jan 2010 11:12:02 -0800
Subject: Allow the "name" param in get() so that you can restrict the query to
 children with a given name.

---
 modules/gallery/helpers/gallery_rest.php | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/modules/gallery/helpers/gallery_rest.php b/modules/gallery/helpers/gallery_rest.php
index c7b32d8c..fd18d59a 100644
--- a/modules/gallery/helpers/gallery_rest.php
+++ b/modules/gallery/helpers/gallery_rest.php
@@ -40,8 +40,14 @@ class gallery_rest_Core {
     $item = rest::resolve($request->url);
     access::required("view", $item);
 
+    if (isset($request->params->name)) {
+      $where[] = array("name", "=", $request->params->name);
+    } else {
+      $where = array();
+    }
+
     $children = array();
-    foreach ($item->children() as $child) {
+    foreach ($item->children($where) as $child) {
       $children[] = url::abs_site("rest/gallery/" . $child->relative_url());
     }
 
-- 
cgit v1.2.3


From a2f5ace4931d4c4d812cd9af1eb3a104bc112b96 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 8 Jan 2010 11:47:00 -0800
Subject: Change merge_where() and merge_or_where() to ignore empty tuples so
 that chaining is easier.

---
 modules/kohana23_compat/libraries/MY_Database_Builder.php | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/modules/kohana23_compat/libraries/MY_Database_Builder.php b/modules/kohana23_compat/libraries/MY_Database_Builder.php
index c82b6ac4..b2a5c92a 100644
--- a/modules/kohana23_compat/libraries/MY_Database_Builder.php
+++ b/modules/kohana23_compat/libraries/MY_Database_Builder.php
@@ -23,8 +23,10 @@ class Database_Builder extends Database_Builder_Core {
    * @chainable
    */
   public function merge_where($tuples) {
-    foreach ($tuples as $tuple) {
-      $this->where($tuple[0], $tuple[1], $tuple[2]);
+    if ($tuples) {
+      foreach ($tuples as $tuple) {
+        $this->where($tuple[0], $tuple[1], $tuple[2]);
+      }
     }
     return $this;
   }
@@ -34,8 +36,10 @@ class Database_Builder extends Database_Builder_Core {
    * @chainable
    */
   public function merge_or_where($tuples) {
-    foreach ($tuples as $tuple) {
-      $this->or_where($tuple[0], $tuple[1], $tuple[2]);
+    if ($tuples) {
+      foreach ($tuples as $tuple) {
+        $this->or_where($tuple[0], $tuple[1], $tuple[2]);
+      }
     }
     return $this;
   }
-- 
cgit v1.2.3


From 2d8843ba4d780b8a9c3662f78d17ca29ebb1c8df Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 8 Jan 2010 11:48:44 -0800
Subject: use item::random() to get the random item.

---
 modules/image_block/helpers/image_block_block.php | 24 ++---------------------
 1 file changed, 2 insertions(+), 22 deletions(-)

diff --git a/modules/image_block/helpers/image_block_block.php b/modules/image_block/helpers/image_block_block.php
index f591e8d1..5f2bbcb7 100644
--- a/modules/image_block/helpers/image_block_block.php
+++ b/modules/image_block/helpers/image_block_block.php
@@ -30,29 +30,9 @@ class image_block_block_Core {
       $block->css_id = "g-image-block";
       $block->title = t("Random image");
       $block->content = new View("image_block_block.html");
+      $block->content->items = item::random(array(array("type", "!=", "album")));
 
-      $random = ((float)mt_rand()) / (float)mt_getrandmax();
-
-      $items = ORM::factory("item")
-        ->viewable()
-        ->where("type", "!=", "album")
-        ->where("rand_key", "<", $random)
-        ->order_by(array("rand_key" => "DESC"))
-        ->find_all(1);
-
-      if ($items->count() == 0) {
-        // Try once more.  If this fails, just ditch the block altogether
-        $items = ORM::factory("item")
-          ->viewable()
-          ->where("type", "!=", "album")
-          ->where("rand_key", ">=", $random)
-          ->order_by(array("rand_key" => "DESC"))
-          ->find_all(1);
-      }
-
-      if ($items->count() > 0) {
-        $block->content->item = $items->current();
-      } else {
+      if ($block->content->items->count() == 0) {
         $block = "";
       }
       break;
-- 
cgit v1.2.3


From 3fc6dab7acf8d6bacbc557a8554f92d251c0ed6b Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 8 Jan 2010 11:49:01 -0800
Subject: Expect merge_where and merge_or_where to handle empty tuples.

---
 modules/gallery/libraries/ORM_MPTT.php | 20 ++++----------------
 1 file changed, 4 insertions(+), 16 deletions(-)

diff --git a/modules/gallery/libraries/ORM_MPTT.php b/modules/gallery/libraries/ORM_MPTT.php
index 0ea519c9..c660b119 100644
--- a/modules/gallery/libraries/ORM_MPTT.php
+++ b/modules/gallery/libraries/ORM_MPTT.php
@@ -165,11 +165,8 @@ class ORM_MPTT_Core extends ORM {
    * @return array ORM
    */
   function children($limit=null, $offset=null, $where=null, $order_by=array("id" => "ASC")) {
-    if ($where) {
-      $this->merge_where($where);
-    }
-
     return $this
+      ->merge_where($where)
       ->where("parent_id", "=", $this->id)
       ->order_by($order_by)
       ->find_all($limit, $offset);
@@ -183,11 +180,8 @@ class ORM_MPTT_Core extends ORM {
    * @return array ORM
    */
   function children_count($where=null) {
-    if ($where) {
-      $this->merge_where($where);
-    }
-
     return $this
+      ->merge_where($where)
       ->where("parent_id", "=", $this->id)
       ->count_all();
   }
@@ -202,11 +196,8 @@ class ORM_MPTT_Core extends ORM {
    * @return object ORM_Iterator
    */
   function descendants($limit=null, $offset=null, $where=null, $order_by=array("id" => "ASC")) {
-    if ($where) {
-      $this->merge_where($where);
-    }
-
     return $this
+      ->merge_where($where);
       ->where("left_ptr", ">", $this->left_ptr)
       ->where("right_ptr", "<=", $this->right_ptr)
       ->order_by($order_by)
@@ -220,11 +211,8 @@ class ORM_MPTT_Core extends ORM {
    * @return   integer  child count
    */
   function descendants_count($where=null) {
-    if ($where) {
-      $this->merge_where($where);
-    }
-
     return $this
+      ->merge_where($where);
       ->where("left_ptr", ">", $this->left_ptr)
       ->where("right_ptr", "<=", $this->right_ptr)
       ->count_all();
-- 
cgit v1.2.3


From 895ac72e706daf8aead624c4cb8d556a2299f73f Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 8 Jan 2010 11:49:18 -0800
Subject: Add item::random() to return a random Item_Model.

---
 modules/gallery/helpers/item.php | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/modules/gallery/helpers/item.php b/modules/gallery/helpers/item.php
index f6181f8a..8098d1cd 100644
--- a/modules/gallery/helpers/item.php
+++ b/modules/gallery/helpers/item.php
@@ -173,4 +173,34 @@ class item_Core {
   static function root() {
     return model_cache::get("item", 1);
   }
+
+  /**
+   * Return a random Item_Model, with optional filters
+   *
+   * @param array   (optional) where tuple
+   */
+  static function random($where=null) {
+    $random = ((float)mt_rand()) / (float)mt_getrandmax();
+
+    // Pick a random number and find the item that's got nearest smaller number.  In the rare case
+    // that we chose the smallest number in the system, choose the item with the smallest number.
+    // This approach works best when the random numbers in the system are roughly evenly
+    // distributed so this is going to be more efficient with larger data sets.
+    $random = 0.0;
+    $items = ORM::factory("item")
+      ->viewable()
+      ->where("rand_key", "<", $random)
+      ->merge_where($where)
+      ->order_by("rand_key", "DESC")
+      ->find_all(1);
+
+    if ($items->count() == 0) {
+        $items = ORM::factory("item")
+          ->viewable()
+          ->merge_where($where)
+          ->order_by("rand_key", "ASC")
+          ->find_all(1);
+    }
+    return $items;
+  }
 }
\ No newline at end of file
-- 
cgit v1.2.3


From ad3e003e487de09769ca3ba40f1d8b3397658ed6 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 8 Jan 2010 14:04:41 -0800
Subject: Remove stray semicolons.

---
 modules/gallery/libraries/ORM_MPTT.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/gallery/libraries/ORM_MPTT.php b/modules/gallery/libraries/ORM_MPTT.php
index c660b119..ed77cac9 100644
--- a/modules/gallery/libraries/ORM_MPTT.php
+++ b/modules/gallery/libraries/ORM_MPTT.php
@@ -197,7 +197,7 @@ class ORM_MPTT_Core extends ORM {
    */
   function descendants($limit=null, $offset=null, $where=null, $order_by=array("id" => "ASC")) {
     return $this
-      ->merge_where($where);
+      ->merge_where($where)
       ->where("left_ptr", ">", $this->left_ptr)
       ->where("right_ptr", "<=", $this->right_ptr)
       ->order_by($order_by)
@@ -212,7 +212,7 @@ class ORM_MPTT_Core extends ORM {
    */
   function descendants_count($where=null) {
     return $this
-      ->merge_where($where);
+      ->merge_where($where)
       ->where("left_ptr", ">", $this->left_ptr)
       ->where("right_ptr", "<=", $this->right_ptr)
       ->count_all();
-- 
cgit v1.2.3


From fb65a0a5854812a9837c770dfbb27a23bee49e3d Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 8 Jan 2010 14:20:15 -0800
Subject: Remove debug code.

---
 modules/gallery/helpers/item.php | 1 -
 1 file changed, 1 deletion(-)

diff --git a/modules/gallery/helpers/item.php b/modules/gallery/helpers/item.php
index 8098d1cd..eb528f8f 100644
--- a/modules/gallery/helpers/item.php
+++ b/modules/gallery/helpers/item.php
@@ -186,7 +186,6 @@ class item_Core {
     // that we chose the smallest number in the system, choose the item with the smallest number.
     // This approach works best when the random numbers in the system are roughly evenly
     // distributed so this is going to be more efficient with larger data sets.
-    $random = 0.0;
     $items = ORM::factory("item")
       ->viewable()
       ->where("rand_key", "<", $random)
-- 
cgit v1.2.3


From 9864ab4b2708ec54c39092a21828403cbbd25e2e Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 8 Jan 2010 14:56:08 -0800
Subject: Move the random image functionality into the gallery REST helper
 since choosing a random image is essentially a function on an item
 collection. Also implemented a bunch of other query filters for item
 collections.

Created item::random_query() as a way of generating a reasonable
starting point for random queries.
---
 modules/gallery/helpers/gallery_rest.php          | 55 +++++++++++++++++---
 modules/gallery/helpers/item.php                  | 25 +++------
 modules/image_block/helpers/image_block_block.php |  2 +-
 modules/image_block/helpers/image_block_rest.php  | 62 -----------------------
 4 files changed, 55 insertions(+), 89 deletions(-)
 delete mode 100644 modules/image_block/helpers/image_block_rest.php

diff --git a/modules/gallery/helpers/gallery_rest.php b/modules/gallery/helpers/gallery_rest.php
index fd18d59a..0de5da2b 100644
--- a/modules/gallery/helpers/gallery_rest.php
+++ b/modules/gallery/helpers/gallery_rest.php
@@ -36,22 +36,63 @@
 // just like #1 except in a helper instead of in the model?
 
 class gallery_rest_Core {
+
+  /**
+   * For items that are collections, you can specify the following additional query parameters to
+   * query the collection.  You can specify them in any combination.
+   *
+   *   scope=direct
+   *     only return items that are immediately under this one
+   *   scope=all
+   *     return items anywhere under this one
+   *
+   *   name=<substring>
+   *     only return items where the name contains this substring
+   *
+   *   random=true
+   *     return a single random item
+   *
+   *   type=<comma separate list of photo, movie or album>
+   *     limit the type to types in this list.  eg, "type=photo,movie"
+   */
   static function get($request) {
     $item = rest::resolve($request->url);
     access::required("view", $item);
 
-    if (isset($request->params->name)) {
-      $where[] = array("name", "=", $request->params->name);
+    $p = $request->params;
+    if (isset($p->random)) {
+      $orm = item::random_query()->offset(0)->limit(1);
     } else {
-      $where = array();
+      $orm = ORM::factory("item")->viewable();
+    }
+
+    if (!empty($p->scope) && !in_array($p->scope, array("direct", "all"))) {
+      throw new Exception("Bad Request", 400);
+    }
+    if (!empty($p->scope)) {
+      if ($p->scope == "direct") {
+        $orm->where("parent_id", "=", $item->id);
+      } else {
+        $orm->where("left_ptr", ">=", $item->left_ptr);
+        $orm->where("right_ptr", "<=", $item->left_ptr);
+        $orm->where("id", "<>", $item->id);
+      }
+    }
+
+    if (isset($p->name)) {
+      $orm->where("name", "LIKE", "%{$p->name}%");
+    }
+
+    if (isset($p->type)) {
+      $orm->where("type", "IN", explode(",", $p->type));
     }
 
-    $children = array();
-    foreach ($item->children($where) as $child) {
-      $children[] = url::abs_site("rest/gallery/" . $child->relative_url());
+    $members = array();
+    foreach ($orm->find_all() as $child) {
+      $members[] = url::abs_site("rest/gallery/" . $child->relative_url());
     }
 
-    return rest::reply(array("resource" => $item->as_array(), "members" => $children));
+    return rest::reply(array("resource" => $item->as_array(), "members" => $members));
   }
 
   static function put($request) {
diff --git a/modules/gallery/helpers/item.php b/modules/gallery/helpers/item.php
index eb528f8f..1fd9ef16 100644
--- a/modules/gallery/helpers/item.php
+++ b/modules/gallery/helpers/item.php
@@ -175,31 +175,18 @@ class item_Core {
   }
 
   /**
-   * Return a random Item_Model, with optional filters
+   * Return a query to get a random Item_Model, with optional filters
    *
    * @param array   (optional) where tuple
    */
-  static function random($where=null) {
-    $random = ((float)mt_rand()) / (float)mt_getrandmax();
-
-    // Pick a random number and find the item that's got nearest smaller number.  In the rare case
-    // that we chose the smallest number in the system, choose the item with the smallest number.
+  static function random_query($where=null) {
+    // Pick a random number and find the item that's got nearest smaller number.
     // This approach works best when the random numbers in the system are roughly evenly
     // distributed so this is going to be more efficient with larger data sets.
-    $items = ORM::factory("item")
+    return ORM::factory("item")
       ->viewable()
-      ->where("rand_key", "<", $random)
+      ->where("rand_key", "<", ((float)mt_rand()) / (float)mt_getrandmax())
       ->merge_where($where)
-      ->order_by("rand_key", "DESC")
-      ->find_all(1);
-
-    if ($items->count() == 0) {
-        $items = ORM::factory("item")
-          ->viewable()
-          ->merge_where($where)
-          ->order_by("rand_key", "ASC")
-          ->find_all(1);
-    }
-    return $items;
+      ->order_by("rand_key", "DESC");
   }
 }
\ No newline at end of file
diff --git a/modules/image_block/helpers/image_block_block.php b/modules/image_block/helpers/image_block_block.php
index 5f2bbcb7..f28e775f 100644
--- a/modules/image_block/helpers/image_block_block.php
+++ b/modules/image_block/helpers/image_block_block.php
@@ -30,7 +30,7 @@ class image_block_block_Core {
       $block->css_id = "g-image-block";
       $block->title = t("Random image");
       $block->content = new View("image_block_block.html");
-      $block->content->items = item::random(array(array("type", "!=", "album")));
+      $block->content->items = item::random_query(array(array("type", "!=", "album")))->find_all(1);
 
       if ($block->content->items->count() == 0) {
         $block = "";
diff --git a/modules/image_block/helpers/image_block_rest.php b/modules/image_block/helpers/image_block_rest.php
deleted file mode 100644
index 65eefb21..00000000
--- a/modules/image_block/helpers/image_block_rest.php
+++ /dev/null
@@ -1,62 +0,0 @@
-<?php defined("SYSPATH") or die("No direct script access.");
-/**
- * Gallery - a web based photo album viewer and editor
- * Copyright (C) 2000-2009 Bharat Mediratta
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or (at
- * your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
- */
-class image_block_rest_Core {
-  static function get($request) {
-    $type = empty($request->type) ? "random" : $request->type;
-    switch ($type) {
-    case "random":
-      $random = ((float)mt_rand()) / (float)mt_getrandmax();
-
-      $items = ORM::factory("item")
-        ->viewable()
-        ->where("type", "!=", "album")
-        ->where("rand_key", "<", $random)
-        ->order_by(array("rand_key" => "DESC"))
-        ->find_all(1);
-
-      if ($items->count() == 0) {
-        // Try once more.  If this fails, just ditch the block altogether
-        $items = ORM::factory("item")
-          ->viewable()
-          ->where("type", "!=", "album")
-          ->where("rand_key",  ">= ", $random)
-          ->order_by(array("rand_key" => "DESC"))
-          ->find_all(1);
-      }
-      break;
-    default:
-      return rest::fail("Unsupported image block type: '{$type}'");
-    }
-
-    if ($items->count() > 0) {
-      $item = $items->current();
-      $response_data = array("name" => $item->name,
-                             "path" => $item->relative_url(),
-                             "title" => $item->title,
-                             "thumb_url" => $item->thumb_url(true),
-                             "thumb_size" => array("height" => $item->thumb_height,
-                                                   "width" => $item->thumb_width));
-
-      return rest::reply(array("resource" => $response_data));
-    } else {
-      return rest::reply();
-    }
-  }
-}
-- 
cgit v1.2.3


From b3e328c9ff4c3e19df4b6d18da947b759fe0c201 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Thu, 14 Jan 2010 21:04:09 -0800
Subject: Begin the process of converting to model based validation.  Right now
 only Albums_Controller::update() supports the pattern.  All form and
 controller based validation happening when editing an album has been moved
 over.

Model based validation means that our REST controllers share the
same validation as web controllers.  We'll have consistency
enforced at the model level, which is a Good Thing.

The basic pattern is now:
1) Rules are in the model

2) ORM::validate() (which is called by ORM::save() but you can
   call it directly, too) checks the model for all the rules and
   throws an ORM_Validation_Exception if there are failures

3) Actions are no longer taken when you call Item_Model::__set().
   Instead, they're all queued up and executed when you call
   Item_Model::save().

Notes:
- item::validate_xxx() functions are now in Item_Model::
- We still call $form->validate() because the form can have
 rules (and forms triggered by events will likely continue to
 have rules.
---
 modules/gallery/controllers/albums.php |  51 ++++--------
 modules/gallery/helpers/album.php      |   9 +--
 modules/gallery/helpers/item.php       |  18 -----
 modules/gallery/models/item.php        | 139 +++++++++++++++++++++------------
 4 files changed, 106 insertions(+), 111 deletions(-)

diff --git a/modules/gallery/controllers/albums.php b/modules/gallery/controllers/albums.php
index 2eeefdf1..8ad3ff72 100644
--- a/modules/gallery/controllers/albums.php
+++ b/modules/gallery/controllers/albums.php
@@ -129,42 +129,27 @@ class Albums_Controller extends Items_Controller {
     access::required("edit", $album);
 
     $form = album::get_edit_form($album);
-    if ($valid = $form->validate()) {
-      if ($album->id != 1 &&
-          $form->edit_item->dirname->value != $album->name ||
-          $form->edit_item->slug->value != $album->slug) {
-        // Make sure that there's not a conflict
-        if ($row = db::build()
-            ->select(array("name", "slug"))
-            ->from("items")
-            ->where("parent_id", "=", $album->parent_id)
-            ->where("id", "<>", $album->id)
-            ->and_open()
-            ->where("name", "=", $form->edit_item->dirname->value)
-            ->or_where("slug", "=", $form->edit_item->slug->value)
-            ->close()
-            ->execute()
-            ->current()) {
-          if ($row->name == $form->edit_item->dirname->value) {
-            $form->edit_item->dirname->add_error("name_conflict", 1);
-          }
-          if ($row->slug == $form->edit_item->slug->value) {
-            $form->edit_item->slug->add_error("slug_conflict", 1);
-          }
-          $valid = false;
-        }
-      }
-    }
-
-    if ($valid) {
+    try {
+      $valid = $form->validate();
       $album->title = $form->edit_item->title->value;
       $album->description = $form->edit_item->description->value;
       $album->sort_column = $form->edit_item->sort_order->column->value;
       $album->sort_order = $form->edit_item->sort_order->direction->value;
-      if ($album->id != 1) {
-        $album->rename($form->edit_item->dirname->value);
-      }
+      $album->name = $form->edit_item->dirname->value;
       $album->slug = $form->edit_item->slug->value;
+      $album->validate();
+    } catch (ORM_Validation_Exception $e) {
+      // Translate ORM validation errors into form error messages
+      foreach ($e->validation->errors() as $key => $error) {
+        if ($key == "name") {
+          $key = "dirname";
+        }
+        $form->edit_item->inputs[$key]->add_error($error, 1);
+      }
+      $valid = false;
+    }
+
+    if ($valid) {
       $album->save();
       module::event("item_edit_form_completed", $album, $form);
 
@@ -180,9 +165,7 @@ class Albums_Controller extends Items_Controller {
         print json_encode(array("result" => "success"));
       }
     } else {
-      print json_encode(
-        array("result" => "error",
-              "form" => $form->__toString()));
+      print json_encode(array("result" => "error", "form" => (string) $form));
     }
   }
 
diff --git a/modules/gallery/helpers/album.php b/modules/gallery/helpers/album.php
index feaf74cc..477f1945 100644
--- a/modules/gallery/helpers/album.php
+++ b/modules/gallery/helpers/album.php
@@ -107,7 +107,6 @@ class album_Core {
         t("The internet address should contain only letters, numbers, hyphens and underscores"));
     $group->hidden("type")->value("album");
     $group->submit("")->value(t("Create"));
-    $form->add_rules_from(ORM::factory("item"));
     $form->script("")
       ->url(url::abs_file("modules/gallery/js/albums_form_add.js"));
     return $form;
@@ -124,15 +123,12 @@ class album_Core {
       $group->input("dirname")->label(t("Directory Name"))->value($parent->name)
         ->rules("required")
         ->error_messages(
-          "name_conflict", t("There is already a movie, photo or album with this name"))
-        ->callback("item::validate_no_slashes")
+          "conflict", t("There is already a movie, photo or album with this name"))
         ->error_messages("no_slashes", t("The directory name can't contain a \"/\""))
-        ->callback("item::validate_no_trailing_period")
         ->error_messages("no_trailing_period", t("The directory name can't end in \".\""));
       $group->input("slug")->label(t("Internet Address"))->value($parent->slug)
         ->error_messages(
-          "slug_conflict", t("There is already a movie, photo or album with this internet address"))
-        ->callback("item::validate_url_safe")
+          "conflict", t("There is already a movie, photo or album with this internet address"))
         ->error_messages(
           "not_url_safe",
           t("The internet address should contain only letters, numbers, hyphens and underscores"));
@@ -159,7 +155,6 @@ class album_Core {
     $group = $form->group("buttons")->label("");
     $group->hidden("type")->value("album");
     $group->submit("")->value(t("Modify"));
-    $form->add_rules_from(ORM::factory("item"));
     return $form;
   }
 
diff --git a/modules/gallery/helpers/item.php b/modules/gallery/helpers/item.php
index 1fd9ef16..53291ccc 100644
--- a/modules/gallery/helpers/item.php
+++ b/modules/gallery/helpers/item.php
@@ -78,24 +78,6 @@ class item_Core {
     graphics::generate($album);
   }
 
-  static function validate_no_slashes($input) {
-    if (strpos($input->value, "/") !== false) {
-      $input->add_error("no_slashes", 1);
-    }
-  }
-
-  static function validate_no_trailing_period($input) {
-    if (rtrim($input->value, ".") !== $input->value) {
-      $input->add_error("no_trailing_period", 1);
-    }
-  }
-
-  static function validate_url_safe($input) {
-    if (preg_match("/[^A-Za-z0-9-_]/", $input->value)) {
-      $input->add_error("not_url_safe", 1);
-    }
-  }
-
   /**
    * Sanitize a filename into something presentable as an item title
    * @param string $filename
diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php
index 4a3d26e9..19bdf655 100644
--- a/modules/gallery/models/item.php
+++ b/modules/gallery/models/item.php
@@ -21,11 +21,11 @@ class Item_Model extends ORM_MPTT {
   protected $children = 'items';
   protected $sorting = array();
 
-  var $form_rules = array(
-    "name" => "required|length[0,255]",
-    "title" => "required|length[0,255]",
-    "description" => "length[0,65535]",
-    "slug" => "required|length[0,255]"
+  var $rules = array(
+    "name"        => array("rules" => array("length[0,255]", "required")),
+    "title"       => array("rules" => array("length[0,255]", "required")),
+    "slug"        => array("rules" => array("length[0,255]", "required")),
+    "description" => array("rules" => array("length[0,65535]"))
   );
 
   /**
@@ -146,21 +146,12 @@ class Item_Model extends ORM_MPTT {
   }
 
   /**
-   * Rename the underlying file for this item to a new name.  Move all the files.  This requires a
-   * save.
+   * Rename the underlying file for this item to a new name and move all related files.
    *
    * @chainable
    */
-  public function rename($new_name) {
-    if ($new_name == $this->name) {
-      return;
-    }
-
-    if (strpos($new_name, "/")) {
-      throw new Exception("@todo NAME_CANNOT_CONTAIN_SLASH");
-    }
-
-    $old_relative_path = urldecode($this->relative_path());
+  private function rename($new_name) {
+    $old_relative_path = urldecode($this->original()->relative_path());
     $new_relative_path = dirname($old_relative_path) . "/" . $new_name;
     if (file_exists(VARPATH . "albums/$new_relative_path")) {
       throw new Exception("@todo INVALID_RENAME_FILE_EXISTS: $new_relative_path");
@@ -178,18 +169,6 @@ class Item_Model extends ORM_MPTT {
       @rename(VARPATH . "thumbs/$old_relative_path", VARPATH . "thumbs/$new_relative_path");
     }
 
-    $this->name = $new_name;
-
-    if ($this->is_album()) {
-      db::build()
-        ->update("items")
-        ->set("relative_url_cache", null)
-        ->set("relative_path_cache", null)
-        ->where("left_ptr", ">", $this->left_ptr)
-        ->where("right_ptr", "<", $this->right_ptr)
-        ->execute();
-    }
-
     return $this;
   }
 
@@ -375,29 +354,6 @@ class Item_Model extends ORM_MPTT {
     }
   }
 
-  /**
-   * @see ORM::__set()
-   */
-  public function __set($column, $value) {
-    if ($column == "name") {
-      $this->relative_path_cache = null;
-    } else if ($column == "slug") {
-      if ($this->slug != $value) {
-        // Clear the relative url cache for this item and all children
-        $this->relative_url_cache = null;
-        if ($this->is_album()) {
-          db::build()
-            ->update("items")
-            ->set("relative_url_cache", null)
-            ->where("left_ptr", ">", $this->left_ptr)
-            ->where("right_ptr", "<", $this->right_ptr)
-            ->execute();
-        }
-      }
-    }
-    parent::__set($column, $value);
-  }
-
   /**
    * @see ORM::save()
    */
@@ -414,9 +370,34 @@ class Item_Model extends ORM_MPTT {
         $this->weight = item::get_max_weight();
       } else {
         $send_event = 1;
+
+        if ($this->original()->name != $this->name) {
+          $this->rename($this->name);
+          $this->relative_path_cache = null;
+        }
+
+        if ($this->original()->slug != $this->slug) {
+          // Clear the relative url cache for this item and all children
+          $this->relative_url_cache = null;
+        }
+
+        // Changing the name or the slug ripples downwards
+        if ($this->is_album() &&
+            ($this->original()->name != $this->name ||
+             $this->original()->slug != $this->slug)) {
+          db::build()
+            ->update("items")
+            ->set("relative_url_cache", null)
+            ->set("relative_path_cache", null)
+            ->where("left_ptr", ">", $this->left_ptr)
+            ->where("right_ptr", "<", $this->right_ptr)
+            ->execute();
+        }
       }
     }
+
     parent::save();
+
     if (isset($send_event)) {
       module::event("item_updated", $this->original(), $this);
     }
@@ -655,4 +636,58 @@ class Item_Model extends ORM_MPTT {
     }
     return parent::descendants($limit, $offset, $where, $order_by);
   }
+
+  /**
+   * Add some custom per-instance rules.
+   */
+  public function validate($array=null) {
+    if (!$array) {
+      // The root item has different rules for the name and slug.
+      if ($this->id == 1) {
+        $this->rules["name"]["rules"][] = "length[0]";
+        $this->rules["slug"]["rules"][] = "length[0]";
+      }
+
+      // Names and slugs can't conflict
+      $this->rules["name"]["callbacks"][] = array($this, "valid_name");
+      $this->rules["slug"]["callbacks"][] = array($this, "valid_slug");
+    }
+
+    parent::validate($array);
+  }
+
+  /**
+   * Validate that the desired slug does not conflict.
+   */
+  public function valid_slug(Validation $v, $value) {
+    if (preg_match("/[^A-Za-z0-9-_]/", $value)) {
+      $v->add_error("slug", "not_url_safe");
+    } else if ($row = db::build()
+        ->from("items")
+        ->where("parent_id", "=", $this->parent_id)
+        ->where("id", "<>", $this->id)
+        ->where("slug", "=", $this->slug)
+        ->count_records()) {
+      $v->add_error("slug", "conflict");
+    }
+  }
+
+  /**
+   * Validate the item name.  It can't conflict with other names, can't contain slashes or
+   * trailing periods.
+   */
+  public function valid_name(Validation $v, $value) {
+    if (strpos($value, "/") !== false) {
+      $v->add_error("name", "no_slashes");
+    } else if (rtrim($value, ".") !== $value) {
+      $v->add_error("name", "no_trailing_period");
+    } else if ($row = db::build()
+               ->from("items")
+               ->where("parent_id", "=", $this->parent_id)
+               ->where("id", "<>", $this->id)
+               ->where("name", "=", $this->name)
+               ->count_records()) {
+      $v->add_error("name", "conflict");
+    }
+  }
 }
-- 
cgit v1.2.3


From 1a557ce5a6e367b37e95915290c092b769ed206a Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 15 Jan 2010 10:36:56 -0800
Subject: Use $value in valid_xxx() functions instead of the member field. 
 They're equivalent, but it's more intuitive this way.

---
 modules/gallery/models/item.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php
index 19bdf655..9edc65ce 100644
--- a/modules/gallery/models/item.php
+++ b/modules/gallery/models/item.php
@@ -666,7 +666,7 @@ class Item_Model extends ORM_MPTT {
         ->from("items")
         ->where("parent_id", "=", $this->parent_id)
         ->where("id", "<>", $this->id)
-        ->where("slug", "=", $this->slug)
+        ->where("slug", "=", $value)
         ->count_records()) {
       $v->add_error("slug", "conflict");
     }
@@ -685,7 +685,7 @@ class Item_Model extends ORM_MPTT {
                ->from("items")
                ->where("parent_id", "=", $this->parent_id)
                ->where("id", "<>", $this->id)
-               ->where("name", "=", $this->name)
+               ->where("name", "=", $value)
                ->count_records()) {
       $v->add_error("name", "conflict");
     }
-- 
cgit v1.2.3


From 94f58e8b65b78cafed8f07f70a48b7b271cfc212 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 15 Jan 2010 10:48:39 -0800
Subject: Move setting Item_Model::rand_key into Item_Model::save() since it's
 business logic.

---
 modules/gallery/helpers/album.php | 1 -
 modules/gallery/helpers/movie.php | 1 -
 modules/gallery/helpers/photo.php | 1 -
 modules/gallery/models/item.php   | 1 +
 4 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/modules/gallery/helpers/album.php b/modules/gallery/helpers/album.php
index 477f1945..52759414 100644
--- a/modules/gallery/helpers/album.php
+++ b/modules/gallery/helpers/album.php
@@ -61,7 +61,6 @@ class album_Core {
     $album->thumb_dirty = 1;
     $album->resize_dirty = 1;
     $album->slug = $slug;
-    $album->rand_key = ((float)mt_rand()) / (float)mt_getrandmax();
     $album->sort_column = "created";
     $album->sort_order = "ASC";
 
diff --git a/modules/gallery/helpers/movie.php b/modules/gallery/helpers/movie.php
index 01859924..b0d24f68 100644
--- a/modules/gallery/helpers/movie.php
+++ b/modules/gallery/helpers/movie.php
@@ -85,7 +85,6 @@ class movie_Core {
     $movie->resize_dirty = 1;
     $movie->sort_column = "weight";
     $movie->slug = $slug;
-    $movie->rand_key = ((float)mt_rand()) / (float)mt_getrandmax();
 
     // Randomize the name if there's a conflict
     // @todo Improve this.  Random numbers are not user friendly
diff --git a/modules/gallery/helpers/photo.php b/modules/gallery/helpers/photo.php
index 4e20e610..aeae7f56 100644
--- a/modules/gallery/helpers/photo.php
+++ b/modules/gallery/helpers/photo.php
@@ -84,7 +84,6 @@ class photo_Core {
     $photo->resize_dirty = 1;
     $photo->sort_column = "weight";
     $photo->slug = $slug;
-    $photo->rand_key = ((float)mt_rand()) / (float)mt_getrandmax();
 
     // Randomize the name or slug if there's a conflict
     // @todo Improve this.  Random numbers are not user friendly
diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php
index 9edc65ce..33b36ff1 100644
--- a/modules/gallery/models/item.php
+++ b/modules/gallery/models/item.php
@@ -368,6 +368,7 @@ class Item_Model extends ORM_MPTT {
       if (!$this->loaded()) {
         $this->created = $this->updated;
         $this->weight = item::get_max_weight();
+        $this->rand_key = ((float)mt_rand()) / (float)mt_getrandmax();
       } else {
         $send_event = 1;
 
-- 
cgit v1.2.3


From 5809949ae8ff87cd5acf56c528e6dc2af6619513 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 15 Jan 2010 11:28:05 -0800
Subject: Don't use Input directly to get album names, etc.  Use the form
 fields.

---
 modules/gallery/controllers/albums.php | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/modules/gallery/controllers/albums.php b/modules/gallery/controllers/albums.php
index 8ad3ff72..9f8c16ea 100644
--- a/modules/gallery/controllers/albums.php
+++ b/modules/gallery/controllers/albums.php
@@ -95,16 +95,16 @@ class Albums_Controller extends Items_Controller {
     access::required("view", $album);
     access::required("add", $album);
 
-    $input = Input::instance();
     $form = album::get_add_form($album);
     if ($form->validate()) {
       $new_album = album::create(
         $album,
-        $input->post("name"),
-        $input->post("title", $input->post("name")),
-        $input->post("description"),
+        $form->add_album->inputs["name"]->value,
+        $form->add_album->title->value ?
+          $form->add_album->title->value : $form->add_album->inputs["name"]->value,
+        $form->add_album->description->value,
         identity::active_user()->id,
-        $input->post("slug"));
+        $form->add_album->slug->value);
 
       log::success("content", "Created an album",
                    html::anchor("albums/$new_album->id", "view album"));
-- 
cgit v1.2.3


From 50e3cc5837df7b0ae8e2d43a3dacee7500ba6db8 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 15 Jan 2010 12:15:20 -0800
Subject: Move model business logic out of album::create() and into
 Item_Model::save().  This makes creating albums similar to editing them and
 makes it difficult to create an album poorly.  I expect to be able to remove
 a lot of code from the photo and movie helper because it's duplicated here.

In order to do this, I refactored ORM_MPTT::add_to_parent() into
ORM_MPTT::save() so we now add it to the parent when we do save.  This
allows us to call save() only once which saves a database call per
add.

The Albums_Controller logic is roughly the same as before.

Haven't updated the tests yet, they're going to fail miserably since
many of them depend on album::create() which is now gone.
---
 modules/gallery/controllers/albums.php | 42 +++++++++++--------
 modules/gallery/helpers/album.php      | 67 ------------------------------
 modules/gallery/libraries/ORM_MPTT.php | 59 +++++++++++++-------------
 modules/gallery/models/item.php        | 75 +++++++++++++++++++++++++++++-----
 4 files changed, 118 insertions(+), 125 deletions(-)

diff --git a/modules/gallery/controllers/albums.php b/modules/gallery/controllers/albums.php
index 9f8c16ea..7658a913 100644
--- a/modules/gallery/controllers/albums.php
+++ b/modules/gallery/controllers/albums.php
@@ -96,29 +96,35 @@ class Albums_Controller extends Items_Controller {
     access::required("add", $album);
 
     $form = album::get_add_form($album);
-    if ($form->validate()) {
-      $new_album = album::create(
-        $album,
-        $form->add_album->inputs["name"]->value,
-        $form->add_album->title->value ?
-          $form->add_album->title->value : $form->add_album->inputs["name"]->value,
-        $form->add_album->description->value,
-        identity::active_user()->id,
-        $form->add_album->slug->value);
+    try {
+      $valid = $form->validate();
+      $album = ORM::factory("item");
+      $album->type = "album";
+      $album->parent_id = $parent_id;
+      $album->name = $form->add_album->inputs["name"]->value;
+      $album->title = $form->add_album->title->value ?
+        $form->add_album->title->value : $form->add_album->inputs["name"]->value;
+      $album->description = $form->add_album->description->value;
+      $album->slug = $form->add_album->slug->value;
+      $album->validate();
+    } catch (ORM_Validation_Exception $e) {
+      // Translate ORM validation errors into form error messages
+      foreach ($e->validation->errors() as $key => $error) {
+        $form->add_album->inputs[$key]->add_error($error, 1);
+      }
+      $valid = false;
+    }
 
+    if ($valid) {
+      $album->save();
       log::success("content", "Created an album",
-                   html::anchor("albums/$new_album->id", "view album"));
+                   html::anchor("albums/$album->id", "view album"));
       message::success(t("Created album %album_title",
-                         array("album_title" => html::purify($new_album->title))));
+                         array("album_title" => html::purify($album->title))));
 
-      print json_encode(
-        array("result" => "success",
-              "location" => $new_album->url()));
+      print json_encode(array("result" => "success", "location" => $album->url()));
     } else {
-      print json_encode(
-        array(
-          "result" => "error",
-          "form" => $form->__toString()));
+      print json_encode(array("result" => "error", "form" => (string) $form));
     }
   }
 
diff --git a/modules/gallery/helpers/album.php b/modules/gallery/helpers/album.php
index 52759414..e99770e9 100644
--- a/modules/gallery/helpers/album.php
+++ b/modules/gallery/helpers/album.php
@@ -24,71 +24,6 @@
  * Note: by design, this class does not do any permission checking.
  */
 class album_Core {
-  /**
-   * Create a new album.
-   * @param integer $parent_id id of parent album
-   * @param string  $name the name of this new album (it will become the directory name on disk)
-   * @param integer $title the title of the new album
-   * @param string  $description (optional) the longer description of this album
-   * @param string  $slug (optional) the url component for this photo
-   * @return Item_Model
-   */
-  static function create($parent, $name, $title, $description=null, $owner_id=null, $slug=null) {
-    if (!$parent->loaded() || !$parent->is_album()) {
-      throw new Exception("@todo INVALID_PARENT");
-    }
-
-    if (strpos($name, "/")) {
-      throw new Exception("@todo NAME_CANNOT_CONTAIN_SLASH");
-    }
-
-    // We don't allow trailing periods as a security measure
-    // ref: http://dev.kohanaphp.com/issues/684
-    if (rtrim($name, ".") != $name) {
-      throw new Exception("@todo NAME_CANNOT_END_IN_PERIOD");
-    }
-
-    if (empty($slug)) {
-      $slug = item::convert_filename_to_slug($name);
-    }
-
-    $album = ORM::factory("item");
-    $album->type = "album";
-    $album->title = $title;
-    $album->description = $description;
-    $album->name = $name;
-    $album->owner_id = $owner_id;
-    $album->thumb_dirty = 1;
-    $album->resize_dirty = 1;
-    $album->slug = $slug;
-    $album->sort_column = "created";
-    $album->sort_order = "ASC";
-
-    // Randomize the name or slug if there's a conflict
-    // @todo Improve this.  Random numbers are not user friendly
-    while (ORM::factory("item")
-           ->where("parent_id", "=", $parent->id)
-           ->and_open()
-           ->where("name", "=", $album->name)
-           ->or_where("slug", "=", $album->slug)
-           ->close()
-           ->find()->id) {
-      $rand = rand();
-      $album->name = "{$name}-$rand";
-      $album->slug = "{$slug}-$rand";
-    }
-
-    $album = $album->add_to_parent($parent);
-    mkdir($album->file_path());
-    mkdir(dirname($album->thumb_path()));
-    mkdir(dirname($album->resize_path()));
-
-    // @todo: publish this from inside Item_Model::save() when we refactor to the point where
-    // there's only one save() happening here.
-    module::event("item_created", $album);
-
-    return $album;
-  }
 
   static function get_add_form($parent) {
     $form = new Forge("albums/create/{$parent->id}", "", "post", array("id" => "g-add-album-form"));
@@ -97,10 +32,8 @@ class album_Core {
     $group->input("title")->label(t("Title"));
     $group->textarea("description")->label(t("Description"));
     $group->input("name")->label(t("Directory name"))
-      ->callback("item::validate_no_slashes")
       ->error_messages("no_slashes", t("The directory name can't contain the \"/\" character"));
     $group->input("slug")->label(t("Internet Address"))
-      ->callback("item::validate_url_safe")
       ->error_messages(
         "not_url_safe",
         t("The internet address should contain only letters, numbers, hyphens and underscores"));
diff --git a/modules/gallery/libraries/ORM_MPTT.php b/modules/gallery/libraries/ORM_MPTT.php
index ed77cac9..46ae0af8 100644
--- a/modules/gallery/libraries/ORM_MPTT.php
+++ b/modules/gallery/libraries/ORM_MPTT.php
@@ -40,44 +40,43 @@ class ORM_MPTT_Core extends ORM {
   }
 
   /**
-   * Add this node as a child of the parent provided.
+   * Overload ORM::save() to update the MPTT tree when we add new items to the hierarchy.
    *
    * @chainable
-   * @param integer $parent_id the id of the parent node
-   * @return ORM
+   * @return  ORM
    */
-  function add_to_parent($parent) {
-    $this->lock();
-    $parent->reload();  // Assume that the prior lock holder may have changed the parent
+  function save() {
+    if (!$this->loaded()) {
+      $this->lock();
+      $parent = ORM::factory("item")->where("id", "=", $this->parent_id)->find();
 
-    try {
-      // Make a hole in the parent for this new item
-      $this->db_builder
-        ->update($this->table_name)
-        ->set("left_ptr", new Database_Expression("`left_ptr` + 2"))
-        ->where("left_ptr", ">=", $parent->right_ptr)
-        ->execute();
-      $this->db_builder
-        ->update($this->table_name)
-        ->set("right_ptr", new Database_Expression("`right_ptr` + 2"))
-        ->where("right_ptr", ">=", $parent->right_ptr)
-        ->execute();
-      $parent->right_ptr += 2;
+      try {
+        // Make a hole in the parent for this new item
+        $this->db_builder
+          ->update($this->table_name)
+          ->set("left_ptr", new Database_Expression("`left_ptr` + 2"))
+          ->where("left_ptr", ">=", $parent->right_ptr)
+          ->execute();
+        $this->db_builder
+          ->update($this->table_name)
+          ->set("right_ptr", new Database_Expression("`right_ptr` + 2"))
+          ->where("right_ptr", ">=", $parent->right_ptr)
+          ->execute();
+        $parent->right_ptr += 2;
 
-      // Insert this item into the hole
-      $this->left_ptr = $parent->right_ptr - 2;
-      $this->right_ptr = $parent->right_ptr - 1;
-      $this->parent_id = $parent->id;
-      $this->level = $parent->level + 1;
-      $this->save();
-      $parent->reload();
-    } catch (Exception $e) {
+        // Insert this item into the hole
+        $this->left_ptr = $parent->right_ptr - 2;
+        $this->right_ptr = $parent->right_ptr - 1;
+        $this->parent_id = $parent->id;
+        $this->level = $parent->level + 1;
+      } catch (Exception $e) {
+        $this->unlock();
+        throw $e;
+      }
       $this->unlock();
-      throw $e;
     }
 
-    $this->unlock();
-    return $this;
+    return parent::save();
   }
 
   /**
diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php
index 33b36ff1..e929f30d 100644
--- a/modules/gallery/models/item.php
+++ b/modules/gallery/models/item.php
@@ -25,7 +25,8 @@ class Item_Model extends ORM_MPTT {
     "name"        => array("rules" => array("length[0,255]", "required")),
     "title"       => array("rules" => array("length[0,255]", "required")),
     "slug"        => array("rules" => array("length[0,255]", "required")),
-    "description" => array("rules" => array("length[0,65535]"))
+    "description" => array("rules" => array("length[0,65535]")),
+    "parent_id"   => array("rules" => array("Item_Model::valid_parent"))
   );
 
   /**
@@ -355,7 +356,10 @@ class Item_Model extends ORM_MPTT {
   }
 
   /**
+   * Handle any business logic necessary to create an item.
    * @see ORM::save()
+   *
+   * @return ORM Item_Model
    */
   public function save() {
     $significant_changes = $this->changed;
@@ -366,12 +370,55 @@ class Item_Model extends ORM_MPTT {
     if (!empty($this->changed) && $significant_changes) {
       $this->updated = time();
       if (!$this->loaded()) {
+        // Create a new item.  Use whatever fields are set, and specify defaults for the rest.
         $this->created = $this->updated;
         $this->weight = item::get_max_weight();
         $this->rand_key = ((float)mt_rand()) / (float)mt_getrandmax();
-      } else {
-        $send_event = 1;
+        $this->thumb_dirty = 1;
+        $this->resize_dirty = 1;
+        if (empty($this->sort_column)) {
+          $this->sort_column = "created";
+        }
+        if (empty($this->sort_order)) {
+          $this->sort_order = "ASC";
+        }
+        if (empty($this->owner_id)) {
+          $this->owner_id = identity::active_user()->id;
+        }
+        if (empty($this->slug)) {
+          $tmp = pathinfo($this->name, PATHINFO_FILENAME);
+          $tmp = preg_replace("/[^A-Za-z0-9-_]+/", "-", $tmp);
+          $this->slug = trim($tmp, "-");
+        }
+
+        // Randomize the name or slug if there's a conflict
+        // @todo Improve this.  Random numbers are not user friendly
+        $base_name = $this->name;
+        $base_slug = $this->slug;
+        while (ORM::factory("item")
+               ->where("parent_id", "=", $this->parent_id)
+               ->and_open()
+               ->where("name", "=", $this->name)
+               ->or_where("slug", "=", $this->slug)
+               ->close()
+               ->find()->id) {
+          $rand = rand();
+          $this->name = "$base_name-$rand";
+          $this->slug = "$base_slug-$rand";
+        }
+
+        parent::save();
 
+        // Call this after we finish saving so that the paths are correct.
+        if ($this->is_album()) {
+          mkdir($this->file_path());
+          mkdir(dirname($this->thumb_path()));
+          mkdir(dirname($this->resize_path()));
+        }
+
+        module::event("item_created", $this);
+      } else {
+        // Update an existing item
         if ($this->original()->name != $this->name) {
           $this->rename($this->name);
           $this->relative_path_cache = null;
@@ -394,14 +441,11 @@ class Item_Model extends ORM_MPTT {
             ->where("right_ptr", "<", $this->right_ptr)
             ->execute();
         }
+        parent::save();
+        module::event("item_updated", $this->original(), $this);
       }
     }
 
-    parent::save();
-
-    if (isset($send_event)) {
-      module::event("item_updated", $this->original(), $this);
-    }
     return $this;
   }
 
@@ -663,7 +707,7 @@ class Item_Model extends ORM_MPTT {
   public function valid_slug(Validation $v, $value) {
     if (preg_match("/[^A-Za-z0-9-_]/", $value)) {
       $v->add_error("slug", "not_url_safe");
-    } else if ($row = db::build()
+    } else if (db::build()
         ->from("items")
         ->where("parent_id", "=", $this->parent_id)
         ->where("id", "<>", $this->id)
@@ -682,7 +726,7 @@ class Item_Model extends ORM_MPTT {
       $v->add_error("name", "no_slashes");
     } else if (rtrim($value, ".") !== $value) {
       $v->add_error("name", "no_trailing_period");
-    } else if ($row = db::build()
+    } else if (db::build()
                ->from("items")
                ->where("parent_id", "=", $this->parent_id)
                ->where("id", "<>", $this->id)
@@ -691,4 +735,15 @@ class Item_Model extends ORM_MPTT {
       $v->add_error("name", "conflict");
     }
   }
+
+  /**
+   * Make sure that the parent id refers to an album.
+   */
+  static function valid_parent($value) {
+    return db::build()
+      ->from("items")
+      ->where("id", "=", $value)
+      ->where("type", "=", "album")
+      ->count_records() == 1;
+  }
 }
-- 
cgit v1.2.3


From 1066e64354ff44f88c7dd0de3bb3e50411458523 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 15 Jan 2010 12:41:22 -0800
Subject: Call parent::save() before releasing the lock to make creating the
 hole and filling it an atomic operation.

---
 modules/gallery/libraries/ORM_MPTT.php | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/modules/gallery/libraries/ORM_MPTT.php b/modules/gallery/libraries/ORM_MPTT.php
index 46ae0af8..404d61ff 100644
--- a/modules/gallery/libraries/ORM_MPTT.php
+++ b/modules/gallery/libraries/ORM_MPTT.php
@@ -73,10 +73,13 @@ class ORM_MPTT_Core extends ORM {
         $this->unlock();
         throw $e;
       }
+      parent::save();
       $this->unlock();
+    } else {
+      parent::save();
     }
 
-    return parent::save();
+    return $this;
   }
 
   /**
-- 
cgit v1.2.3


From 654b103355f1bda15246e651fa91f3c9e08c3901 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 15 Jan 2010 13:41:46 -0800
Subject: Validate the model type.

---
 modules/gallery/models/item.php | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php
index e929f30d..395ba52c 100644
--- a/modules/gallery/models/item.php
+++ b/modules/gallery/models/item.php
@@ -26,7 +26,8 @@ class Item_Model extends ORM_MPTT {
     "title"       => array("rules" => array("length[0,255]", "required")),
     "slug"        => array("rules" => array("length[0,255]", "required")),
     "description" => array("rules" => array("length[0,65535]")),
-    "parent_id"   => array("rules" => array("Item_Model::valid_parent"))
+    "parent_id"   => array("rules" => array("Item_Model::valid_parent")),
+    "type"        => array("rules" => array("Item_Model::valid_type")),
   );
 
   /**
@@ -736,6 +737,13 @@ class Item_Model extends ORM_MPTT {
     }
   }
 
+  /**
+   * Make sure that the type is valid.
+   */
+  static function valid_type($value) {
+    return in_array($value, array("album", "photo", "movie"));
+  }
+
   /**
    * Make sure that the parent id refers to an album.
    */
-- 
cgit v1.2.3


From bf085a1a176f32546f86988049e0c3f809842ce7 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 16 Jan 2010 00:51:31 -0800
Subject: Convert photo uploading over to the new model based validation
 approach.

- Rearrange Simple_Uploader_Controller::add_photo() to validate
  the form early in the process, and switch to using model based
  validation.

- Move thumbnail generation into gallery_event::item_created() so
  that it's decoupled from the model.

- Delete photo::create() and move all of its logic into
  Item_Model::save().

- Add Item_Model::$data_file to track the data file associated
  with new movies and photos.

- Do some cleanup on the validation callbacks -- it turns out the
  2nd argument is the field name not the value.
---
 modules/gallery/controllers/simple_uploader.php |  40 ++++---
 modules/gallery/helpers/gallery_event.php       |  16 +++
 modules/gallery/helpers/photo.php               | 112 -------------------
 modules/gallery/models/item.php                 | 139 +++++++++++++++++++-----
 4 files changed, 151 insertions(+), 156 deletions(-)

diff --git a/modules/gallery/controllers/simple_uploader.php b/modules/gallery/controllers/simple_uploader.php
index 5d32e35f..7a7e7557 100644
--- a/modules/gallery/controllers/simple_uploader.php
+++ b/modules/gallery/controllers/simple_uploader.php
@@ -40,39 +40,45 @@ class Simple_Uploader_Controller extends Controller {
     access::required("add", $album);
     access::verify_csrf();
 
+    // The Flash uploader not call /start directly, so simulate it here for now.
+    if (!batch::in_progress()) {
+      batch::start();
+    }
+
+    $form = $this->_get_add_form($album);
+
+    // Uploadify adds its own field to the form, so validate that separately.
     $file_validation = new Validation($_FILES);
     $file_validation->add_rules(
       "Filedata", "upload::valid",  "upload::required", "upload::type[gif,jpg,jpeg,png,flv,mp4]");
-    if ($file_validation->validate()) {
-      // SimpleUploader.swf does not yet call /start directly, so simulate it here for now.
-      if (!batch::in_progress()) {
-        batch::start();
-      }
 
+    if ($form->validate() && $file_validation->validate()) {
       $temp_filename = upload::save("Filedata");
       try {
-        $name = substr(basename($temp_filename), 10);  // Skip unique identifier Kohana adds
-        $title = item::convert_filename_to_title($name);
+        $item = ORM::factory("item");
+        $item->name = substr(basename($temp_filename), 10);  // Skip unique identifier Kohana adds
+        $item->title = item::convert_filename_to_title($item->name);
+        $item->parent_id = $album->id;
+        $item->set_data_file($temp_filename);
+
         $path_info = @pathinfo($temp_filename);
         if (array_key_exists("extension", $path_info) &&
             in_array(strtolower($path_info["extension"]), array("flv", "mp4"))) {
-          $item = movie::create($album, $temp_filename, $name, $title);
+          $item->type = "movie";
+          $item->save();
           log::success("content", t("Added a movie"),
                        html::anchor("movies/$item->id", t("view movie")));
         } else {
-          $item = photo::create($album, $temp_filename, $name, $title);
+          $item->type = "photo";
+          $item->save();
           log::success("content", t("Added a photo"),
                        html::anchor("photos/$item->id", t("view photo")));
         }
 
-        // We currently have no way of showing errors if validation fails, so only call our event
-        // handlers if validation passes.
-        $form = $this->_get_add_form($album);
-        if ($form->validate()) {
-          module::event("add_photos_form_completed", $item, $form);
-        }
+        module::event("add_photos_form_completed", $item, $form);
       } catch (Exception $e) {
-        Kohana_Log::add("alert", $e->__toString());
+        // The Flash uploader has no good way of reporting complex errors, so just keep it simple.
+        Kohana_Log::add("error", $e->getMessage() . "\n" . $e->getTraceAsString());
         if (file_exists($temp_filename)) {
           unlink($temp_filename);
         }
@@ -84,7 +90,7 @@ class Simple_Uploader_Controller extends Controller {
       print "FILEID: $item->id";
     } else {
       header("HTTP/1.1 400 Bad Request");
-      print "ERROR: " . t("Invalid Upload");
+      print "ERROR: " . t("Invalid upload");
     }
   }
 
diff --git a/modules/gallery/helpers/gallery_event.php b/modules/gallery/helpers/gallery_event.php
index 679d65c2..9452e855 100644
--- a/modules/gallery/helpers/gallery_event.php
+++ b/modules/gallery/helpers/gallery_event.php
@@ -73,6 +73,22 @@ class gallery_event_Core {
 
   static function item_created($item) {
     access::add_item($item);
+
+    if ($item->is_photo() || $item->is_movie()) {
+      // Build our thumbnail/resizes.
+      try {
+        graphics::generate($item);
+      } catch (Exception $e) {
+        log::failure("Unable to create a thumbnail for item id {$item->id}");
+        Kohana_Log::add("error", $e->getMessage() . "\n" . $e->getTraceAsString());
+      }
+
+      // If the parent has no cover item, make this it.
+      $parent = $item->parent();
+      if (access::can("edit", $parent) && $parent->album_cover_item_id == null)  {
+        item::make_album_cover($item);
+      }
+    }
   }
 
   static function item_deleted($item) {
diff --git a/modules/gallery/helpers/photo.php b/modules/gallery/helpers/photo.php
index aeae7f56..74e30409 100644
--- a/modules/gallery/helpers/photo.php
+++ b/modules/gallery/helpers/photo.php
@@ -24,118 +24,6 @@
  * Note: by design, this class does not do any permission checking.
  */
 class photo_Core {
-  /**
-   * Create a new photo.
-   * @param integer $parent parent album
-   * @param string  $filename path to the photo file on disk
-   * @param string  $name the filename to use for this photo in the album
-   * @param integer $title the title of the new photo
-   * @param string  $description (optional) the longer description of this photo
-   * @param string  $slug (optional) the url component for this photo
-   * @return Item_Model
-   */
-  static function create($parent, $filename, $name, $title,
-                         $description=null, $owner_id=null, $slug=null) {
-    if (!$parent->loaded() || !$parent->is_album()) {
-      throw new Exception("@todo INVALID_PARENT");
-    }
-
-    if (!is_file($filename)) {
-      throw new Exception("@todo MISSING_IMAGE_FILE");
-    }
-
-    if (strpos($name, "/")) {
-      throw new Exception("@todo NAME_CANNOT_CONTAIN_SLASH");
-    }
-
-    // We don't allow trailing periods as a security measure
-    // ref: http://dev.kohanaphp.com/issues/684
-    if (rtrim($name, ".") != $name) {
-      throw new Exception("@todo NAME_CANNOT_END_IN_PERIOD");
-    }
-
-    if (filesize($filename) == 0) {
-      throw new Exception("@todo EMPTY_INPUT_FILE");
-    }
-
-    $image_info = getimagesize($filename);
-
-    // Force an extension onto the name
-    $pi = pathinfo($filename);
-    if (empty($pi["extension"])) {
-      $pi["extension"] = image_type_to_extension($image_info[2], false);
-      $name .= "." . $pi["extension"];
-    }
-
-    if (empty($slug)) {
-      $slug = item::convert_filename_to_slug($name);
-    }
-
-    $photo = ORM::factory("item");
-    $photo->type = "photo";
-    $photo->title = $title;
-    $photo->description = $description;
-    $photo->name = $name;
-    $photo->owner_id = $owner_id ? $owner_id : identity::active_user()->id;
-    $photo->width = $image_info[0];
-    $photo->height = $image_info[1];
-    $photo->mime_type = empty($image_info['mime']) ? "application/unknown" : $image_info['mime'];
-    $photo->thumb_dirty = 1;
-    $photo->resize_dirty = 1;
-    $photo->sort_column = "weight";
-    $photo->slug = $slug;
-
-    // Randomize the name or slug if there's a conflict
-    // @todo Improve this.  Random numbers are not user friendly
-    while (ORM::factory("item")
-           ->where("parent_id", "=", $parent->id)
-           ->and_open()
-           ->where("name", "=", $photo->name)
-           ->or_where("slug", "=", $photo->slug)
-           ->close()
-           ->find()->id) {
-      $rand = rand();
-      $photo->name = "{$name}.$rand.{$pi['extension']}";
-      $photo->slug = "{$slug}-$rand";
-    }
-
-    // This saves the photo
-    $photo->add_to_parent($parent);
-
-    /*
-     * If the thumb or resize already exists then rename it. We need to do this after the save
-     * because the resize_path and thumb_path both call relative_path which caches the
-     * path. Before add_to_parent the relative path will be incorrect.
-     */
-    if (file_exists($photo->resize_path()) ||
-        file_exists($photo->thumb_path())) {
-      $photo->name = $pi["filename"] . "-" . rand() . "." . $pi["extension"];
-      $photo->save();
-    }
-
-    copy($filename, $photo->file_path());
-
-    // @todo: publish this from inside Item_Model::save() when we refactor to the point where
-    // there's only one save() happening here.
-    module::event("item_created", $photo);
-
-    // Build our thumbnail/resizes.  If we fail to build thumbnail/resize we assume that the image
-    // is bad in some way and discard it.
-    try {
-      graphics::generate($photo);
-    } catch (Exception $e) {
-      $photo->delete();
-      throw $e;
-    }
-
-    // If the parent has no cover item, make this it.
-    if (access::can("edit", $parent) && $parent->album_cover_item_id == null)  {
-      item::make_album_cover($photo);
-    }
-
-    return $photo;
-  }
-
   static function get_edit_form($photo) {
     $form = new Forge("photos/update/$photo->id", "", "post", array("id" => "g-edit-photo-form"));
     $form->hidden("from_id");
diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php
index 46b0304e..977b9771 100644
--- a/modules/gallery/models/item.php
+++ b/modules/gallery/models/item.php
@@ -20,13 +20,13 @@
 class Item_Model extends ORM_MPTT {
   protected $children = 'items';
   protected $sorting = array();
+  protected $data_file = null;
 
   var $rules = array(
     "name"        => array("rules" => array("length[0,255]", "required")),
     "title"       => array("rules" => array("length[0,255]", "required")),
     "slug"        => array("rules" => array("length[0,255]", "required")),
     "description" => array("rules" => array("length[0,65535]")),
-    "parent_id"   => array("rules" => array("Item_Model::valid_parent")),
     "type"        => array("rules" => array("Item_Model::valid_type")),
   );
 
@@ -174,6 +174,14 @@ class Item_Model extends ORM_MPTT {
     return $this;
   }
 
+  /**
+   * Specify the path to the data file associated with this item.  To actually associate it,
+   * you still have to call save().
+   */
+  public function set_data_file($data_file) {
+    $this->data_file = $data_file;
+  }
+
   /**
    * Return the server-relative url to this item, eg:
    *   /gallery3/index.php/BobsWedding?page=2
@@ -304,7 +312,7 @@ class Item_Model extends ORM_MPTT {
     }
     $this->relative_path_cache = implode($names, "/");
     $this->relative_url_cache = implode($slugs, "/");
-    $this->save();
+    return $this;
   }
 
   /**
@@ -319,7 +327,7 @@ class Item_Model extends ORM_MPTT {
     }
 
     if (!isset($this->relative_path_cache)) {
-      $this->_build_relative_caches();
+      $this->_build_relative_caches()->save();
     }
     return $this->relative_path_cache;
   }
@@ -334,7 +342,7 @@ class Item_Model extends ORM_MPTT {
     }
 
     if (!isset($this->relative_url_cache)) {
-      $this->_build_relative_caches();
+      $this->_build_relative_caches()->save();
     }
     return $this->relative_url_cache;
   }
@@ -368,6 +376,7 @@ class Item_Model extends ORM_MPTT {
     unset($significant_changes["relative_url_cache"]);
     unset($significant_changes["relative_path_cache"]);
 
+
     if (!empty($this->changed) && $significant_changes) {
       $this->updated = time();
       if (!$this->loaded()) {
@@ -386,15 +395,37 @@ class Item_Model extends ORM_MPTT {
         if (empty($this->owner_id)) {
           $this->owner_id = identity::active_user()->id;
         }
+
+        // Make an url friendly slug from the name, if necessary
         if (empty($this->slug)) {
           $tmp = pathinfo($this->name, PATHINFO_FILENAME);
           $tmp = preg_replace("/[^A-Za-z0-9-_]+/", "-", $tmp);
           $this->slug = trim($tmp, "-");
         }
 
-        // Randomize the name or slug if there's a conflict
+        if ($this->is_movie() || $this->is_photo()) {
+          $image_info = getimagesize($this->data_file);
+
+          if ($this->is_photo()) {
+            $this->width = $image_info[0];
+            $this->height = $image_info[1];
+            $this->mime_type =
+              empty($image_info['mime']) ? "application/unknown" : $image_info['mime'];
+          }
+
+          // Force an extension onto the name if necessary
+          $pi = pathinfo($this->data_file);
+          if (empty($pi["extension"])) {
+            $pi["extension"] = image_type_to_extension($image_info[2], false);
+            $this->name .= "." . $pi["extension"];
+          }
+
+        }
+
+        // Randomize the name or slug if there's a conflict.  Preserve the extension.
         // @todo Improve this.  Random numbers are not user friendly
-        $base_name = $this->name;
+        $base_name = pathinfo($this->name, PATHINFO_FILENAME);
+        $base_ext = pathinfo($this->name, PATHINFO_EXTENSION);
         $base_slug = $this->slug;
         while (ORM::factory("item")
                ->where("parent_id", "=", $this->parent_id)
@@ -404,19 +435,46 @@ class Item_Model extends ORM_MPTT {
                ->close()
                ->find()->id) {
           $rand = rand();
-          $this->name = "$base_name-$rand";
+          if ($base_ext) {
+            $this->name = "$base_name-$rand.$base_ext";
+          } else {
+            $this->name = "$base_name-$rand";
+          }
           $this->slug = "$base_slug-$rand";
         }
 
         parent::save();
 
-        // Call this after we finish saving so that the paths are correct.
-        if ($this->is_album()) {
+        // Build our url caches and save again.  If we could depend on a save happening later we
+        // could defer this 2nd save.
+        $this->_build_relative_caches();
+        parent::save();
+
+        // Take any actions that we can only do once all our paths are set correctly after saving.
+        switch ($this->type) {
+        case "album":
           mkdir($this->file_path());
           mkdir(dirname($this->thumb_path()));
           mkdir(dirname($this->resize_path()));
+          break;
+
+        case "photo":
+          // The thumb or resize may already exist in the case where a movie and a photo generate
+          // a thumbnail of the same name (eg, foo.flv movie and foo.jpg photo will generate
+          // foo.jpg thumbnail).  If that happens, randomize and save again.
+          if (file_exists($this->resize_path()) ||
+              file_exists($this->thumb_path())) {
+            $pi = pathinfo($this->name);
+            $this->name = $pi["filename"] . "-" . rand() . "." . $pi["extension"];
+            parent::save();
+          }
+
+          copy($this->data_file, $this->file_path());
+          break;
         }
 
+        // This will almost definitely trigger another save, so put it at the end so that we're
+        // tail recursive.
         module::event("item_created", $this);
       } else {
         // Update an existing item
@@ -691,8 +749,8 @@ class Item_Model extends ORM_MPTT {
     if (!$array) {
       // The root item has different rules for the name and slug.
       if ($this->id == 1) {
-        $this->rules["name"]["rules"][] = "length[0]";
-        $this->rules["slug"]["rules"][] = "length[0]";
+        $this->rules["name"] = array("rules" => array("length[0]"));
+        $this->rules["slug"] = array("rules" => array("length[0]"));
       }
 
       // Names and slugs can't conflict
@@ -700,20 +758,28 @@ class Item_Model extends ORM_MPTT {
       $this->rules["slug"]["callbacks"][] = array($this, "valid_slug");
     }
 
+    // Movies and photos must have data files
+    if ($this->is_photo() || $this->is_movie() && !$this->loaded()) {
+      $this->rules["name"]["callbacks"][] = array($this, "valid_data_file");
+    }
+
+    // All items must have a legal parent
+    $this->rules["parent_id"]["callbacks"][] = array($this, "valid_parent");
+
     parent::validate($array);
   }
 
   /**
    * Validate that the desired slug does not conflict.
    */
-  public function valid_slug(Validation $v, $value) {
-    if (preg_match("/[^A-Za-z0-9-_]/", $value)) {
+  public function valid_slug(Validation $v, $field) {
+    if (preg_match("/[^A-Za-z0-9-_]/", $this->slug)) {
       $v->add_error("slug", "not_url_safe");
     } else if (db::build()
         ->from("items")
         ->where("parent_id", "=", $this->parent_id)
         ->where("id", "<>", $this->id)
-        ->where("slug", "=", $value)
+        ->where("slug", "=", $this->slug)
         ->count_records()) {
       $v->add_error("slug", "conflict");
     }
@@ -723,36 +789,55 @@ class Item_Model extends ORM_MPTT {
    * Validate the item name.  It can't conflict with other names, can't contain slashes or
    * trailing periods.
    */
-  public function valid_name(Validation $v, $value) {
-    if (strpos($value, "/") !== false) {
+  public function valid_name(Validation $v, $field) {
+    if (strpos($this->name, "/") !== false) {
       $v->add_error("name", "no_slashes");
-    } else if (rtrim($value, ".") !== $value) {
+    } else if (rtrim($this->name, ".") !== $this->name) {
       $v->add_error("name", "no_trailing_period");
     } else if (db::build()
                ->from("items")
                ->where("parent_id", "=", $this->parent_id)
                ->where("id", "<>", $this->id)
-               ->where("name", "=", $value)
+               ->where("name", "=", $this->name)
                ->count_records()) {
       $v->add_error("name", "conflict");
     }
   }
 
   /**
-   * Make sure that the type is valid.
+   * Make sure that the data file is well formed (it exists and isn't empty).
    */
-  static function valid_type($value) {
-    return in_array($value, array("album", "photo", "movie"));
+  public function valid_data_file(Validation $v, $field) {
+    if (!is_file($this->data_file)) {
+      $v->add_error("file", "bad_path");
+    } else if (filesize($this->data_file) == 0) {
+      $v->add_error("file", "empty_file");
+    }
   }
 
   /**
    * Make sure that the parent id refers to an album.
    */
-  static function valid_parent($value) {
-    return db::build()
-      ->from("items")
-      ->where("id", "=", $value)
-      ->where("type", "=", "album")
-      ->count_records() == 1;
+  public function valid_parent(Validation $v, $field) {
+    if ($this->id == 1) {
+      if ($this->parent_id != 0) {
+        $v->add_error("parent_id", "invalid");
+      }
+    } else {
+      if (db::build()
+          ->from("items")
+          ->where("id", "=", $this->parent_id)
+          ->where("type", "=", "album")
+          ->count_records() != 1) {
+        $v->add_error("parent_id", "invalid");
+      }
+    }
+  }
+
+  /**
+   * Make sure that the type is valid.
+   */
+  static function valid_type($value) {
+    return in_array($value, array("album", "photo", "movie"));
   }
 }
-- 
cgit v1.2.3


From 9f6dba723842cc16dd3f3787d232028c6c0c2e19 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 16 Jan 2010 11:12:19 -0800
Subject: Check for illegal extensions in valid_name() Fix a bug where we were
 not calling valid_data_file correctly.

---
 modules/gallery/models/item.php | 31 +++++++++++++++++++++++--------
 1 file changed, 23 insertions(+), 8 deletions(-)

diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php
index 977b9771..a9607699 100644
--- a/modules/gallery/models/item.php
+++ b/modules/gallery/models/item.php
@@ -759,7 +759,7 @@ class Item_Model extends ORM_MPTT {
     }
 
     // Movies and photos must have data files
-    if ($this->is_photo() || $this->is_movie() && !$this->loaded()) {
+    if (($this->is_photo() || $this->is_movie()) && !$this->loaded()) {
       $this->rules["name"]["callbacks"][] = array($this, "valid_data_file");
     }
 
@@ -792,14 +792,29 @@ class Item_Model extends ORM_MPTT {
   public function valid_name(Validation $v, $field) {
     if (strpos($this->name, "/") !== false) {
       $v->add_error("name", "no_slashes");
-    } else if (rtrim($this->name, ".") !== $this->name) {
+      return;
+    }
+
+    if (rtrim($this->name, ".") !== $this->name) {
       $v->add_error("name", "no_trailing_period");
-    } else if (db::build()
-               ->from("items")
-               ->where("parent_id", "=", $this->parent_id)
-               ->where("id", "<>", $this->id)
-               ->where("name", "=", $this->name)
-               ->count_records()) {
+      return;
+    }
+
+    if ($this->is_movie() || $this->is_photo()) {
+      $new_ext = pathinfo($this->name, PATHINFO_EXTENSION);
+      $old_ext = pathinfo($this->original()->name, PATHINFO_EXTENSION);
+      if (strcasecmp($new_ext, $old_ext)) {
+        $v->add_error("name", "illegal_extension");
+        return;
+      }
+    }
+
+    if (db::build()
+        ->from("items")
+        ->where("parent_id", "=", $this->parent_id)
+        ->where("id", "<>", $this->id)
+        ->where("name", "=", $this->name)
+        ->count_records()) {
       $v->add_error("name", "conflict");
     }
   }
-- 
cgit v1.2.3


From 5a8449f16d3c0db8fb47acf515d319d6eb9e87f4 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 16 Jan 2010 11:12:27 -0800
Subject: Convert Photos_Controller::update() to use model based validation.

---
 modules/gallery/controllers/photos.php | 55 ++++++++++------------------------
 modules/gallery/helpers/photo.php      | 10 ++-----
 2 files changed, 17 insertions(+), 48 deletions(-)

diff --git a/modules/gallery/controllers/photos.php b/modules/gallery/controllers/photos.php
index 56b454ce..98f2126d 100644
--- a/modules/gallery/controllers/photos.php
+++ b/modules/gallery/controllers/photos.php
@@ -61,48 +61,25 @@ class Photos_Controller extends Items_Controller {
     access::required("edit", $photo);
 
     $form = photo::get_edit_form($photo);
-    $valid = $form->validate();
-
-    if ($valid) {
-      $new_ext = pathinfo($form->edit_item->filename->value, PATHINFO_EXTENSION);
-      $old_ext = pathinfo($photo->name, PATHINFO_EXTENSION);
-      if (strcasecmp($new_ext, $old_ext)) {
-        $form->edit_item->filename->add_error("illegal_extension", 1);
-        $valid = false;
-      }
-    }
-
-    if ($valid) {
-      if ($form->edit_item->filename->value != $photo->name ||
-          $form->edit_item->slug->value != $photo->slug) {
-        // Make sure that there's not a name or slug conflict
-        if ($row = db::build()
-            ->select(array("name", "slug"))
-            ->from("items")
-            ->where("parent_id", "=", $photo->parent_id)
-            ->where("id", "<>", $photo->id)
-            ->and_open()
-            ->where("name", "=", $form->edit_item->filename->value)
-            ->or_where("slug", "=", $form->edit_item->slug->value)
-            ->close()
-            ->execute()
-            ->current()) {
-          if ($row->name == $form->edit_item->filename->value) {
-            $form->edit_item->filename->add_error("name_conflict", 1);
-          }
-          if ($row->slug == $form->edit_item->slug->value) {
-            $form->edit_item->slug->add_error("slug_conflict", 1);
-          }
-          $valid = false;
+    try {
+      $valid = $form->validate();
+      $photo->title = $form->edit_item->title->value;
+      $photo->description = $form->edit_item->description->value;
+      $photo->slug = $form->edit_item->slug->value;
+      $photo->name = $form->edit_item->filename->value;
+      $photo->validate();
+    } catch (ORM_Validation_Exception $e) {
+      // Translate ORM validation errors into form error messages
+      foreach ($e->validation->errors() as $key => $error) {
+        if ($key == "name") {
+          $key = "filename";
         }
+        $form->edit_item->inputs[$key]->add_error($error, 1);
       }
+      $valid = false;
     }
 
     if ($valid) {
-      $photo->title = $form->edit_item->title->value;
-      $photo->description = $form->edit_item->description->value;
-      $photo->slug = $form->edit_item->slug->value;
-      $photo->rename($form->edit_item->filename->value);
       $photo->save();
       module::event("item_edit_form_completed", $photo, $form);
 
@@ -118,9 +95,7 @@ class Photos_Controller extends Items_Controller {
         print json_encode(array("result" => "success"));
       }
     } else {
-      print json_encode(
-        array("result" => "error",
-              "form" => $form->__toString()));
+      print json_encode(array("result" => "error", "form" => (string) $form));
     }
   }
 
diff --git a/modules/gallery/helpers/photo.php b/modules/gallery/helpers/photo.php
index 74e30409..cb94772e 100644
--- a/modules/gallery/helpers/photo.php
+++ b/modules/gallery/helpers/photo.php
@@ -31,18 +31,13 @@ class photo_Core {
     $group->input("title")->label(t("Title"))->value($photo->title);
     $group->textarea("description")->label(t("Description"))->value($photo->description);
     $group->input("filename")->label(t("Filename"))->value($photo->name)
-      ->rules("required")
-      ->error_messages(
-        "name_conflict", t("There is already a movie, photo or album with this name"))
-      ->callback("item::validate_no_slashes")
+      ->error_messages("conflict", t("There is already a movie, photo or album with this name"))
       ->error_messages("no_slashes", t("The photo name can't contain a \"/\""))
-      ->callback("item::validate_no_trailing_period")
       ->error_messages("no_trailing_period", t("The photo name can't end in \".\""))
       ->error_messages("illegal_extension", t("You cannot change the filename extension"));
     $group->input("slug")->label(t("Internet Address"))->value($photo->slug)
-      ->callback("item::validate_url_safe")
       ->error_messages(
-        "slug_conflict", t("There is already a movie, photo or album with this internet address"))
+        "conflict", t("There is already a movie, photo or album with this internet address"))
       ->error_messages(
         "not_url_safe",
         t("The internet address should contain only letters, numbers, hyphens and underscores"));
@@ -51,7 +46,6 @@ class photo_Core {
 
     $group = $form->group("buttons")->label("");
     $group->submit("")->value(t("Modify"));
-    $form->add_rules_from(ORM::factory("item"));
     return $form;
   }
 
-- 
cgit v1.2.3


From b5a6a6a5d5741f592d504b8a444899964101b6b6 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 16 Jan 2010 11:44:21 -0800
Subject: Oops, log::failure() doesn't exist.  Use log::error().

---
 modules/gallery/helpers/gallery_event.php | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/modules/gallery/helpers/gallery_event.php b/modules/gallery/helpers/gallery_event.php
index 9452e855..db3b34fe 100644
--- a/modules/gallery/helpers/gallery_event.php
+++ b/modules/gallery/helpers/gallery_event.php
@@ -79,7 +79,9 @@ class gallery_event_Core {
       try {
         graphics::generate($item);
       } catch (Exception $e) {
-        log::failure("Unable to create a thumbnail for item id {$item->id}");
+        log::error("graphics", t("Couldn't create a thumbnail or resize for %item_title",
+                                 array("item_title" => $item->title)),
+                   html::anchor($item->abs_url(), t("details")));
         Kohana_Log::add("error", $e->getMessage() . "\n" . $e->getTraceAsString());
       }
 
-- 
cgit v1.2.3


From efdb73cb986002806dfe3c9241f792652e4b56fa Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 16 Jan 2010 12:00:50 -0800
Subject: Make movie creation use model based validation.  Move movie related
 logic from movie::create() into Item_Model

---
 modules/gallery/controllers/simple_uploader.php |   7 ++
 modules/gallery/helpers/movie.php               | 103 ------------------------
 modules/gallery/models/item.php                 |  77 +++++++++++-------
 3 files changed, 55 insertions(+), 132 deletions(-)

diff --git a/modules/gallery/controllers/simple_uploader.php b/modules/gallery/controllers/simple_uploader.php
index 7a7e7557..16d1d241 100644
--- a/modules/gallery/controllers/simple_uploader.php
+++ b/modules/gallery/controllers/simple_uploader.php
@@ -79,6 +79,13 @@ class Simple_Uploader_Controller extends Controller {
       } catch (Exception $e) {
         // The Flash uploader has no good way of reporting complex errors, so just keep it simple.
         Kohana_Log::add("error", $e->getMessage() . "\n" . $e->getTraceAsString());
+
+        // Ugh.  I hate to use instanceof, But this beats catching the exception separately since
+        // we mostly want to treat it the same way as all other exceptions
+        if ($e instanceof ORM_Validation_Exception) {
+          Kohana_Log::add("error", "Validation errors: " . print_r($e->validation->errors(), 1));
+        }
+
         if (file_exists($temp_filename)) {
           unlink($temp_filename);
         }
diff --git a/modules/gallery/helpers/movie.php b/modules/gallery/helpers/movie.php
index b0d24f68..0a27ac94 100644
--- a/modules/gallery/helpers/movie.php
+++ b/modules/gallery/helpers/movie.php
@@ -24,109 +24,6 @@
  * Note: by design, this class does not do any permission checking.
  */
 class movie_Core {
-  /**
-   * Create a new movie.
-   * @param integer $parent_id id of parent album
-   * @param string  $filename path to the photo file on disk
-   * @param string  $name the filename to use for this photo in the album
-   * @param integer $title the title of the new photo
-   * @param string  $description (optional) the longer description of this photo
-   * @param string  $slug (optional) the url component for this photo
-   * @return Item_Model
-   */
-  static function create($parent, $filename, $name, $title,
-                         $description=null, $owner_id=null, $slug=null) {
-    if (!$parent->loaded() || !$parent->is_album()) {
-      throw new Exception("@todo INVALID_PARENT");
-    }
-
-    if (!is_file($filename)) {
-      throw new Exception("@todo MISSING_MOVIE_FILE");
-    }
-
-    if (strpos($name, "/")) {
-      throw new Exception("@todo NAME_CANNOT_CONTAIN_SLASH");
-    }
-
-    // We don't allow trailing periods as a security measure
-    // ref: http://dev.kohanaphp.com/issues/684
-    if (rtrim($name, ".") != $name) {
-      throw new Exception("@todo NAME_CANNOT_END_IN_PERIOD");
-    }
-
-    try {
-      $movie_info = movie::getmoviesize($filename);
-    } catch (Exception $e) {
-      // Assuming this is MISSING_FFMPEG for now
-      $movie_info = getimagesize(MODPATH . "gallery/images/missing_movie.png");
-    }
-
-    // Force an extension onto the name
-    $pi = pathinfo($filename);
-    if (empty($pi["extension"])) {
-      $pi["extension"] = image_type_to_extension($movie_info[2], false);
-      $name .= "." . $pi["extension"];
-    }
-
-    if (empty($slug)) {
-      $slug = item::convert_filename_to_slug($name);
-    }
-
-    $movie = ORM::factory("item");
-    $movie->type = "movie";
-    $movie->title = $title;
-    $movie->description = $description;
-    $movie->name = $name;
-    $movie->owner_id = $owner_id ? $owner_id : identity::active_user()->id;
-    $movie->width = $movie_info[0];
-    $movie->height = $movie_info[1];
-    $movie->mime_type = strtolower($pi["extension"]) == "mp4" ? "video/mp4" : "video/x-flv";
-    $movie->thumb_dirty = 1;
-    $movie->resize_dirty = 1;
-    $movie->sort_column = "weight";
-    $movie->slug = $slug;
-
-    // Randomize the name if there's a conflict
-    // @todo Improve this.  Random numbers are not user friendly
-    while (ORM::factory("item")
-           ->where("parent_id", "=", $parent->id)
-           ->and_open()
-           ->where("name", "=", $movie->name)
-           ->or_where("slug", "=", $movie->slug)
-           ->close()
-           ->find()->id) {
-      $rand = rand();
-      $movie->name = "{$name}.$rand.{$pi['extension']}";
-      $movie->slug = "{$slug}-$rand";
-    }
-
-    // This saves the photo
-    $movie->add_to_parent($parent);
-
-    // If the thumb or resize already exists then rename it
-    if (file_exists($movie->resize_path()) ||
-        file_exists($movie->thumb_path())) {
-      $movie->name = $pi["filename"] . "-" . rand() . "." . $pi["extension"];
-      $movie->save();
-    }
-
-    copy($filename, $movie->file_path());
-
-    // @todo: publish this from inside Item_Model::save() when we refactor to the point where
-    // there's only one save() happening here.
-    module::event("item_created", $movie);
-
-    // Build our thumbnail
-    graphics::generate($movie);
-
-    // If the parent has no cover item, make this it.
-    if (access::can("edit", $parent) && $parent->album_cover_item_id == null)  {
-      item::make_album_cover($movie);
-    }
-
-    return $movie;
-  }
-
   static function get_edit_form($movie) {
     $form = new Forge("movies/update/$movie->id", "", "post", array("id" => "g-edit-movie-form"));
     $form->hidden("from_id");
diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php
index a9607699..c007afeb 100644
--- a/modules/gallery/models/item.php
+++ b/modules/gallery/models/item.php
@@ -376,7 +376,6 @@ class Item_Model extends ORM_MPTT {
     unset($significant_changes["relative_url_cache"]);
     unset($significant_changes["relative_path_cache"]);
 
-
     if (!empty($this->changed) && $significant_changes) {
       $this->updated = time();
       if (!$this->loaded()) {
@@ -403,23 +402,32 @@ class Item_Model extends ORM_MPTT {
           $this->slug = trim($tmp, "-");
         }
 
+        // Get the width, height and mime type from our data file for photos and movies.
         if ($this->is_movie() || $this->is_photo()) {
-          $image_info = getimagesize($this->data_file);
+          $pi = pathinfo($this->data_file);
 
           if ($this->is_photo()) {
+            $image_info = getimagesize($this->data_file);
             $this->width = $image_info[0];
             $this->height = $image_info[1];
-            $this->mime_type =
-              empty($image_info['mime']) ? "application/unknown" : $image_info['mime'];
-          }
+            $this->mime_type = $image_info["mime"];
 
-          // Force an extension onto the name if necessary
-          $pi = pathinfo($this->data_file);
-          if (empty($pi["extension"])) {
-            $pi["extension"] = image_type_to_extension($image_info[2], false);
-            $this->name .= "." . $pi["extension"];
-          }
+            // Force an extension onto the name if necessary
+            if (empty($pi["extension"])) {
+              $pi["extension"] = image_type_to_extension($image_info[2], false);
+              $this->name .= "." . $pi["extension"];
+            }
+          } else {
+            list ($this->width, $this->height) = movie::getmoviesize($this->data_file);
 
+            // No extension?  Assume FLV.
+            if (empty($pi["extension"])) {
+              $pi["extension"] = "flv";
+              $this->name .= "." . $pi["extension"];
+            }
+
+            $this->mime_type = strtolower($pi["extension"]) == "mp4" ? "video/mp4" : "video/x-flv";
+          }
         }
 
         // Randomize the name or slug if there's a conflict.  Preserve the extension.
@@ -445,8 +453,9 @@ class Item_Model extends ORM_MPTT {
 
         parent::save();
 
-        // Build our url caches and save again.  If we could depend on a save happening later we
-        // could defer this 2nd save.
+        // Build our url caches, then save again.  We have to do this after it's already been
+        // saved once because we use only information from the database to build the paths.  If we
+        // could depend on a save happening later we could defer this 2nd save.
         $this->_build_relative_caches();
         parent::save();
 
@@ -459,6 +468,7 @@ class Item_Model extends ORM_MPTT {
           break;
 
         case "photo":
+        case "movie":
           // The thumb or resize may already exist in the case where a movie and a photo generate
           // a thumbnail of the same name (eg, foo.flv movie and foo.jpg photo will generate
           // foo.jpg thumbnail).  If that happens, randomize and save again.
@@ -746,26 +756,27 @@ class Item_Model extends ORM_MPTT {
    * Add some custom per-instance rules.
    */
   public function validate($array=null) {
+    // validate() is recursive, only modify the rules on the outermost call.
     if (!$array) {
-      // The root item has different rules for the name and slug.
       if ($this->id == 1) {
+        // Root album can't have a name or slug
         $this->rules["name"] = array("rules" => array("length[0]"));
         $this->rules["slug"] = array("rules" => array("length[0]"));
+      } else {
+        // Layer some callbacks on top of the existing rules
+        $this->rules["name"]["callbacks"] = array(array($this, "valid_name"));
+        $this->rules["slug"]["callbacks"] = array(array($this, "valid_slug"));
       }
 
-      // Names and slugs can't conflict
-      $this->rules["name"]["callbacks"][] = array($this, "valid_name");
-      $this->rules["slug"]["callbacks"][] = array($this, "valid_slug");
-    }
+      // Movies and photos must have data files
+      if (($this->is_photo() || $this->is_movie()) && !$this->loaded()) {
+        $this->rules["name"]["callbacks"][] = array($this, "valid_data_file");
+      }
 
-    // Movies and photos must have data files
-    if (($this->is_photo() || $this->is_movie()) && !$this->loaded()) {
-      $this->rules["name"]["callbacks"][] = array($this, "valid_data_file");
+      // All items must have a legal parent
+      $this->rules["parent_id"]["callbacks"] = array(array($this, "valid_parent"));
     }
 
-    // All items must have a legal parent
-    $this->rules["parent_id"]["callbacks"][] = array($this, "valid_parent");
-
     parent::validate($array);
   }
 
@@ -801,11 +812,19 @@ class Item_Model extends ORM_MPTT {
     }
 
     if ($this->is_movie() || $this->is_photo()) {
-      $new_ext = pathinfo($this->name, PATHINFO_EXTENSION);
-      $old_ext = pathinfo($this->original()->name, PATHINFO_EXTENSION);
-      if (strcasecmp($new_ext, $old_ext)) {
-        $v->add_error("name", "illegal_extension");
-        return;
+      if ($this->loaded()) {
+        // Existing items can't change their extension
+        $new_ext = pathinfo($this->name, PATHINFO_EXTENSION);
+        $old_ext = pathinfo($this->original()->name, PATHINFO_EXTENSION);
+        if (strcasecmp($new_ext, $old_ext)) {
+          $v->add_error("name", "illegal_extension");
+          return;
+        }
+      } else {
+        // New items must have an extension
+        if (!pathinfo($this->name, PATHINFO_EXTENSION)) {
+          $v->add_error("name", "illegal_extension");
+        }
       }
     }
 
-- 
cgit v1.2.3


From 8ce11ac97062f63eb6d0c5ef261bdf9ff6727ed2 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 16 Jan 2010 12:07:36 -0800
Subject: Convert Movies_Controller::update() over to model based validation.

---
 modules/gallery/controllers/movies.php | 55 ++++++++++------------------------
 modules/gallery/helpers/movie.php      | 10 ++-----
 2 files changed, 18 insertions(+), 47 deletions(-)

diff --git a/modules/gallery/controllers/movies.php b/modules/gallery/controllers/movies.php
index 7a8e4d2a..0908e281 100644
--- a/modules/gallery/controllers/movies.php
+++ b/modules/gallery/controllers/movies.php
@@ -61,48 +61,25 @@ class Movies_Controller extends Items_Controller {
     access::required("edit", $movie);
 
     $form = movie::get_edit_form($movie);
-    $valid = $form->validate();
-
-    if ($valid) {
-      $new_ext = pathinfo($form->edit_item->filename->value, PATHINFO_EXTENSION);
-      $old_ext = pathinfo($movie->name, PATHINFO_EXTENSION);
-      if (strcasecmp($new_ext, $old_ext)) {
-        $form->edit_item->filename->add_error("illegal_extension", 1);
-        $valid = false;
-      }
-    }
-
-    if ($valid) {
-      if ($form->edit_item->filename->value != $movie->name ||
-          $form->edit_item->slug->value != $movie->slug) {
-        // Make sure that there's not a name or slug conflict
-        if ($row = db::build()
-            ->select(array("name", "slug"))
-            ->from("items")
-            ->where("parent_id", "=", $movie->parent_id)
-            ->where("id", "<>", $movie->id)
-            ->and_open()
-            ->where("name", "=", $form->edit_item->filename->value)
-            ->or_where("slug", "=", $form->edit_item->slug->value)
-            ->close()
-            ->execute()
-            ->current()) {
-          if ($row->name == $form->edit_item->filename->value) {
-            $form->edit_item->filename->add_error("name_conflict", 1);
-          }
-          if ($row->slug == $form->edit_item->slug->value) {
-            $form->edit_item->slug->add_error("slug_conflict", 1);
-          }
-          $valid = false;
+    try {
+      $valid = $form->validate();
+      $movie->title = $form->edit_item->title->value;
+      $movie->description = $form->edit_item->description->value;
+      $movie->slug = $form->edit_item->slug->value;
+      $movie->name = $form->edit_item->filename->value;
+      $movie->validate();
+    } catch (ORM_Validation_Exception $e) {
+      // Translate ORM validation errors into form error messages
+      foreach ($e->validation->errors() as $key => $error) {
+        if ($key == "name") {
+          $key = "filename";
         }
+        $form->edit_item->inputs[$key]->add_error($error, 1);
       }
+      $valid = false;
     }
 
     if ($valid) {
-      $movie->title = $form->edit_item->title->value;
-      $movie->description = $form->edit_item->description->value;
-      $movie->slug = $form->edit_item->slug->value;
-      $movie->rename($form->edit_item->filename->value);
       $movie->save();
       module::event("item_edit_form_completed", $movie, $form);
 
@@ -118,9 +95,7 @@ class Movies_Controller extends Items_Controller {
         print json_encode(array("result" => "success"));
       }
     } else {
-      print json_encode(
-        array("result" => "error",
-              "form" => $form->__toString()));
+      print json_encode(array("result" => "error", "form" => (string) $form));
     }
   }
 
diff --git a/modules/gallery/helpers/movie.php b/modules/gallery/helpers/movie.php
index 0a27ac94..b2e846d3 100644
--- a/modules/gallery/helpers/movie.php
+++ b/modules/gallery/helpers/movie.php
@@ -31,18 +31,14 @@ class movie_Core {
     $group->input("title")->label(t("Title"))->value($movie->title);
     $group->textarea("description")->label(t("Description"))->value($movie->description);
     $group->input("filename")->label(t("Filename"))->value($movie->name)
-      ->rules("required")
       ->error_messages(
-        "name_conflict", t("There is already a movie, photo or album with this name"))
-      ->callback("item::validate_no_slashes")
+        "conflict", t("There is already a movie, photo or album with this name"))
       ->error_messages("no_slashes", t("The movie name can't contain a \"/\""))
-      ->callback("item::validate_no_trailing_period")
       ->error_messages("no_trailing_period", t("The movie name can't end in \".\""))
       ->error_messages("illegal_extension", t("You cannot change the filename extension"));
     $group->input("slug")->label(t("Internet Address"))->value($movie->slug)
-      ->callback("item::validate_url_safe")
       ->error_messages(
-        "slug_conflict", t("There is already a movie, photo or album with this internet address"))
+        "conflict", t("There is already a movie, photo or album with this internet address"))
       ->error_messages(
         "not_url_safe",
         t("The internet address should contain only letters, numbers, hyphens and underscores"));
@@ -51,7 +47,7 @@ class movie_Core {
 
     $group = $form->group("buttons")->label("");
     $group->submit("")->value(t("Modify"));
-    $form->add_rules_from(ORM::factory("item"));
+
     return $form;
   }
 
-- 
cgit v1.2.3


From ff728b3ccd329e988220ca2857b3dcd989ebad37 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 16 Jan 2010 17:51:57 -0800
Subject: Whitespace.

---
 modules/user/controllers/admin_users.php | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/modules/user/controllers/admin_users.php b/modules/user/controllers/admin_users.php
index 96b86fff..ab747528 100644
--- a/modules/user/controllers/admin_users.php
+++ b/modules/user/controllers/admin_users.php
@@ -21,12 +21,8 @@ class Admin_Users_Controller extends Admin_Controller {
   public function index() {
     $view = new Admin_View("admin.html");
     $view->content = new View("admin_users.html");
-    $view->content->users = ORM::factory("user")
-      ->order_by("name", "ASC")
-      ->find_all();
-    $view->content->groups = ORM::factory("group")
-      ->order_by("name", "ASC")
-      ->find_all();
+    $view->content->users = ORM::factory("user")->order_by("name", "ASC")->find_all();
+    $view->content->groups = ORM::factory("group")->order_by("name", "ASC")->find_all();
     print $view;
   }
 
-- 
cgit v1.2.3


From 7f20f660791a8276e6f74232e6b941cf20c8c1a7 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 16 Jan 2010 18:00:02 -0800
Subject: Whitespace.

---
 modules/user/views/user_form.html.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/user/views/user_form.html.php b/modules/user/views/user_form.html.php
index 039ae8a5..4ce2b532 100644
--- a/modules/user/views/user_form.html.php
+++ b/modules/user/views/user_form.html.php
@@ -1,5 +1,5 @@
 <?php defined("SYSPATH") or die("No direct script access.") ?>
-<script  type="text/javascript">
+<script type="text/javascript">
   $("form").ready(function(){
     $('input[name="password"]').user_password_strength();
   });
-- 
cgit v1.2.3


From a5aacfa4a650ed5830331b8c81f68ea1625cd3ba Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 16 Jan 2010 18:10:40 -0800
Subject: Don't forget to save when we make insignificant chagnes only.

---
 modules/gallery/models/item.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php
index c007afeb..56ee321a 100644
--- a/modules/gallery/models/item.php
+++ b/modules/gallery/models/item.php
@@ -514,6 +514,10 @@ class Item_Model extends ORM_MPTT {
         parent::save();
         module::event("item_updated", $original, $this);
       }
+    } else if (!empty($this->changed)) {
+      // Insignificant changes only.  Don't fire events or do any special checking to try to keep
+      // this lightweight.
+      parent::save();
     }
 
     return $this;
-- 
cgit v1.2.3


From fdcb4a1f32d8a7d153462da00129524ffa0f69b8 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 16 Jan 2010 18:16:47 -0800
Subject: PHPdoc.

---
 modules/gallery/models/item.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php
index 56ee321a..869e3b27 100644
--- a/modules/gallery/models/item.php
+++ b/modules/gallery/models/item.php
@@ -365,7 +365,7 @@ class Item_Model extends ORM_MPTT {
   }
 
   /**
-   * Handle any business logic necessary to create an item.
+   * Handle any business logic necessary to create or modify an item.
    * @see ORM::save()
    *
    * @return ORM Item_Model
-- 
cgit v1.2.3


From a691dcc63cb6403784e061997cc85606a8f953b3 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 16 Jan 2010 19:58:55 -0800
Subject: Convert Admin_Users::add_user() to use model based validation.  Get
 the rules and business logic out of the form and user::create(), and move it
 into User_Model::save().

---
 modules/user/controllers/admin_users.php | 39 ++++++++---------
 modules/user/helpers/user.php            | 26 ------------
 modules/user/models/user.php             | 72 ++++++++++++++++++++++++++------
 3 files changed, 78 insertions(+), 59 deletions(-)

diff --git a/modules/user/controllers/admin_users.php b/modules/user/controllers/admin_users.php
index ab747528..7f08f8a1 100644
--- a/modules/user/controllers/admin_users.php
+++ b/modules/user/controllers/admin_users.php
@@ -30,31 +30,33 @@ class Admin_Users_Controller extends Admin_Controller {
     access::verify_csrf();
 
     $form = $this->_get_user_add_form_admin();
-    $valid = $form->validate();
-    $name = $form->add_user->inputs["name"]->value;
-    if ($user = user::lookup_by_name($name)) {
-      $form->add_user->inputs["name"]->add_error("in_use", 1);
+    try {
+      $user = ORM::factory("user");
+      $valid = $form->validate();
+      $user->name = $form->add_user->inputs["name"]->value;
+      $user->full_name = $form->add_user->full_name->value;
+      $user->password = $form->add_user->password->value;
+      $user->email = $form->add_user->email->value;
+
+      if (!empty($form->add_user->locale->value)) {
+        $user->locale = $form->add_user->locale->value;
+      }
+      $user->validate();
+    } catch (ORM_Validation_Exception $e) {
+      // Translate ORM validation errors into form error messages
+      foreach ($e->validation->errors() as $key => $error) {
+        $form->add_user->inputs[$key]->add_error($error, 1);
+      }
       $valid = false;
     }
 
     if ($valid) {
-      $user = user::create(
-        $name, $form->add_user->full_name->value, $form->add_user->password->value);
-      $user->email = $form->add_user->email->value;
-      $user->admin = $form->add_user->admin->checked;
-
-      if ($form->add_user->locale) {
-        $desired_locale = $form->add_user->locale->value;
-        $user->locale = $desired_locale == "none" ? null : $desired_locale;
-      }
       $user->save();
       module::event("user_add_form_admin_completed", $user, $form);
-
       message::success(t("Created user %user_name", array("user_name" => $user->name)));
       print json_encode(array("result" => "success"));
     } else {
-      print json_encode(array("result" => "error",
-                              "form" => $form->__toString()));
+      print json_encode(array("result" => "error", "form" => (string) $form));
     }
   }
 
@@ -329,11 +331,6 @@ class Admin_Users_Controller extends Admin_Controller {
     $group->input("url")->label(t("URL"))->id("g-url");
     self::_add_locale_dropdown($group);
     $group->checkbox("admin")->label(t("Admin"))->id("g-admin");
-    $form->add_rules_from(ORM::factory("user"));
-
-    $minimum_length = module::get_var("user", "mininum_password_length", 5);
-    $form->add_user->password
-      ->rules($minimum_length ? "required|length[$minimum_length, 40]" : "length[40]");
 
     module::event("user_add_form_admin", $user, $form);
     $group->submit("")->value(t("Add user"));
diff --git a/modules/user/helpers/user.php b/modules/user/helpers/user.php
index e092aecc..3561021f 100644
--- a/modules/user/helpers/user.php
+++ b/modules/user/helpers/user.php
@@ -35,32 +35,6 @@ class user_Core {
     return model_cache::get("user", 1);
   }
 
-  /**
-   * Create a new user.
-   *
-   * @param string  $name
-   * @param string  $full_name
-   * @param string  $password
-   * @return User_Model
-   */
-  static function create($name, $full_name, $password) {
-    $user = ORM::factory("user")->where("name", "=", $name)->find();
-    if ($user->loaded()) {
-      throw new Exception("@todo USER_ALREADY_EXISTS $name");
-    }
-
-    $user->name = $name;
-    $user->full_name = $full_name;
-    $user->password = $password;
-
-    // Required groups
-    $user->add(group::everybody());
-    $user->add(group::registered_users());
-
-    $user->save();
-    return $user;
-  }
-
   /**
    * Is the password provided correct?
    *
diff --git a/modules/user/models/user.php b/modules/user/models/user.php
index edba2a2c..12da5784 100644
--- a/modules/user/models/user.php
+++ b/modules/user/models/user.php
@@ -19,14 +19,16 @@
  */
 class User_Model extends ORM implements User_Definition {
   protected $has_and_belongs_to_many = array("groups");
+  protected $password_length = null;
 
-  var $form_rules = array(
-    "name" => "required|length[1,32]",
-    "full_name" => "length[0,255]",
-    "email" => "required|valid_email|length[1,255]",
-    "password" => "length[1,40]",
-    "url" => "valid_url",
-    "locale" => "length[2,10]");
+  var $rules = array(
+    "name"      => array("rules" => array("length[1,32]", "required")),
+    "locale"    => array("rules" => array("length[2,10]")),
+    "password"  => array("rules" => array("length[5,40]")),  // note: overridden in validate()
+    "email"     => array("rules" => array("length[1,255]", "required", "valid::email")),
+    "full_name" => array("rules" => array("length[0,255]")),
+    "url"       => array("rules" => array("valid::url")),
+  );
 
   public function __set($column, $value) {
     switch ($column) {
@@ -35,6 +37,7 @@ class User_Model extends ORM implements User_Definition {
       break;
 
     case "password":
+      $this->password_length = strlen($value);
       $value = user::hash_password($value);
       break;
     }
@@ -65,18 +68,41 @@ class User_Model extends ORM implements User_Definition {
     return $this->groups->find_all();
   }
 
+  /**
+   * Add some custom per-instance rules.
+   */
+  public function validate($array=null) {
+    // validate() is recursive, only modify the rules on the outermost call.
+    if (!$array) {
+      $this->rules["name"]["callbacks"] = array(array($this, "valid_name"));
+    }
+
+    $this->rules["password"]["callbacks"] = array(array($this, "valid_password"));
+
+    parent::validate($array);
+  }
+
+  /**
+   * Handle any business logic necessary to create or update a user.
+   * @see ORM::save()
+   *
+   * @return ORM User_Model
+   */
   public function save() {
     if (!$this->loaded()) {
-        $created = 1;
-    }
+      // New user
+      $this->add(group::everybody());
+      $this->add(group::registered_users());
 
-    $original = clone $this->original();
-    parent::save();
-    if (isset($created)) {
+      parent::save();
       module::event("user_created", $this);
     } else {
+      // Updated user
+      $original = clone $this->original();
+      parent::save();
       module::event("user_updated", $original, $this);
     }
+
     return $this;
   }
 
@@ -88,4 +114,26 @@ class User_Model extends ORM implements User_Definition {
   public function display_name() {
     return empty($this->full_name) ? $this->name : $this->full_name;
   }
+
+  /**
+   * Validate the user name.  Make sure there are no conflicts.
+   */
+  public function valid_name(Validation $v, $field) {
+    if (db::build()->from("users")
+        ->where("name", "=", $this->name)
+        ->where("id", "<>", $this->id)
+        ->count_records() == 1) {
+      $v->add_error("name", "in_use");
+    }
+  }
+
+  /**
+   * Validate the password.
+   */
+  public function valid_password(Validation $v, $field) {
+    $minimum_length = module::get_var("user", "mininum_password_length", 5);
+    if ($this->password_length < $minimum_length || $this->password_length > 40) {
+      $v->add_error("password", "length");
+    }
+  }
 }
-- 
cgit v1.2.3


From 6a4dda9bdef81bcf79abe5601fd7309e593078f3 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 16 Jan 2010 21:15:12 -0800
Subject: Convert Admin_Users_Controller, User_Model and Group_Model to use
 model based validation.

---
 modules/user/controllers/admin_users.php | 115 +++++++++++++------------------
 modules/user/controllers/users.php       |  17 +++--
 modules/user/helpers/group.php           |  17 -----
 modules/user/models/group.php            |  39 ++++++++---
 modules/user/models/user.php             |  18 ++++-
 5 files changed, 103 insertions(+), 103 deletions(-)

diff --git a/modules/user/controllers/admin_users.php b/modules/user/controllers/admin_users.php
index 7f08f8a1..c35eba73 100644
--- a/modules/user/controllers/admin_users.php
+++ b/modules/user/controllers/admin_users.php
@@ -37,10 +37,9 @@ class Admin_Users_Controller extends Admin_Controller {
       $user->full_name = $form->add_user->full_name->value;
       $user->password = $form->add_user->password->value;
       $user->email = $form->add_user->email->value;
-
-      if (!empty($form->add_user->locale->value)) {
-        $user->locale = $form->add_user->locale->value;
-      }
+      $user->url = $form->edit_user->url->value;
+      $user->locale = $form->add_user->locale->value;
+      $user->admin = $form->edit_user->admin->checked;
       $user->validate();
     } catch (ORM_Validation_Exception $e) {
       // Translate ORM validation errors into form error messages
@@ -110,43 +109,34 @@ class Admin_Users_Controller extends Admin_Controller {
     }
 
     $form = $this->_get_user_edit_form_admin($user);
-    $valid = $form->validate();
-    if ($valid) {
-      $new_name = $form->edit_user->inputs["name"]->value;
-      $temp_user = user::lookup_by_name($new_name);
-      if ($new_name != $user->name &&
-          ($temp_user && $temp_user->id != $user->id)) {
-        $form->edit_user->inputs["name"]->add_error("in_use", 1);
-        $valid = false;
-      } else {
-        $user->name = $new_name;
-      }
-    }
-
-    if ($valid) {
+    try {
+      $valid = $form->validate();
+      $user->name = $form->edit_user->inputs["name"]->value;
       $user->full_name = $form->edit_user->full_name->value;
-      if ($form->edit_user->password->value) {
-        $user->password = $form->edit_user->password->value;
-      }
+      $user->password = $form->edit_user->password->value;
       $user->email = $form->edit_user->email->value;
       $user->url = $form->edit_user->url->value;
-      if ($form->edit_user->locale) {
-        $desired_locale = $form->edit_user->locale->value;
-        $user->locale = $desired_locale == "none" ? null : $desired_locale;
-      }
-
-      // An admin can change the admin status for any user but themselves
+      $user->locale = $form->edit_user->locale->value;
       if ($user->id != identity::active_user()->id) {
         $user->admin = $form->edit_user->admin->checked;
       }
+
+      $user->validate();
+    } catch (ORM_Validation_Exception $e) {
+      // Translate ORM validation errors into form error messages
+      foreach ($e->validation->errors() as $key => $error) {
+        $form->edit_user->inputs[$key]->add_error($error, 1);
+      }
+      $valid = false;
+    }
+
+    if ($valid) {
       $user->save();
       module::event("user_edit_form_admin_completed", $user, $form);
-
       message::success(t("Changed user %user_name", array("user_name" => $user->name)));
       print json_encode(array("result" => "success"));
     } else {
-      print json_encode(array("result" => "error",
-                              "form" => $form->__toString()));
+      print json_encode(array("result" => "error", "form" => (string) $form));
     }
   }
 
@@ -191,25 +181,26 @@ class Admin_Users_Controller extends Admin_Controller {
     access::verify_csrf();
 
     $form = $this->_get_group_add_form_admin();
-    $valid = $form->validate();
-    if ($valid) {
-      $new_name = $form->add_group->inputs["name"]->value;
-      $group = group::lookup_by_name($new_name);
-      if (!empty($group)) {
-        $form->add_group->inputs["name"]->add_error("in_use", 1);
-        $valid = false;
+    try {
+      $valid = $form->validate();
+      $group = ORM::factory("group");
+      $group->name = $form->add_group->inputs["name"]->value;
+      $group->validate();
+    } catch (ORM_Validation_Exception $e) {
+      // Translate ORM validation errors into form error messages
+      foreach ($e->validation->errors() as $key => $error) {
+        $form->add_group->inputs[$key]->add_error($error, 1);
       }
+      $valid = false;
     }
 
     if ($valid) {
-      $group = group::create($new_name);
       $group->save();
       message::success(
         t("Created group %group_name", array("group_name" => $group->name)));
       print json_encode(array("result" => "success"));
     } else {
-      print json_encode(array("result" => "error",
-                              "form" => $form->__toString()));
+      print json_encode(array("result" => "error", "form" => (string) $form));
     }
   }
 
@@ -258,19 +249,19 @@ class Admin_Users_Controller extends Admin_Controller {
     }
 
     $form = $this->_get_group_edit_form_admin($group);
-    $valid = $form->validate();
-
-    if ($valid) {
-      $new_name = $form->edit_group->inputs["name"]->value;
-      $group = group::lookup_by_name($name);
-      if ($group->loaded()) {
-        $form->edit_group->inputs["name"]->add_error("in_use", 1);
-        $valid = false;
+    try {
+      $valid = $form->validate();
+      $group->name = $form->edit_group->inputs["name"]->value;
+      $group->validate();
+    } catch (ORM_Validation_Exception $e) {
+      // Translate ORM validation errors into form error messages
+      foreach ($e->validation->errors() as $key => $error) {
+        $form->edit_group->inputs[$key]->add_error($error, 1);
       }
+      $valid = false;
     }
 
     if ($valid) {
-      $group->name = $form->edit_group->inputs["name"]->value;
       $group->save();
       message::success(
         t("Changed group %group_name", array("group_name" => $group->name)));
@@ -278,8 +269,7 @@ class Admin_Users_Controller extends Admin_Controller {
     } else {
       message::error(
         t("Failed to change group %group_name", array("group_name" => $group->name)));
-      print json_encode(array("result" => "error",
-                              "form" => $form->__toString()));
+      print json_encode(array("result" => "error", "form" => (string) $form));
     }
   }
 
@@ -308,10 +298,6 @@ class Admin_Users_Controller extends Admin_Controller {
     $group->input("email")->label(t("Email"))->id("g-email")->value($user->email);
     $group->input("url")->label(t("URL"))->id("g-url")->value($user->url);
     $group->checkbox("admin")->label(t("Admin"))->id("g-admin")->checked($user->admin);
-    $form->add_rules_from($user);
-    $minimum_length = module::get_var("user", "mininum_password_length", 5);
-    $form->edit_user->password
-      ->rules($minimum_length ? "length[$minimum_length, 40]" : "length[40]");
 
     module::event("user_edit_form_admin", $user, $form);
     $group->submit("")->value(t("Modify User"));
@@ -342,15 +328,14 @@ class Admin_Users_Controller extends Admin_Controller {
     foreach ($locales as $locale => $display_name) {
       $locales[$locale] = SafeString::of_safe_html($display_name);
     }
-    if (count($locales) > 1) {
-      // Put "none" at the first position in the array
-      $locales = array_merge(array("" => t("« none »")), $locales);
-      $selected_locale = ($user && $user->locale) ? $user->locale : "";
-      $form->dropdown("locale")
-        ->label(t("Language Preference"))
-        ->options($locales)
-        ->selected($selected_locale);
-    }
+
+    // Put "none" at the first position in the array
+    $locales = array_merge(array("" => t("« none »")), $locales);
+    $selected_locale = ($user && $user->locale) ? $user->locale : "";
+    $form->dropdown("locale")
+      ->label(t("Language Preference"))
+      ->options($locales)
+      ->selected($selected_locale);
   }
 
   private function _get_user_delete_form_admin($user) {
@@ -370,7 +355,6 @@ class Admin_Users_Controller extends Admin_Controller {
     $form_group->inputs["name"]->error_messages(
       "in_use", t("There is already a group with that name"));
     $form_group->submit("")->value(t("Save"));
-    $form->add_rules_from($group);
     return $form;
   }
 
@@ -381,7 +365,6 @@ class Admin_Users_Controller extends Admin_Controller {
     $form_group->inputs["name"]->error_messages(
       "in_use", t("There is already a group with that name"));
     $form_group->submit("")->value(t("Add group"));
-    $form->add_rules_from(ORM::factory("group"));
     return $form;
   }
 
diff --git a/modules/user/controllers/users.php b/modules/user/controllers/users.php
index ca218393..71f9a889 100644
--- a/modules/user/controllers/users.php
+++ b/modules/user/controllers/users.php
@@ -95,14 +95,13 @@ class Users_Controller extends Controller {
     foreach ($locales as $locale => $display_name) {
       $locales[$locale] = SafeString::of_safe_html($display_name);
     }
-    if (count($locales) > 1) {
-      // Put "none" at the first position in the array
-      $locales = array_merge(array("" => t("« none »")), $locales);
-      $selected_locale = ($user && $user->locale) ? $user->locale : "";
-      $form->dropdown("locale")
-        ->label(t("Language Preference"))
-        ->options($locales)
-        ->selected($selected_locale);
-    }
+
+    // Put "none" at the first position in the array
+    $locales = array_merge(array("" => t("« none »")), $locales);
+    $selected_locale = ($user && $user->locale) ? $user->locale : "";
+    $form->dropdown("locale")
+      ->label(t("Language Preference"))
+      ->options($locales)
+      ->selected($selected_locale);
   }
 }
diff --git a/modules/user/helpers/group.php b/modules/user/helpers/group.php
index 2ada0ac1..38124b0d 100644
--- a/modules/user/helpers/group.php
+++ b/modules/user/helpers/group.php
@@ -24,23 +24,6 @@
  * Note: by design, this class does not do any permission checking.
  */
 class group_Core {
-  /**
-   * Create a new group.
-   *
-   * @param string  $name
-   * @return Group_Definition the group object
-   */
-  static function create($name) {
-    $group = ORM::factory("group")->where("name", "=", $name)->find();
-    if ($group->loaded()) {
-      throw new Exception("@todo GROUP_ALREADY_EXISTS $name");
-    }
-
-    $group->name = $name;
-    $group->save();
-    return $group;
-  }
-
   /**
    * The group of all possible visitors.  This includes the guest user.
    *
diff --git a/modules/user/models/group.php b/modules/user/models/group.php
index 10f6f4b3..16d6adb7 100644
--- a/modules/user/models/group.php
+++ b/modules/user/models/group.php
@@ -20,8 +20,7 @@
 class Group_Model extends ORM implements Group_Definition {
   protected $has_and_belongs_to_many = array("users");
 
-  var $form_rules = array(
-    "name" => "required|length[4,255]");
+  var $rules = array("name" => array("rules" => array("required", "length[4,255]")));
 
   /**
    * @see ORM::delete()
@@ -37,18 +36,42 @@ class Group_Model extends ORM implements Group_Definition {
     return $this->users->find_all();
   }
 
-  public function save() {
-    if (!$this->loaded()) {
-        $created = 1;
+  /**
+   * Add some custom per-instance rules.
+   */
+  public function validate($array=null) {
+    // validate() is recursive, only modify the rules on the outermost call.
+    if (!$array) {
+      $this->rules["name"]["callbacks"] = array(array($this, "valid_name"));
     }
 
-    $original = clone $this->original();
-    parent::save();
-    if (isset($created)) {
+    parent::validate($array);
+  }
+
+  public function save() {
+    if (!$this->loaded()) {
+      // New group
+      parent::save();
       module::event("group_created", $this);
     } else {
+      // Updated group
+      $original = clone $this->original();
+      parent::save();
       module::event("group_updated", $original, $this);
     }
+
     return $this;
   }
+
+  /**
+   * Validate the user name.  Make sure there are no conflicts.
+   */
+  public function valid_name(Validation $v, $field) {
+    if (db::build()->from("groups")
+        ->where("name", "=", $this->name)
+        ->where("id", "<>", $this->id)
+        ->count_records() == 1) {
+      $v->add_error("name", "in_use");
+    }
+  }
 }
\ No newline at end of file
diff --git a/modules/user/models/user.php b/modules/user/models/user.php
index 12da5784..c45f88ac 100644
--- a/modules/user/models/user.php
+++ b/modules/user/models/user.php
@@ -78,6 +78,7 @@ class User_Model extends ORM implements User_Definition {
     }
 
     $this->rules["password"]["callbacks"] = array(array($this, "valid_password"));
+    $this->rules["admin"]["callbacks"] = array(array($this, "valid_admin"));
 
     parent::validate($array);
   }
@@ -131,9 +132,20 @@ class User_Model extends ORM implements User_Definition {
    * Validate the password.
    */
   public function valid_password(Validation $v, $field) {
-    $minimum_length = module::get_var("user", "mininum_password_length", 5);
-    if ($this->password_length < $minimum_length || $this->password_length > 40) {
-      $v->add_error("password", "length");
+    if (!$this->loaded() || $this->password_length) {
+      $minimum_length = module::get_var("user", "mininum_password_length", 5);
+      if ($this->password_length < $minimum_length || $this->password_length > 40) {
+        $v->add_error("password", "length");
+      }
+    }
+  }
+
+  /**
+   * Validate the admin bit.
+   */
+  public function valid_admin(Validation $v, $field) {
+    if ($this->id == identity::active_user()->id && !$this->admin) {
+      $v->add_error("admin", "locked");
     }
   }
 }
-- 
cgit v1.2.3


From 4a2d5bc9e234cc7e81e47131e8d8755919b773fc Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 16 Jan 2010 21:24:18 -0800
Subject: Convert Users_Controller to model based validation.

---
 modules/user/controllers/users.php | 41 ++++++++++++++++++--------------------
 1 file changed, 19 insertions(+), 22 deletions(-)

diff --git a/modules/user/controllers/users.php b/modules/user/controllers/users.php
index 71f9a889..b3f39b47 100644
--- a/modules/user/controllers/users.php
+++ b/modules/user/controllers/users.php
@@ -26,34 +26,36 @@ class Users_Controller extends Controller {
     }
 
     $form = $this->_get_edit_form($user);
-    $valid = $form->validate();
-    if ($valid) {
+    try {
+      $valid = $form->validate();
       $user->full_name = $form->edit_user->full_name->value;
-      if ($form->edit_user->password->value) {
-        $user->password = $form->edit_user->password->value;
-      }
+      $user->password = $form->edit_user->password->value;
       $user->email = $form->edit_user->email->value;
       $user->url = $form->edit_user->url->value;
-      if ($form->edit_user->locale) {
-        $desired_locale = $form->edit_user->locale->value;
-        $new_locale = $desired_locale == "none" ? null : $desired_locale;
-        if ($new_locale != $user->locale) {
-          // Delete the session based locale preference
-          setcookie("g_locale", "", time() - 24 * 3600, "/");
-        }
-        $user->locale = $new_locale;
+      $user->locale = $form->edit_user->locale->value;
+      $user->validate();
+    } catch (ORM_Validation_Exception $e) {
+      // Translate ORM validation errors into form error messages
+      foreach ($e->validation->errors() as $key => $error) {
+        $form->edit_user->inputs[$key]->add_error($error, 1);
+     }
+      $valid = false;
+    }
+
+    if ($valid) {
+      if ($user->original()->locale != $user->locale) {
+        // Delete the session based locale preference
+        setcookie("g_locale", "", time() - 24 * 3600, "/");
       }
+
       $user->save();
       module::event("user_edit_form_completed", $user, $form);
-
       message::success(t("User information updated."));
       print json_encode(
         array("result" => "success",
               "resource" => url::site("users/{$user->id}")));
     } else {
-      print json_encode(
-        array("result" => "error",
-              "form" => $form->__toString()));
+      print json_encode(array("result" => "error", "form" => (string) $form));
     }
   }
 
@@ -78,11 +80,6 @@ class Users_Controller extends Controller {
       ->matches($group->password);
     $group->input("email")->label(t("Email"))->id("g-email")->value($user->email);
     $group->input("url")->label(t("URL"))->id("g-url")->value($user->url);
-    $form->add_rules_from($user);
-
-    $minimum_length = module::get_var("user", "mininum_password_length", 5);
-    $form->edit_user->password
-      ->rules($minimum_length ? "length[$minimum_length, 40]" : "length[40]");
 
     module::event("user_edit_form", $user, $form);
     $group->submit("")->value(t("Save"));
-- 
cgit v1.2.3


From 39ad9fa9a0b8d262bf87d2932a18ce9d49ab3437 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 16 Jan 2010 21:25:17 -0800
Subject: Get rid of add_rules_from() -- it's no longer necessary now that
 we're doing model based validation.

---
 modules/gallery/libraries/MY_Forge.php | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/modules/gallery/libraries/MY_Forge.php b/modules/gallery/libraries/MY_Forge.php
index 9564f941..ee2a0bef 100644
--- a/modules/gallery/libraries/MY_Forge.php
+++ b/modules/gallery/libraries/MY_Forge.php
@@ -34,20 +34,6 @@ class Forge extends Forge_Core {
     return parent::render($template, $custom);
   }
 
-  /**
-   * Associate validation rules defined in the model with this form.
-   */
-  public function add_rules_from($model) {
-    foreach ($this->inputs as $name => $input) {
-      if (isset($input->inputs)) {
-        $input->add_rules_from($model);
-      }
-      if (isset($model->form_rules[$name])) {
-        $input->rules($model->form_rules[$name]);
-      }
-    }
-  }
-
   /**
    * Validate our CSRF value as a mandatory part of all form validation.
    */
-- 
cgit v1.2.3


From 1c85cf6397d8c780db0d2ade185e0bbf714a57a6 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 16 Jan 2010 22:27:07 -0800
Subject: Convert comment code over to model based validation.

---
 modules/comment/controllers/comments.php | 57 +++++++++------------
 modules/comment/helpers/comment.php      | 40 ---------------
 modules/comment/models/comment.php       | 87 ++++++++++++++++++++++++++++----
 3 files changed, 99 insertions(+), 85 deletions(-)

diff --git a/modules/comment/controllers/comments.php b/modules/comment/controllers/comments.php
index 068152a2..6c546321 100644
--- a/modules/comment/controllers/comments.php
+++ b/modules/comment/controllers/comments.php
@@ -26,50 +26,39 @@ class Comments_Controller extends Controller {
     access::required("view", $item);
 
     $form = comment::get_add_form($item);
-    $valid = $form->validate();
-    if ($valid) {
-      if (identity::active_user()->guest && !$form->add_comment->inputs["name"]->value) {
-        $form->add_comment->inputs["name"]->add_error("missing", 1);
-        $valid = false;
-      }
-
-      if (!$form->add_comment->text->value) {
-        $form->add_comment->text->add_error("missing", 1);
-        $valid = false;
+    try {
+      $valid = $form->validate();
+      $comment = ORM::factory("comment");
+      $comment->item_id = $id;
+      $comment->author_id = identity::active_user()->id;
+      $comment->text = $form->add_comment->text->value;
+      $comment->guest_name = $form->add_comment->inputs["name"]->value;
+      $comment->guest_email = $form->add_comment->email->value;
+      $comment->guest_url = $form->add_comment->url->value;
+      $comment->validate();
+    } catch (ORM_Validation_Exception $e) {
+      // Translate ORM validation errors into form error messages
+      foreach ($e->validation->errors() as $key => $error) {
+        switch ($key) {
+        case "guest_name":  $key = "name";  break;
+        case "guest_email": $key = "email"; break;
+        }
+        $form->add_comment->inputs[$key]->add_error($error, 1);
       }
+      $valid = false;
     }
 
     if ($valid) {
-      $comment = comment::create(
-        $item, identity::active_user(),
-        $form->add_comment->text->value,
-        $form->add_comment->inputs["name"]->value,
-        $form->add_comment->email->value,
-        $form->add_comment->url->value);
-
-      $active = identity::active_user();
-      if ($active->guest) {
-        $form->add_comment->inputs["name"]->value("");
-        $form->add_comment->email->value("");
-        $form->add_comment->url->value("");
-      } else {
-        $form->add_comment->inputs["name"]->value($active->full_name);
-        $form->add_comment->email->value($active->email);
-        $form->add_comment->url->value($active->url);
-      }
-
-      $form->add_comment->text->value("");
+      $comment->save();
       $view = new Theme_View("comment.html", "other", "comment-fragment");
       $view->comment = $comment;
 
       print json_encode(
         array("result" => "success",
-              "view" => $view->__toString(),
-              "form" => $form->__toString()));
+              "view" => (string) $view,
+              "form" => (string) comment::get_add_form($item)));
     } else {
-      print json_encode(
-        array("result" => "error",
-              "form" => $form->__toString()));
+      print json_encode(array("result" => "error", "form" => (string) $form));
     }
   }
 
diff --git a/modules/comment/helpers/comment.php b/modules/comment/helpers/comment.php
index 1e1e7d2f..389c8922 100644
--- a/modules/comment/helpers/comment.php
+++ b/modules/comment/helpers/comment.php
@@ -24,46 +24,6 @@
  * Note: by design, this class does not do any permission checking.
  */
 class comment_Core {
-  /**
-   * Create a new comment.
-   * @param Item_MOdel $item         the parent item
-   * @param User_Model $author       the author User_Model
-   * @param string     $text         comment body
-   * @param string     $guest_name   guest's name (if the author is a guest user, default empty)
-   * @param string     $guest_email  guest's email (if the author is a guest user, default empty)
-   * @param string     $guest_url    guest's url (if the author is a guest user, default empty)
-   * @return Comment_Model
-   */
-  static function create($item, $author, $text, $guest_name=null,
-                         $guest_email=null, $guest_url=null) {
-    $comment = ORM::factory("comment");
-    $comment->author_id = $author->id;
-    $comment->guest_email = $guest_email;
-    $comment->guest_name = $guest_name;
-    $comment->guest_url = $guest_url;
-    $comment->item_id = $item->id;
-    $comment->text = $text;
-    $comment->state = "published";
-
-    // These values are useful for spam fighting, so save them with the comment.
-    $input = Input::instance();
-    $comment->server_http_accept = substr($input->server("HTTP_ACCEPT"), 0, 128);
-    $comment->server_http_accept_charset = substr($input->server("HTTP_ACCEPT_CHARSET"), 0, 64);
-    $comment->server_http_accept_encoding = substr($input->server("HTTP_ACCEPT_ENCODING"), 0, 64);
-    $comment->server_http_accept_language = substr($input->server("HTTP_ACCEPT_LANGUAGE"), 0, 64);
-    $comment->server_http_connection = substr($input->server("HTTP_CONNECTION"), 0, 64);
-    $comment->server_http_host = substr($input->server("HTTP_HOST"), 0, 64);
-    $comment->server_http_referer = substr($input->server("HTTP_REFERER"), 0, 255);
-    $comment->server_http_user_agent = substr($input->server("HTTP_USER_AGENT"), 0, 128);
-    $comment->server_query_string = substr($input->server("QUERY_STRING"), 0, 64);
-    $comment->server_remote_addr = substr($input->server("REMOTE_ADDR"), 0, 32);
-    $comment->server_remote_host = substr($input->server("REMOTE_HOST"), 0, 64);
-    $comment->server_remote_port = substr($input->server("REMOTE_PORT"), 0, 16);
-    $comment->save();
-
-    return $comment;
-  }
-
   static function get_add_form($item) {
     $form = new Forge("comments/create/{$item->id}", "", "post", array("id" => "g-comment-form"));
     $group = $form->group("add_comment")->label(t("Add comment"));
diff --git a/modules/comment/models/comment.php b/modules/comment/models/comment.php
index e0b82039..7ad47c6d 100644
--- a/modules/comment/models/comment.php
+++ b/modules/comment/models/comment.php
@@ -18,6 +18,11 @@
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
 class Comment_Model extends ORM {
+  var $rules = array(
+    "text" => array("rules" => array("required")),
+    "state" => array("rules" => array("Comment_Model::valid_state"))
+  );
+
   function item() {
     return ORM::factory("item", $this->item_id);
   }
@@ -53,25 +58,57 @@ class Comment_Model extends ORM {
     }
   }
 
+  /**
+   * Add some custom per-instance rules.
+   */
+  public function validate($array=null) {
+    // validate() is recursive, only modify the rules on the outermost call.
+    if (!$array) {
+      $this->rules["item_id"]["callbacks"] = array(array($this, "valid_item"));
+      $this->rules["guest_name"]["callbacks"] = array(array($this, "valid_author"));
+    }
+
+    parent::validate($array);
+  }
+
   /**
    * @see ORM::save()
    */
   public function save() {
-    if (!empty($this->changed)) {
-      $this->updated = time();
-      if (!$this->loaded() && empty($this->created)) {
-        $this->created = $this->updated;
-        $created = true;
+    $this->updated = time();
+    if (!$this->loaded()) {
+      // New comment
+      $this->created = $this->updated;
+      if (empty($this->state)) {
+        $this->state = "published";
       }
-    }
-    $visible_change = $this->original()->state == "published" || $this->state == "published";
-
-    $original = clone $this->original();
-    parent::save();
 
-    if (isset($created)) {
+      // These values are useful for spam fighting, so save them with the comment.  It's painful to
+      // check each one to see if it already exists before setting it, so just use server_http_host
+      // as a semaphore for now (we use that in g2_import.php)
+      if (empty($this->server_http_host)) {
+        $input = Input::instance();
+        $this->server_http_accept = substr($input->server("HTTP_ACCEPT"), 0, 128);
+        $this->server_http_accept_charset = substr($input->server("HTTP_ACCEPT_CHARSET"), 0, 64);
+        $this->server_http_accept_encoding = substr($input->server("HTTP_ACCEPT_ENCODING"), 0, 64);
+        $this->server_http_accept_language = substr($input->server("HTTP_ACCEPT_LANGUAGE"), 0, 64);
+        $this->server_http_connection = substr($input->server("HTTP_CONNECTION"), 0, 64);
+        $this->server_http_host = substr($input->server("HTTP_HOST"), 0, 64);
+        $this->server_http_referer = substr($input->server("HTTP_REFERER"), 0, 255);
+        $this->server_http_user_agent = substr($input->server("HTTP_USER_AGENT"), 0, 128);
+        $this->server_query_string = substr($input->server("QUERY_STRING"), 0, 64);
+        $this->server_remote_addr = substr($input->server("REMOTE_ADDR"), 0, 32);
+        $this->server_remote_host = substr($input->server("REMOTE_HOST"), 0, 64);
+        $this->server_remote_port = substr($input->server("REMOTE_PORT"), 0, 16);
+      }
+      $visible_change = $this->original()->state == "published" || $this->state == "published";
+      parent::save();
       module::event("comment_created", $this);
     } else {
+      // Updated comment
+      $visible_change = $this->original()->state == "published" || $this->state == "published";
+      $original = clone $this->original();
+      parent::save();
       module::event("comment_updated", $original, $this);
     }
 
@@ -92,4 +129,32 @@ class Comment_Model extends ORM {
     $this->join("items", "items.id", "comments.item_id");
     return item::viewable($this);
   }
+
+  /**
+   * Make sure we have an appropriate author id set, or a guest name.
+   */
+  public function valid_author(Validation $v, $field) {
+    if ($this->author_id == identity::guest()->id && empty($this->guest_name)) {
+      $v->add_error("guest_name", "required");
+    }
+  }
+
+  /**
+   * Make sure we have a valid associated item id.
+   */
+  public function valid_item(Validation $v, $field) {
+    if (db::build()
+        ->from("items")
+        ->where("id", "=", $this->item_id)
+        ->count_records() != 1) {
+      $v->add_error("item_id", "invalid");
+    }
+  }
+
+  /**
+   * Make sure that the state is legal.
+   */
+  static function valid_state($value) {
+    return in_array($value, array("published", "unpublished", "spam", "deleted"));
+  }
 }
-- 
cgit v1.2.3


From 5c49c041e740b8bb8eb6afae8563731ab858aa97 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 16 Jan 2010 22:42:02 -0800
Subject: Use "(string) $form" instead of "$form->__toString()"

---
 modules/gallery/controllers/login.php              |  4 +---
 modules/tag/controllers/admin_tags.php             |  4 +---
 modules/tag/controllers/tags.php                   |  4 +---
 modules/user/controllers/admin_users.php           |  6 ++----
 modules/watermark/controllers/admin_watermarks.php | 12 +++---------
 5 files changed, 8 insertions(+), 22 deletions(-)

diff --git a/modules/gallery/controllers/login.php b/modules/gallery/controllers/login.php
index 75ee6b9c..464db491 100644
--- a/modules/gallery/controllers/login.php
+++ b/modules/gallery/controllers/login.php
@@ -33,9 +33,7 @@ class Login_Controller extends Controller {
       print json_encode(
         array("result" => "success"));
     } else {
-      print json_encode(
-        array("result" => "error",
-              "form" => $form->__toString()));
+      print json_encode(array("result" => "error", "form" => (string) $form));
     }
   }
 
diff --git a/modules/tag/controllers/admin_tags.php b/modules/tag/controllers/admin_tags.php
index e20b8ac8..3b605a4e 100644
--- a/modules/tag/controllers/admin_tags.php
+++ b/modules/tag/controllers/admin_tags.php
@@ -60,9 +60,7 @@ class Admin_Tags_Controller extends Admin_Controller {
         array("result" => "success",
               "location" => url::site("admin/tags")));
     } else {
-      print json_encode(
-        array("result" => "error",
-              "form" => $form->__toString()));
+      print json_encode(array("result" => "error", "form" => (string) $form));
     }
   }
 
diff --git a/modules/tag/controllers/tags.php b/modules/tag/controllers/tags.php
index 992c7411..e28b7a83 100644
--- a/modules/tag/controllers/tags.php
+++ b/modules/tag/controllers/tags.php
@@ -71,9 +71,7 @@ class Tags_Controller extends Controller {
         array("result" => "success",
               "cloud" => tag::cloud(30)->__toString()));
     } else {
-      print json_encode(
-        array("result" => "error",
-              "form" => $form->__toString()));
+      print json_encode(array("result" => "error", "form" => (string) $form));
     }
   }
 
diff --git a/modules/user/controllers/admin_users.php b/modules/user/controllers/admin_users.php
index c35eba73..91468250 100644
--- a/modules/user/controllers/admin_users.php
+++ b/modules/user/controllers/admin_users.php
@@ -82,8 +82,7 @@ class Admin_Users_Controller extends Admin_Controller {
       $name = $user->name;
       $user->delete();
     } else {
-      print json_encode(array("result" => "error",
-                              "form" => $form->__toString()));
+      print json_encode(array("result" => "error", "form" => (string) $form));
     }
 
     $message = t("Deleted user %user_name", array("user_name" => $name));
@@ -221,8 +220,7 @@ class Admin_Users_Controller extends Admin_Controller {
       $name = $group->name;
       $group->delete();
     } else {
-      print json_encode(array("result" => "error",
-                              "form" => $form->__toString()));
+      print json_encode(array("result" => "error", "form" => (string) $form));
     }
 
     $message = t("Deleted group %group_name", array("group_name" => $name));
diff --git a/modules/watermark/controllers/admin_watermarks.php b/modules/watermark/controllers/admin_watermarks.php
index 2a1d5f60..f535ad08 100644
--- a/modules/watermark/controllers/admin_watermarks.php
+++ b/modules/watermark/controllers/admin_watermarks.php
@@ -52,9 +52,7 @@ class Admin_Watermarks_Controller extends Admin_Controller {
         array("result" => "success",
               "location" => url::site("admin/watermarks")));
     } else {
-      print json_encode(
-        array("result" => "error",
-              "form" => $form->__toString()));
+      print json_encode(array("result" => "error", "form" => (string) $form));
     }
   }
 
@@ -84,9 +82,7 @@ class Admin_Watermarks_Controller extends Admin_Controller {
         array("result" => "success",
               "location" => url::site("admin/watermarks")));
     } else {
-      print json_encode(
-        array("result" => "error",
-              "form" => $form->__toString()));
+      print json_encode(array("result" => "error", "form" => (string) $form));
     }
   }
 
@@ -127,9 +123,7 @@ class Admin_Watermarks_Controller extends Admin_Controller {
         array("result" => "success",
               "location" => url::site("admin/watermarks")));
     } else {
-      print json_encode(
-        array("result" => "error",
-              "form" => $form->__toString()));
+      print json_encode(array("result" => "error", "form" => (string) $form));
     }
   }
 
-- 
cgit v1.2.3


From 4f8c98a7bc89911427a6fd97b8ed6ef6f41a2835 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 12:13:25 -0800
Subject: Move rules entirely down into validate() so that we can be more
 sophisticated but keep all our rules in one place.

Add rules for most fields.
---
 modules/gallery/models/item.php | 116 +++++++++++++++++++++++++++++++---------
 1 file changed, 91 insertions(+), 25 deletions(-)

diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php
index 869e3b27..04120f10 100644
--- a/modules/gallery/models/item.php
+++ b/modules/gallery/models/item.php
@@ -18,18 +18,10 @@
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
 class Item_Model extends ORM_MPTT {
-  protected $children = 'items';
+  protected $children = "items";
   protected $sorting = array();
   protected $data_file = null;
 
-  var $rules = array(
-    "name"        => array("rules" => array("length[0,255]", "required")),
-    "title"       => array("rules" => array("length[0,255]", "required")),
-    "slug"        => array("rules" => array("length[0,255]", "required")),
-    "description" => array("rules" => array("length[0,65535]")),
-    "type"        => array("rules" => array("Item_Model::valid_type")),
-  );
-
   /**
    * Add a set of restrictions to any following queries to restrict access only to items
    * viewable by the active user.
@@ -757,28 +749,41 @@ class Item_Model extends ORM_MPTT {
   }
 
   /**
-   * Add some custom per-instance rules.
+   * Specify our rules here so that we have access to the instance of this model.
    */
   public function validate($array=null) {
-    // validate() is recursive, only modify the rules on the outermost call.
     if (!$array) {
+      $this->rules = array(
+        "album_cover_item_id" => array("callbacks" => array(array($this, "valid_item"))),
+        "description"         => array("rules"     => array("length[0,65535]")),
+        "left_ptr"            => array("callbacks" => array(array($this, "internal_only"))),
+        "level"               => array("callbacks" => array(array($this, "internal_only"))),
+        "mime_type"           => array("callbacks" => array(array($this, "valid_field"))),
+        "name"                => array("rules"     => array("length[0,255]", "required"),
+                                       "callbacks" => array(array($this, "valid_name"))),
+        "parent_id"           => array("callbacks" => array(array($this, "valid_parent"))),
+        "rand_key"            => array("rule"      => array("decimal")),
+        "right_ptr"           => array("callbacks" => array(array($this, "internal_only"))),
+        "slug"                => array("rules"     => array("length[0,255]", "required"),
+                                       "callbacks" => array(array($this, "valid_slug"))),
+        "sort_column"         => array("callbacks" => array(array($this, "valid_field"))),
+        "sort_order"          => array("callbacks" => array(array($this, "valid_field"))),
+        "title"               => array("rules"     => array("length[0,255]", "required")),
+        "type"                => array("callbacks" => array(array($this, "read_only"),
+                                                            array($this, "valid_field"))),
+      );
+
+      // Conditional rules
       if ($this->id == 1) {
-        // Root album can't have a name or slug
+        // Root album can't have a name or slug so replace the rules
         $this->rules["name"] = array("rules" => array("length[0]"));
         $this->rules["slug"] = array("rules" => array("length[0]"));
-      } else {
-        // Layer some callbacks on top of the existing rules
-        $this->rules["name"]["callbacks"] = array(array($this, "valid_name"));
-        $this->rules["slug"]["callbacks"] = array(array($this, "valid_slug"));
       }
 
       // Movies and photos must have data files
       if (($this->is_photo() || $this->is_movie()) && !$this->loaded()) {
         $this->rules["name"]["callbacks"][] = array($this, "valid_data_file");
       }
-
-      // All items must have a legal parent
-      $this->rules["parent_id"]["callbacks"] = array(array($this, "valid_parent"));
     }
 
     parent::validate($array);
@@ -821,13 +826,13 @@ class Item_Model extends ORM_MPTT {
         $new_ext = pathinfo($this->name, PATHINFO_EXTENSION);
         $old_ext = pathinfo($this->original()->name, PATHINFO_EXTENSION);
         if (strcasecmp($new_ext, $old_ext)) {
-          $v->add_error("name", "illegal_extension");
+          $v->add_error("name", "illegal_data_file_extension");
           return;
         }
       } else {
         // New items must have an extension
         if (!pathinfo($this->name, PATHINFO_EXTENSION)) {
-          $v->add_error("name", "illegal_extension");
+          $v->add_error("name", "illegal_data_file_extension");
         }
       }
     }
@@ -847,9 +852,9 @@ class Item_Model extends ORM_MPTT {
    */
   public function valid_data_file(Validation $v, $field) {
     if (!is_file($this->data_file)) {
-      $v->add_error("file", "bad_path");
+      $v->add_error("name", "bad_data_file_path");
     } else if (filesize($this->data_file) == 0) {
-      $v->add_error("file", "empty_file");
+      $v->add_error("name", "empty_data_file");
     }
   }
 
@@ -872,10 +877,71 @@ class Item_Model extends ORM_MPTT {
     }
   }
 
+  /**
+   * Make sure the field refers to a valid item by id, or is null.
+   */
+  public function valid_item(Validation $v, $field) {
+    if ($this->$field && db::build()
+        ->from("items")
+        ->where("id", "=", $this->$field)
+        ->count_records() != 1) {
+      $v->add_error($field, "invalid_item");
+    }
+  }
+
   /**
    * Make sure that the type is valid.
    */
-  static function valid_type($value) {
-    return in_array($value, array("album", "photo", "movie"));
+  public function valid_field(Validation $v, $field) {
+    switch($field) {
+    case "mime_type":
+      if ($this->is_movie()) {
+        $legal_values = array("video/flv", "video/mp4");
+      } if ($this->is_photo()) {
+        $legal_values = array("image/jpeg", "image/gif", "image/png");
+      }
+      break;
+
+    case "sort_column":
+      if (!array_key_exists($this->sort_column, $this->object)) {
+        $v->add_error($field, "invalid");
+      }
+      break;
+
+    case "sort_order":
+      $legal_values = array("ASC", "DESC", "asc", "desc");
+      break;
+
+    case "type":
+      $legal_values = array("album", "photo", "movie");
+      break;
+
+    default:
+      $v->add_error($field, "unvalidated_field");
+      break;
+    }
+
+    if (isset($legal_values) && !in_array($this->$field, $legal_values)) {
+      $v->add_error($field, "invalid");
+    }
+  }
+
+  /**
+   * This field cannot be changed externally, it can only be changed inside save() after
+   * validation has been performed.
+   */
+  public function internal_only(Validation $v, $field) {
+    if ($this->original()->$field != $this->$field) {
+      $v->add_error($field, "internal_only");
+    }
+  }
+
+  /**
+   * This field cannot be changed after it's been set.
+   */
+  public function read_only(Validation $v, $field) {
+    if ($this->loaded() && $this->original()->$field != $this->$field) {
+      $v->add_error($field, "read_only");
+    }
   }
 }
-- 
cgit v1.2.3


From 3789b85b7d960a046e4b6de2bbbf82b3e59d2eab Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 12:19:24 -0800
Subject: Move rules down into validate() and improve valid_author().

---
 modules/comment/models/comment.php | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/modules/comment/models/comment.php b/modules/comment/models/comment.php
index 7ad47c6d..891ffbce 100644
--- a/modules/comment/models/comment.php
+++ b/modules/comment/models/comment.php
@@ -18,11 +18,6 @@
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
 class Comment_Model extends ORM {
-  var $rules = array(
-    "text" => array("rules" => array("required")),
-    "state" => array("rules" => array("Comment_Model::valid_state"))
-  );
-
   function item() {
     return ORM::factory("item", $this->item_id);
   }
@@ -64,8 +59,12 @@ class Comment_Model extends ORM {
   public function validate($array=null) {
     // validate() is recursive, only modify the rules on the outermost call.
     if (!$array) {
-      $this->rules["item_id"]["callbacks"] = array(array($this, "valid_item"));
-      $this->rules["guest_name"]["callbacks"] = array(array($this, "valid_author"));
+      $this->rules = array(
+        "guest_name" => array("callbacks" => array(array($this, "valid_author"))),
+        "item_id"    => array("callbacks" => array(array($this, "valid_item"))),
+        "state"      => array("rules"     => array("Comment_Model::valid_state")),
+        "text"       => array("rules"     => array("required")),
+      );
     }
 
     parent::validate($array);
@@ -134,7 +133,9 @@ class Comment_Model extends ORM {
    * Make sure we have an appropriate author id set, or a guest name.
    */
   public function valid_author(Validation $v, $field) {
-    if ($this->author_id == identity::guest()->id && empty($this->guest_name)) {
+    if (empty($this->author_id)) {
+      $v->add_error("author_id", "required");
+    } else if ($this->author_id == identity::guest()->id && empty($this->guest_name)) {
       $v->add_error("guest_name", "required");
     }
   }
-- 
cgit v1.2.3


From 9488684220cbf4121dea12a28083f6c34b648da8 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 12:30:24 -0800
Subject: Move model rules down into their validate() function for consistency.
 Change "in_use" error to "conflict" for consistency.

---
 modules/user/controllers/admin_users.php |  8 ++++----
 modules/user/models/group.php            | 10 +++++-----
 modules/user/models/user.php             | 31 ++++++++++++++-----------------
 3 files changed, 23 insertions(+), 26 deletions(-)

diff --git a/modules/user/controllers/admin_users.php b/modules/user/controllers/admin_users.php
index 91468250..bc68d154 100644
--- a/modules/user/controllers/admin_users.php
+++ b/modules/user/controllers/admin_users.php
@@ -287,7 +287,7 @@ class Admin_Users_Controller extends Admin_Controller {
     $group = $form->group("edit_user")->label(t("Edit user"));
     $group->input("name")->label(t("Username"))->id("g-username")->value($user->name);
     $group->inputs["name"]->error_messages(
-      "in_use", t("There is already a user with that username"));
+      "conflict", t("There is already a user with that username"));
     $group->input("full_name")->label(t("Full name"))->id("g-fullname")->value($user->full_name);
     self::_add_locale_dropdown($group, $user);
     $group->password("password")->label(t("Password"))->id("g-password");
@@ -306,7 +306,7 @@ class Admin_Users_Controller extends Admin_Controller {
     $form = new Forge("admin/users/add_user", "", "post", array("id" => "g-add-user-form"));
     $group = $form->group("add_user")->label(t("Add user"));
     $group->input("name")->label(t("Username"))->id("g-username")
-      ->error_messages("in_use", t("There is already a user with that username"));
+      ->error_messages("conflict", t("There is already a user with that username"));
     $group->input("full_name")->label(t("Full name"))->id("g-fullname");
     $group->password("password")->label(t("Password"))->id("g-password");
     $group->password("password2")->label(t("Confirm password"))->id("g-password2")
@@ -351,7 +351,7 @@ class Admin_Users_Controller extends Admin_Controller {
     $form_group = $form->group("edit_group")->label(t("Edit group"));
     $form_group->input("name")->label(t("Name"))->id("g-name")->value($group->name);
     $form_group->inputs["name"]->error_messages(
-      "in_use", t("There is already a group with that name"));
+      "conflict", t("There is already a group with that name"));
     $form_group->submit("")->value(t("Save"));
     return $form;
   }
@@ -361,7 +361,7 @@ class Admin_Users_Controller extends Admin_Controller {
     $form_group = $form->group("add_group")->label(t("Add group"));
     $form_group->input("name")->label(t("Name"))->id("g-name");
     $form_group->inputs["name"]->error_messages(
-      "in_use", t("There is already a group with that name"));
+      "conflict", t("There is already a group with that name"));
     $form_group->submit("")->value(t("Add group"));
     return $form;
   }
diff --git a/modules/user/models/group.php b/modules/user/models/group.php
index 16d6adb7..c00bf5c9 100644
--- a/modules/user/models/group.php
+++ b/modules/user/models/group.php
@@ -20,8 +20,6 @@
 class Group_Model extends ORM implements Group_Definition {
   protected $has_and_belongs_to_many = array("users");
 
-  var $rules = array("name" => array("rules" => array("required", "length[4,255]")));
-
   /**
    * @see ORM::delete()
    */
@@ -37,12 +35,14 @@ class Group_Model extends ORM implements Group_Definition {
   }
 
   /**
-   * Add some custom per-instance rules.
+   * Specify our rules here so that we have access to the instance of this model.
    */
   public function validate($array=null) {
     // validate() is recursive, only modify the rules on the outermost call.
     if (!$array) {
-      $this->rules["name"]["callbacks"] = array(array($this, "valid_name"));
+      $this->rules = array(
+        "name" => array("rules" => array("required", "length[4,255]"),
+                        "callbacks" => array(array($this, "valid_name"))));
     }
 
     parent::validate($array);
@@ -71,7 +71,7 @@ class Group_Model extends ORM implements Group_Definition {
         ->where("name", "=", $this->name)
         ->where("id", "<>", $this->id)
         ->count_records() == 1) {
-      $v->add_error("name", "in_use");
+      $v->add_error("name", "conflict");
     }
   }
 }
\ No newline at end of file
diff --git a/modules/user/models/user.php b/modules/user/models/user.php
index c45f88ac..451b5ffb 100644
--- a/modules/user/models/user.php
+++ b/modules/user/models/user.php
@@ -21,15 +21,6 @@ class User_Model extends ORM implements User_Definition {
   protected $has_and_belongs_to_many = array("groups");
   protected $password_length = null;
 
-  var $rules = array(
-    "name"      => array("rules" => array("length[1,32]", "required")),
-    "locale"    => array("rules" => array("length[2,10]")),
-    "password"  => array("rules" => array("length[5,40]")),  // note: overridden in validate()
-    "email"     => array("rules" => array("length[1,255]", "required", "valid::email")),
-    "full_name" => array("rules" => array("length[0,255]")),
-    "url"       => array("rules" => array("valid::url")),
-  );
-
   public function __set($column, $value) {
     switch ($column) {
     case "hashed_password":
@@ -69,17 +60,23 @@ class User_Model extends ORM implements User_Definition {
   }
 
   /**
-   * Add some custom per-instance rules.
+   * Specify our rules here so that we have access to the instance of this model.
    */
   public function validate($array=null) {
     // validate() is recursive, only modify the rules on the outermost call.
     if (!$array) {
-      $this->rules["name"]["callbacks"] = array(array($this, "valid_name"));
+      $this->rules = array(
+        "admin"     => array("callbacks" => array(array($this, "valid_admin"))),
+        "email"     => array("rules"     => array("length[1,255]", "required", "valid::email")),
+        "full_name" => array("rules"     => array("length[0,255]")),
+        "locale"    => array("rules"     => array("length[2,10]")),
+        "name"      => array("rules"     => array("length[1,32]", "required"),
+                             "callbacks" => array(array($this, "valid_name"))),
+        "password"  => array("callbacks" => array(array($this, "valid_password"))),
+        "url"       => array("rules"     => array("valid::url")),
+      );
     }
 
-    $this->rules["password"]["callbacks"] = array(array($this, "valid_password"));
-    $this->rules["admin"]["callbacks"] = array(array($this, "valid_admin"));
-
     parent::validate($array);
   }
 
@@ -124,7 +121,7 @@ class User_Model extends ORM implements User_Definition {
         ->where("name", "=", $this->name)
         ->where("id", "<>", $this->id)
         ->count_records() == 1) {
-      $v->add_error("name", "in_use");
+      $v->add_error("name", "conflict");
     }
   }
 
@@ -134,8 +131,8 @@ class User_Model extends ORM implements User_Definition {
   public function valid_password(Validation $v, $field) {
     if (!$this->loaded() || $this->password_length) {
       $minimum_length = module::get_var("user", "mininum_password_length", 5);
-      if ($this->password_length < $minimum_length || $this->password_length > 40) {
-        $v->add_error("password", "length");
+      if ($this->password_length < $minimum_length) {
+        $v->add_error("password", "min_length");
       }
     }
   }
-- 
cgit v1.2.3


From cfb27dde023e4f4d04fc9de687548501e607d371 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 13:28:24 -0800
Subject: Adjust installers to work with model based validation.

---
 modules/gallery/helpers/gallery_installer.php | 33 ++++++++++++++++-----------
 modules/user/helpers/user_installer.php       | 32 ++++++++++++++++++++------
 2 files changed, 45 insertions(+), 20 deletions(-)

diff --git a/modules/gallery/helpers/gallery_installer.php b/modules/gallery/helpers/gallery_installer.php
index 1e0ad28c..aa297236 100644
--- a/modules/gallery/helpers/gallery_installer.php
+++ b/modules/gallery/helpers/gallery_installer.php
@@ -209,19 +209,26 @@ class gallery_installer {
     t("Edit");
     t("Add");
 
-    $root = ORM::factory("item");
-    $root->type = "album";
-    $root->title = "Gallery";
-    $root->description = "";
-    $root->left_ptr = 1;
-    $root->right_ptr = 2;
-    $root->parent_id = 0;
-    $root->level = 1;
-    $root->thumb_dirty = 1;
-    $root->resize_dirty = 1;
-    $root->sort_column = "weight";
-    $root->sort_order = "ASC";
-    $root->save();
+    // Hardcode the first item to sidestep ORM validation rules
+    $now = time();
+    db::build()->insert(
+      "items",
+      array("created" => $now,
+            "description" => "",
+            "left_ptr" => 1,
+            "level" => 1,
+            "parent_id" => 0,
+            "resize_dirty" => 1,
+            "right_ptr" => 2,
+            "sort_column" => "weight",
+            "sort_order" => "ASC",
+            "thumb_dirty" => 1,
+            "title" => "Gallery",
+            "type" => "album",
+            "updated" => $now,
+            "weight" => 1))
+      ->execute();
+    $root = ORM::factory("item")->where("id", "=", 1)->find();
     access::add_item($root);
 
     module::set_var("gallery", "active_site_theme", "wind");
diff --git a/modules/user/helpers/user_installer.php b/modules/user/helpers/user_installer.php
index 0cba502f..70bee300 100644
--- a/modules/user/helpers/user_installer.php
+++ b/modules/user/helpers/user_installer.php
@@ -53,21 +53,39 @@ class user_installer {
                  UNIQUE KEY(`user_id`, `group_id`))
                DEFAULT CHARSET=utf8;");
 
-    $everybody = group::create("Everybody");
+    $everybody = ORM::factory("group");
+    $everybody->name = "Everybody";
     $everybody->special = true;
     $everybody->save();
 
-    $registered = group::create("Registered Users");
+    $registered = ORM::factory("group");
+    $registered->name = "Registered Users";
     $registered->special = true;
     $registered->save();
 
-    $guest = user::create("guest", "Guest User", "");
-    $guest->guest = true;
-    $guest->remove($registered);
+    // Avoid ORM to sidestep validation.
+    db::build()->insert(
+      "users",
+      array("name" => "guest",
+            "full_name" => "Guest User",
+            "guest" => true))
+      ->execute();
+
+    $guest = ORM::factory("user")->where("id", "=", 1)->find();
+    $guest->add($everybody);
     $guest->save();
 
-    $admin = user::create("admin", "Gallery Administrator", "admin");
-    $admin->admin = true;
+    db::build()->insert(
+      "users",
+      array("name" => "admin",
+            "full_name" => "Gallery Administrator",
+            "password" => "admin",
+            "admin" => true))
+      ->execute();
+
+    $admin = ORM::factory("user")->where("id", "=", 2)->find();
+    $admin->add($everybody);
+    $admin->add($registered);
     $admin->save();
 
     $current_provider = module::get_var("gallery", "identity_provider");
-- 
cgit v1.2.3


From f0a290fc7617f62e7e53bd4659f541a9c340ba1c Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 13:29:36 -0800
Subject: If we call original() and there's no $original yet, then consider
 this to be the original.  That should be safe because we're already guarding
 __set, __unset and save.

---
 modules/gallery/libraries/MY_ORM.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/gallery/libraries/MY_ORM.php b/modules/gallery/libraries/MY_ORM.php
index 56c776aa..8c0f084f 100644
--- a/modules/gallery/libraries/MY_ORM.php
+++ b/modules/gallery/libraries/MY_ORM.php
@@ -49,6 +49,10 @@ class ORM extends ORM_Core {
   }
 
   public function original() {
+    if (!isset($this->original)) {
+      $this->original = clone $this;
+    }
+
     return $this->original;
   }
 }
-- 
cgit v1.2.3


From f70130b820b48769c5d2182ed0c8b503daccb562 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 13:30:06 -0800
Subject: Special case output for ORM_Validation_Exceptions

---
 modules/gallery_unit_test/controllers/gallery_unit_test.php | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/modules/gallery_unit_test/controllers/gallery_unit_test.php b/modules/gallery_unit_test/controllers/gallery_unit_test.php
index 498dd756..e05fcbaa 100644
--- a/modules/gallery_unit_test/controllers/gallery_unit_test.php
+++ b/modules/gallery_unit_test/controllers/gallery_unit_test.php
@@ -127,6 +127,12 @@ class Gallery_Unit_Test_Controller extends Controller {
 
       $filter = count($_SERVER["argv"]) > 2 ? $_SERVER["argv"][2] : null;
       print new Unit_Test($modules, $filter);
+    } catch (ORM_Validation_Exception $e) {
+      print "Validation Exception: {$e->getMessage()}\n";
+      print $e->getTraceAsString() . "\n";
+      foreach ($e->validation->errors() as $field => $msg) {
+        print "$field: $msg\n";
+      }
     } catch (Exception $e) {
       print "Exception: {$e->getMessage()}\n";
       print $e->getTraceAsString() . "\n";
-- 
cgit v1.2.3


From bb79a1455a3f692c813f8dad6300fd7ecc6fd583 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 16:55:11 -0800
Subject: Remove unnecessary comment.

---
 modules/tag/helpers/tag_rest.php | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/modules/tag/helpers/tag_rest.php b/modules/tag/helpers/tag_rest.php
index c1bbf4fb..0aac5291 100644
--- a/modules/tag/helpers/tag_rest.php
+++ b/modules/tag/helpers/tag_rest.php
@@ -44,10 +44,6 @@ class tag_rest_Core {
   static function put($request) {
     $tag = rest::resolve($request->url);
 
-    // @todo: what permission should be required to edit a tag?
-    // for now, require edit at the top level.  Perhaps later, just require any edit perms,
-    // anywhere in the gallery?
-
     if (isset($request->params->remove)) {
       if (!is_array($request->params->remove)) {
         throw new Exception("Bad request", 400);
-- 
cgit v1.2.3


From fafa7f277f0591c74bd3d162c4c39a01604b55ae Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 16:55:48 -0800
Subject: Remove a @todo.

---
 modules/gallery/helpers/gallery_rest.php | 40 +++++++++++++++++++-------------
 1 file changed, 24 insertions(+), 16 deletions(-)

diff --git a/modules/gallery/helpers/gallery_rest.php b/modules/gallery/helpers/gallery_rest.php
index 0de5da2b..24733f20 100644
--- a/modules/gallery/helpers/gallery_rest.php
+++ b/modules/gallery/helpers/gallery_rest.php
@@ -19,7 +19,6 @@
  */
 
 // @todo Add logging
-// @todo VALIDATION
 
 // Validation questions
 //
@@ -100,10 +99,15 @@ class gallery_rest_Core {
     access::required("edit", $item);
 
     $params = $request->params;
-    foreach (array("captured", "description", "slug", "sort_column", "sort_order",
-                   "title", "view_count", "weight") as $key) {
-      if (isset($params->$key)) {
-        $item->$key = $params->$key;
+
+    // Only change fields from a whitelist.
+    foreach (array("album_cover_item_id", "captured", "description",
+                   "height", "mime_type", "name", "parent_id", "rand_key", "resize_dirty",
+                   "resize_height", "resize_width", "slug", "sort_column", "sort_order",
+                   "thumb_dirty", "thumb_height", "thumb_width", "title", "view_count",
+                   "weight", "width") as $key) {
+      if (array_key_exists($key, $request->params)) {
+        $item->$key = $request->params->$key;
       }
     }
     $item->save();
@@ -116,22 +120,26 @@ class gallery_rest_Core {
     access::required("edit", $parent);
 
     $params = $request->params;
+    $item = ORM::factory("item");
     switch ($params->type) {
     case "album":
-      $item = album::create(
-        $parent,
-        $params->name,
-        isset($params->title) ? $params->title : $name,
-        isset($params->description) ? $params->description : null);
+      $item->type = "album";
+      $item->parent_id = $parent->id;
+      $item->name = $params->name;
+      $item->title = isset($params->title) ? $params->title : $name;
+      $item->description = isset($params->description) ? $params->description : null;
+      $item->save();
       break;
 
     case "photo":
-      $item = photo::create(
-        $parent,
-        $request->file,
-        $params->name,
-        isset($params->title) ? $params->title : $name,
-        isset($params->description) ? $params->description : null);
+    case "movie":
+      $item->type = $params->type;
+      $item->parent_id = $parent->id;
+      $item->set_data_file($request->file);
+      $item->name = $params->name;
+      $item->title = isset($params->title) ? $params->title : $name;
+      $item->description = isset($params->description) ? $params->description : null;
+      $item->save();
       break;
 
     default:
-- 
cgit v1.2.3


From afb3fa71b9aea16a02c13f75d7999069a4ae9d21 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 16:58:47 -0800
Subject: Get rid of internal_only designation -- it's too hard to enforce
 cleanly.

---
 modules/gallery/models/item.php | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php
index 04120f10..453a3525 100644
--- a/modules/gallery/models/item.php
+++ b/modules/gallery/models/item.php
@@ -756,14 +756,11 @@ class Item_Model extends ORM_MPTT {
       $this->rules = array(
         "album_cover_item_id" => array("callbacks" => array(array($this, "valid_item"))),
         "description"         => array("rules"     => array("length[0,65535]")),
-        "left_ptr"            => array("callbacks" => array(array($this, "internal_only"))),
-        "level"               => array("callbacks" => array(array($this, "internal_only"))),
         "mime_type"           => array("callbacks" => array(array($this, "valid_field"))),
         "name"                => array("rules"     => array("length[0,255]", "required"),
                                        "callbacks" => array(array($this, "valid_name"))),
         "parent_id"           => array("callbacks" => array(array($this, "valid_parent"))),
         "rand_key"            => array("rule"      => array("decimal")),
-        "right_ptr"           => array("callbacks" => array(array($this, "internal_only"))),
         "slug"                => array("rules"     => array("length[0,255]", "required"),
                                        "callbacks" => array(array($this, "valid_slug"))),
         "sort_column"         => array("callbacks" => array(array($this, "valid_field"))),
@@ -926,16 +923,6 @@ class Item_Model extends ORM_MPTT {
     }
   }
 
-  /**
-   * This field cannot be changed externally, it can only be changed inside save() after
-   * validation has been performed.
-   */
-  public function internal_only(Validation $v, $field) {
-    if ($this->original()->$field != $this->$field) {
-      $v->add_error($field, "internal_only");
-    }
-  }
-
   /**
    * This field cannot be changed after it's been set.
    */
-- 
cgit v1.2.3


From 4197ee39b9e9737afbc766d42ec68641d760654a Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 16:58:54 -0800
Subject: Catch ORM_Validation_Exception and turn it into a 400 Bad Request
 with appropriate error output.

---
 modules/rest/controllers/rest.php | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/modules/rest/controllers/rest.php b/modules/rest/controllers/rest.php
index 5ef9eb84..cac49740 100644
--- a/modules/rest/controllers/rest.php
+++ b/modules/rest/controllers/rest.php
@@ -72,7 +72,14 @@ class Rest_Controller extends Controller {
         throw new Rest_Exception("Forbidden", 403);
       }
 
-      print call_user_func(array($handler_class, $handler_method), $request);
+      try {
+        print call_user_func(array($handler_class, $handler_method), $request);
+      } catch (ORM_Validation_Exception $e) {
+        foreach ($e->validation->errors() as $key => $value) {
+          $msgs[] = "$key: $value";
+        }
+        throw new Rest_Exception("Bad Request: " . join(", ", $msgs), 400);
+      }
     } catch (Rest_Exception $e) {
       rest::send_headers($e);
     }
-- 
cgit v1.2.3


From 9e9c5397b7602107afdda2894d2bf2bbd8ce652c Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 16:59:25 -0800
Subject: Qualify the Bad Request output when the name is missing

---
 modules/tag/helpers/tags_rest.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/tag/helpers/tags_rest.php b/modules/tag/helpers/tags_rest.php
index 3ef897fd..7f0ed66a 100644
--- a/modules/tag/helpers/tags_rest.php
+++ b/modules/tag/helpers/tags_rest.php
@@ -33,7 +33,7 @@ class tags_rest_Core {
     access::required("edit", item::root());
 
     if (empty($request->params->name)) {
-      throw new Rest_Exception("Bad Request", 400);
+      throw new Rest_Exception("Bad Request: missing name", 400);
     }
 
     $tag = ORM::factory("tag")->where("name", "=", $request->params->name)->find();
-- 
cgit v1.2.3


From 5162e35d499e8f57f2cff8eefeb633538aad8a65 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 17:54:14 -0800
Subject: Use an empty password for the guest user.

---
 modules/user/helpers/user_installer.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/user/helpers/user_installer.php b/modules/user/helpers/user_installer.php
index 70bee300..f7e3b60b 100644
--- a/modules/user/helpers/user_installer.php
+++ b/modules/user/helpers/user_installer.php
@@ -68,6 +68,7 @@ class user_installer {
       "users",
       array("name" => "guest",
             "full_name" => "Guest User",
+            "password" => "",
             "guest" => true))
       ->execute();
 
-- 
cgit v1.2.3


From 3ef22d9d1a42e6f4ac1ebf32bceceb0e6fa03b4d Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 18:09:31 -0800
Subject: Add special output support for ORM_Validation_Exception

---
 modules/gallery_unit_test/views/kohana_unit_test_cli.php | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/modules/gallery_unit_test/views/kohana_unit_test_cli.php b/modules/gallery_unit_test/views/kohana_unit_test_cli.php
index 3203ee44..a0de0f52 100644
--- a/modules/gallery_unit_test/views/kohana_unit_test_cli.php
+++ b/modules/gallery_unit_test/views/kohana_unit_test_cli.php
@@ -57,6 +57,12 @@ foreach ($results as $class => $methods) {
         if ($result->getMessage()) {
           echo "  ", $result->getMessage(), "\n";
         }
+        if ($result instanceof ORM_Validation_Exception) {
+          echo "  Validation errors:\n";
+          foreach ($result->validation->errors() as $key => $value) {
+            echo "    $key: $value\n";
+          }
+        }
         echo "  ", $result->getFile(), " (Line ", $result->getLine(), ")\n";
         echo "\n";
         echo $result->getTraceAsString(), "\n";
-- 
cgit v1.2.3


From 05e8d560e4f3f0c2be29b15536914048f54d5e91 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 18:10:32 -0800
Subject: Refactor to work with model based validation.

While I'm at it, pull _make_comment() out of setup and only call it on
demand; this makes the tests run faster.
---
 modules/akismet/tests/Akismet_Helper_Test.php | 43 ++++++++++++++++-----------
 1 file changed, 25 insertions(+), 18 deletions(-)

diff --git a/modules/akismet/tests/Akismet_Helper_Test.php b/modules/akismet/tests/Akismet_Helper_Test.php
index d8605d5c..b32e9a02 100644
--- a/modules/akismet/tests/Akismet_Helper_Test.php
+++ b/modules/akismet/tests/Akismet_Helper_Test.php
@@ -23,19 +23,26 @@ class Akismet_Helper_Test extends Unit_Test_Case {
   public function setup() {
     Input::instance()->ip_address = "1.1.1.1";
     request::set_user_agent("Akismet_Helper_Test");
+    module::set_var("akismet", "api_key", "TEST_KEY");
+  }
+
+  private function _make_comment() {
+    $comment = ORM::factory("comment");
+    $comment->item_id = item::root()->id;
+    $comment->author_id = identity::guest()->id;
+    $comment->text = "This is a comment";
+    $comment->guest_name = "John Doe";
+    $comment->guest_email = "john@gallery2.org";
+    $comment->guest_url = "http://gallery2.org";
+    $comment->save();
 
-    $root = ORM::factory("item", 1);
-    $this->_comment = comment::create(
-      $root, identity::guest(), "This is a comment",
-      "John Doe", "john@gallery2.org", "http://gallery2.org");
-    foreach ($this->_comment->list_fields("comments") as $name => $field) {
+    // Set the server fields to a known placeholder
+    foreach ($comment->list_fields("comments") as $name => $field) {
       if (strpos($name, "server_") === 0) {
-        $this->_comment->$name = substr($name, strlen("server_"));
+        $comment->$name = substr($name, strlen("server_"));
       }
     }
-    $this->_comment->save();
-
-    module::set_var("akismet", "api_key", "TEST_KEY");
+    return $comment->save();
   }
 
   public function build_verify_request_test() {
@@ -51,8 +58,8 @@ class Akismet_Helper_Test extends Unit_Test_Case {
   }
 
   public function build_comment_check_request_test() {
-    $request = akismet::_build_request("comment-check", $this->_comment);
-    $id = $this->_comment->id;
+    $comment = $this->_make_comment();
+    $request = akismet::_build_request("comment-check", $comment);
     $expected = "POST /1.1/comment-check HTTP/1.0\r\n" .
       "Host: TEST_KEY.rest.akismet.com\r\n" .
       "Content-Type: application/x-www-form-urlencoded; charset=UTF-8\r\n" .
@@ -66,15 +73,15 @@ class Akismet_Helper_Test extends Unit_Test_Case {
       "SERVER_HTTP_ACCEPT_CHARSET=http_accept_charset&" .
       "blog=http%3A%2F%2F.%2F&comment_author=John+Doe&comment_author_email=john%40gallery2.org&" .
       "comment_author_url=http%3A%2F%2Fgallery2.org&comment_content=This+is+a+comment&" .
-      "comment_type=comment&permalink=http%3A%2F%2F.%2Findex.php%2Fcomments%2F{$id}&" .
+      "comment_type=comment&permalink=http%3A%2F%2F.%2Findex.php%2Fcomments%2F{$comment->id}&" .
       "referrer=http_referer&user_agent=http_user_agent&user_ip=remote_addr";
 
     $this->assert_equal($expected, $request);
   }
 
   public function build_submit_spam_request_test() {
-    $request = akismet::_build_request("submit-spam", $this->_comment);
-    $id = $this->_comment->id;
+    $comment = $this->_make_comment();
+    $request = akismet::_build_request("submit-spam", $comment);
     $expected =
       "POST /1.1/submit-spam HTTP/1.0\r\n" .
       "Host: TEST_KEY.rest.akismet.com\r\n" .
@@ -89,15 +96,15 @@ class Akismet_Helper_Test extends Unit_Test_Case {
       "SERVER_HTTP_ACCEPT_CHARSET=http_accept_charset&" .
       "blog=http%3A%2F%2F.%2F&comment_author=John+Doe&comment_author_email=john%40gallery2.org&" .
       "comment_author_url=http%3A%2F%2Fgallery2.org&comment_content=This+is+a+comment&" .
-      "comment_type=comment&permalink=http%3A%2F%2F.%2Findex.php%2Fcomments%2F{$id}&" .
+      "comment_type=comment&permalink=http%3A%2F%2F.%2Findex.php%2Fcomments%2F{$comment->id}&" .
       "referrer=http_referer&user_agent=http_user_agent&user_ip=remote_addr";
 
     $this->assert_equal($expected, $request);
   }
 
   public function build_submit_ham_request_test() {
-    $request = akismet::_build_request("submit-ham", $this->_comment);
-    $id = $this->_comment->id;
+    $comment = $this->_make_comment();
+    $request = akismet::_build_request("submit-ham", $comment);
     $expected =
       "POST /1.1/submit-ham HTTP/1.0\r\n" .
       "Host: TEST_KEY.rest.akismet.com\r\n" .
@@ -112,7 +119,7 @@ class Akismet_Helper_Test extends Unit_Test_Case {
       "SERVER_HTTP_ACCEPT_CHARSET=http_accept_charset&blog=http%3A%2F%2F.%2F&" .
       "comment_author=John+Doe&comment_author_email=john%40gallery2.org&" .
       "comment_author_url=http%3A%2F%2Fgallery2.org&comment_content=This+is+a+comment&" .
-      "comment_type=comment&permalink=http%3A%2F%2F.%2Findex.php%2Fcomments%2F{$id}&" .
+      "comment_type=comment&permalink=http%3A%2F%2F.%2Findex.php%2Fcomments%2F{$comment->id}&" .
       "referrer=http_referer&user_agent=http_user_agent&user_ip=remote_addr";
 
     $this->assert_equal($expected, $request);
-- 
cgit v1.2.3


From c13d5c35134fbdb637d32eaf721d90e0c3889739 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 19:24:48 -0800
Subject: Helper class for common test methods (like creating albums, photos,
 etc).

---
 modules/gallery_unit_test/helpers/test.php | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 modules/gallery_unit_test/helpers/test.php

diff --git a/modules/gallery_unit_test/helpers/test.php b/modules/gallery_unit_test/helpers/test.php
new file mode 100644
index 00000000..30a87807
--- /dev/null
+++ b/modules/gallery_unit_test/helpers/test.php
@@ -0,0 +1,30 @@
+<?php defined("SYSPATH") or die("No direct script access.");
+/**
+ * Gallery - a web based photo album viewer and editor
+ * Copyright (C) 2000-2009 Bharat Mediratta
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or (at
+ * your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+class test_Core {
+  static function random_album($parent=null) {
+    $rand = rand();
+
+    $album = ORM::factory("item");
+    $album->type = "album";
+    $album->parent_id = $parent ? $parent->id : 1;
+    $album->name = "test_$rand";
+    return $album->save();
+  }
+}
-- 
cgit v1.2.3


From 53a17e3444e677dbb1878db68ffa1677511690c3 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 19:26:22 -0800
Subject: Add album title in random_album().

---
 modules/gallery_unit_test/helpers/test.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/gallery_unit_test/helpers/test.php b/modules/gallery_unit_test/helpers/test.php
index 30a87807..2fa12a23 100644
--- a/modules/gallery_unit_test/helpers/test.php
+++ b/modules/gallery_unit_test/helpers/test.php
@@ -24,7 +24,8 @@ class test_Core {
     $album = ORM::factory("item");
     $album->type = "album";
     $album->parent_id = $parent ? $parent->id : 1;
-    $album->name = "test_$rand";
+    $album->name = "name_$rand";
+    $album->title = "title_$rand";
     return $album->save();
   }
 }
-- 
cgit v1.2.3


From f68862f4c9a595cfd84e844e85339f7ed82c6c1a Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 19:26:32 -0800
Subject: Updated for model based validation.

---
 modules/comment/tests/Comment_Event_Test.php | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/modules/comment/tests/Comment_Event_Test.php b/modules/comment/tests/Comment_Event_Test.php
index ff7f1c26..5b7daef4 100644
--- a/modules/comment/tests/Comment_Event_Test.php
+++ b/modules/comment/tests/Comment_Event_Test.php
@@ -19,14 +19,17 @@
  */
 class Comment_Event_Test extends Unit_Test_Case {
   public function deleting_an_item_deletes_its_comments_too_test() {
-    $rand = rand();
-    $album = album::create(ORM::factory("item", 1), "test_$rand", "test_$rand");
-    $comment = comment::create(
-      $album, identity::guest(), "text_$rand", "name_$rand", "email_$rand", "url_$rand");
+    $album = test::random_album();
+
+    $comment = ORM::factory("comment");
+    $comment->item_id = $album->id;
+    $comment->author_id = identity::guest()->id;
+    $comment->guest_name = "test";
+    $comment->text = "text";
+    $comment->save();
 
     $album->delete();
 
-    $deleted_comment = ORM::factory("comment", $comment->id);
-    $this->assert_false($deleted_comment->loaded());
+    $this->assert_false(ORM::factory("comment")->where("id", "=", $comment->id)->find()->loaded());
   }
 }
-- 
cgit v1.2.3


From c863544ec39da4f39e30cf28ea4972c0ad1e3923 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 19:31:49 -0800
Subject: Add validation for guest_email and guest_url.

---
 modules/comment/models/comment.php | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/modules/comment/models/comment.php b/modules/comment/models/comment.php
index 891ffbce..69b8505e 100644
--- a/modules/comment/models/comment.php
+++ b/modules/comment/models/comment.php
@@ -60,10 +60,12 @@ class Comment_Model extends ORM {
     // validate() is recursive, only modify the rules on the outermost call.
     if (!$array) {
       $this->rules = array(
-        "guest_name" => array("callbacks" => array(array($this, "valid_author"))),
-        "item_id"    => array("callbacks" => array(array($this, "valid_item"))),
-        "state"      => array("rules"     => array("Comment_Model::valid_state")),
-        "text"       => array("rules"     => array("required")),
+        "guest_name"  => array("callbacks" => array(array($this, "valid_author"))),
+        "guest_email" => array("rules"     => array("email")),
+        "guest_url"   => array("rules"     => array("url")),
+        "item_id"     => array("callbacks" => array(array($this, "valid_item"))),
+        "state"       => array("rules"     => array("Comment_Model::valid_state")),
+        "text"        => array("rules"     => array("required")),
       );
     }
 
-- 
cgit v1.2.3


From c5c17eecc3334649ee3f78bc4117262d1505eb3b Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 19:32:05 -0800
Subject: Updated for model based validation.

---
 modules/comment/tests/Comment_Helper_Test.php | 32 ++++++++++++++++-----------
 1 file changed, 19 insertions(+), 13 deletions(-)

diff --git a/modules/comment/tests/Comment_Helper_Test.php b/modules/comment/tests/Comment_Helper_Test.php
index 8e726869..d780aba6 100644
--- a/modules/comment/tests/Comment_Helper_Test.php
+++ b/modules/comment/tests/Comment_Helper_Test.php
@@ -48,15 +48,19 @@ class Comment_Helper_Test extends Unit_Test_Case {
   }
 
   public function create_comment_for_guest_test() {
-    $rand = rand();
-    $root = ORM::factory("item", 1);
-    $comment = comment::create(
-      $root, identity::guest(), "text_$rand", "name_$rand", "email_$rand", "url_$rand");
+    $comment = ORM::factory("comment");
+    $comment->item_id = item::root()->id;
+    $comment->text = "text";
+    $comment->author_id = identity::guest()->id;
+    $comment->guest_name = "name";
+    $comment->guest_email = "email@email.com";
+    $comment->guest_url = "http://url.com";
+    $comment->save();
 
-    $this->assert_equal("name_$rand", $comment->author_name());
-    $this->assert_equal("email_$rand", $comment->author_email());
-    $this->assert_equal("url_$rand", $comment->author_url());
-    $this->assert_equal("text_$rand", $comment->text);
+    $this->assert_equal("name", $comment->author_name());
+    $this->assert_equal("email@email.com", $comment->author_email());
+    $this->assert_equal("http://url.com", $comment->author_url());
+    $this->assert_equal("text", $comment->text);
     $this->assert_equal(1, $comment->item_id);
 
     $this->assert_equal("REMOTE_ADDR", $comment->server_remote_addr);
@@ -78,16 +82,18 @@ class Comment_Helper_Test extends Unit_Test_Case {
   }
 
   public function create_comment_for_user_test() {
-    $rand = rand();
-    $root = ORM::factory("item", 1);
     $admin = identity::admin_user();
-    $comment = comment::create(
-      $root, $admin, "text_$rand", "name_$rand", "email_$rand", "url_$rand");
+
+    $comment = ORM::factory("comment");
+    $comment->item_id = item::root()->id;
+    $comment->text = "text";
+    $comment->author_id = $admin->id;
+    $comment->save();
 
     $this->assert_equal($admin->full_name, $comment->author_name());
     $this->assert_equal($admin->email, $comment->author_email());
     $this->assert_equal($admin->url, $comment->author_url());
-    $this->assert_equal("text_$rand", $comment->text);
+    $this->assert_equal("text", $comment->text);
     $this->assert_equal(1, $comment->item_id);
 
     $this->assert_equal("REMOTE_ADDR", $comment->server_remote_addr);
-- 
cgit v1.2.3


From c5f9a466c88985857bd7ef9499b631520d4a3365 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 19:33:44 -0800
Subject: Updated for model based validation.

---
 modules/comment/tests/Comment_Model_Test.php | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/modules/comment/tests/Comment_Model_Test.php b/modules/comment/tests/Comment_Model_Test.php
index aa91d6f2..c98eb63c 100644
--- a/modules/comment/tests/Comment_Model_Test.php
+++ b/modules/comment/tests/Comment_Model_Test.php
@@ -20,21 +20,24 @@
 class Comment_Model_Test extends Unit_Test_Case {
 
   public function cant_view_comments_for_unviewable_items_test() {
-    $root = ORM::factory("item", 1);
-    $album = album::create($root, rand(), rand(), rand());
-    $comment = comment::create($album, identity::guest(), "text", "name", "email", "url");
+    $album = test::random_album();
+
+    $comment = ORM::factory("comment");
+    $comment->item_id = $album->id;
+    $comment->author_id = identity::admin_user()->id;
+    $comment->text = "text";
+    $comment->save();
+
     identity::set_active_user(identity::guest());
 
     // We can see the comment when permissions are granted on the album
     access::allow(identity::everybody(), "view", $album);
-    $this->assert_equal(
-      1,
+    $this->assert_true(
       ORM::factory("comment")->viewable()->where("comments.id", "=", $comment->id)->count_all());
 
     // We can't see the comment when permissions are denied on the album
     access::deny(identity::everybody(), "view", $album);
-    $this->assert_equal(
-      0,
+    $this->assert_false(
       ORM::factory("comment")->viewable()->where("comments.id", "=", $comment->id)->count_all());
   }
 }
-- 
cgit v1.2.3


From c9fd8d751d3bb46b8b0d6d5bea0cf8272f06c11b Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 19:57:24 -0800
Subject: Add random_photo()

---
 modules/gallery_unit_test/helpers/test.php | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/modules/gallery_unit_test/helpers/test.php b/modules/gallery_unit_test/helpers/test.php
index 2fa12a23..6dfa3cf0 100644
--- a/modules/gallery_unit_test/helpers/test.php
+++ b/modules/gallery_unit_test/helpers/test.php
@@ -28,4 +28,15 @@ class test_Core {
     $album->title = "title_$rand";
     return $album->save();
   }
+
+  static function random_photo($parent=null) {
+    $rand = rand();
+    $photo = ORM::factory("item");
+    $photo->type = "photo";
+    $photo->parent_id = $parent ? $parent->id : 1;
+    $photo->set_data_file(MODPATH . "gallery/tests/test.jpg");
+    $photo->name = "name_$rand.jpg";
+    $photo->title = "title_$rand";
+    return $photo->save();
+  }
 }
-- 
cgit v1.2.3


From afb7decb00c5e668cd8c47fd30396dcc1f0c5442 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 19:57:42 -0800
Subject: Make it work with model based validation. Refactor _get_proxy() out
 of setup() and into its own helper function.

---
 modules/digibug/tests/Digibug_Controller_Test.php | 36 +++++++++++------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/modules/digibug/tests/Digibug_Controller_Test.php b/modules/digibug/tests/Digibug_Controller_Test.php
index 015a270a..38dcd8e9 100644
--- a/modules/digibug/tests/Digibug_Controller_Test.php
+++ b/modules/digibug/tests/Digibug_Controller_Test.php
@@ -18,41 +18,41 @@
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
 class Digibug_Controller_Test extends Unit_Test_Case {
-  private $_proxy;
-  private $_item;
   private $_server;
 
+  public function setup() {
+    $this->_server = $_SERVER;
+  }
+
   public function teardown() {
     $_SERVER = $this->_server;
   }
 
-  public function setup() {
-    $this->_server = $_SERVER;
+  private function _get_proxy() {
+    $album = test::random_album();
+    $photo = test::random_photo($album);
 
-    $root = ORM::factory("item", 1);
-    $this->_album = album::create($root,  rand(), "test album");
-    access::deny(identity::everybody(), "view_full", $this->_album);
-    access::deny(identity::registered_users(), "view_full", $this->_album);
+    access::deny(identity::everybody(), "view_full", $album);
+    access::deny(identity::registered_users(), "view_full", $album);
 
-    $rand = rand();
-    $this->_item = photo::create($this->_album, MODPATH . "gallery/tests/test.jpg", "$rand.jpg",
-                                 $rand, $rand);
-    $this->_proxy = ORM::factory("digibug_proxy");
-    $this->_proxy->uuid = md5(rand());
-    $this->_proxy->item_id = $this->_item->id;
-    $this->_proxy->save();
+    $proxy = ORM::factory("digibug_proxy");
+    $proxy->uuid = md5(rand());
+    $proxy->item_id = $photo->id;
+    return $proxy->save();
   }
 
   public function digibug_request_thumb_test() {
+    $proxy = $this->_get_proxy();
+
     $controller = new Digibug_Controller();
-    $controller->print_proxy("thumb", $this->_proxy->uuid);
+    $controller->print_proxy("thumb", $proxy->uuid);
   }
 
   public function digibug_request_full_malicious_ip_test() {
     $_SERVER["REMOTE_ADDR"] = "123.123.123.123";
     try {
       $controller = new Digibug_Controller();
-      $controller->print_proxy("full", $this->_proxy->uuid);
+      $controller->print_proxy("full", $this->_get_proxy()->uuid);
       $this->assert_true(false, "Should have failed with an 404 exception");
     } catch (Kohana_404_Exception $e) {
       // expected behavior
@@ -69,6 +69,6 @@ class Digibug_Controller_Test extends Unit_Test_Case {
 
     $_SERVER["REMOTE_ADDR"] = long2ip(rand($low, $high));
     $controller = new Digibug_Controller();
-    $controller->print_proxy("full", $this->_proxy->uuid);
+    $controller->print_proxy("full", $this->_get_proxy()->uuid);
   }
 }
-- 
cgit v1.2.3


From 39bb08db2847d2c6faf945ccf901bc34edbca355 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 20:02:30 -0800
Subject: Make set_data_file() chainable.

---
 modules/gallery/models/item.php | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php
index 453a3525..fcd9b8e6 100644
--- a/modules/gallery/models/item.php
+++ b/modules/gallery/models/item.php
@@ -169,9 +169,11 @@ class Item_Model extends ORM_MPTT {
   /**
    * Specify the path to the data file associated with this item.  To actually associate it,
    * you still have to call save().
+   * @chainable
    */
   public function set_data_file($data_file) {
     $this->data_file = $data_file;
+    return $this;
   }
 
   /**
-- 
cgit v1.2.3


From c0d01425528a979634b514250347f5bab25cf9a0 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 20:03:18 -0800
Subject: Updated for model based validation.

---
 modules/exif/tests/Exif_Test.php | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/modules/exif/tests/Exif_Test.php b/modules/exif/tests/Exif_Test.php
index 5c5a5cb1..eca5d027 100644
--- a/modules/exif/tests/Exif_Test.php
+++ b/modules/exif/tests/Exif_Test.php
@@ -19,10 +19,9 @@
  */
 class Exif_Test extends Unit_Test_Case {
   public function exif_extract_test() {
-    $rand = rand();
-    $root = ORM::factory("item", 1);
-    $photo = photo::create(
-      $root, MODPATH . "exif/tests/data/image.jpg", "$rand.jpg", $rand, $rand);
+    $photo = test::random_photo()
+      ->set_data_file(MODPATH . "exif/tests/data/image.jpg")
+      ->save();
 
     $expected = array(
       array("caption" => "Camera Maker", "value" => "Pentax Corporation"),
-- 
cgit v1.2.3


From dd5f08b703754b88f10234db94c44f153e4f37ca Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 20:06:28 -0800
Subject: Create xxx_unsaved() versions for the case where you want to tinker
 with the item before it gets saved.

---
 modules/gallery_unit_test/helpers/test.php | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/modules/gallery_unit_test/helpers/test.php b/modules/gallery_unit_test/helpers/test.php
index 6dfa3cf0..5368539f 100644
--- a/modules/gallery_unit_test/helpers/test.php
+++ b/modules/gallery_unit_test/helpers/test.php
@@ -18,7 +18,7 @@
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
 class test_Core {
-  static function random_album($parent=null) {
+  static function random_album_unsaved($parent=null) {
     $rand = rand();
 
     $album = ORM::factory("item");
@@ -26,10 +26,14 @@ class test_Core {
     $album->parent_id = $parent ? $parent->id : 1;
     $album->name = "name_$rand";
     $album->title = "title_$rand";
-    return $album->save();
+    return $album;
   }
 
-  static function random_photo($parent=null) {
+  static function random_album($parent=null) {
+    return test::random_album_unsaved($parent)->save();
+  }
+
+  static function random_photo_unsaved($parent=null) {
     $rand = rand();
     $photo = ORM::factory("item");
     $photo->type = "photo";
@@ -37,6 +41,10 @@ class test_Core {
     $photo->set_data_file(MODPATH . "gallery/tests/test.jpg");
     $photo->name = "name_$rand.jpg";
     $photo->title = "title_$rand";
-    return $photo->save();
+    return $photo;
+  }
+
+  static function random_photo($parent=null) {
+    return test::random_photo_unsaved($parent)->save();
   }
 }
-- 
cgit v1.2.3


From 7d9d40c7d68ea29dd37c963336fb34fa3abbedfa Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 20:06:34 -0800
Subject: Use test::random_photo_unsaved() instead.

---
 modules/exif/tests/Exif_Test.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/exif/tests/Exif_Test.php b/modules/exif/tests/Exif_Test.php
index eca5d027..191bdb99 100644
--- a/modules/exif/tests/Exif_Test.php
+++ b/modules/exif/tests/Exif_Test.php
@@ -19,7 +19,7 @@
  */
 class Exif_Test extends Unit_Test_Case {
   public function exif_extract_test() {
-    $photo = test::random_photo()
+    $photo = test::random_photo_unsaved()
       ->set_data_file(MODPATH . "exif/tests/data/image.jpg")
       ->save();
 
-- 
cgit v1.2.3


From ab7be17b7fae9dbff42a77cb5eff85cf0c8d824d Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 20:17:50 -0800
Subject: Switch to model based validation approach.

---
 modules/user/libraries/drivers/IdentityProvider/Gallery.php | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/modules/user/libraries/drivers/IdentityProvider/Gallery.php b/modules/user/libraries/drivers/IdentityProvider/Gallery.php
index d874512c..9927ea33 100644
--- a/modules/user/libraries/drivers/IdentityProvider/Gallery.php
+++ b/modules/user/libraries/drivers/IdentityProvider/Gallery.php
@@ -39,7 +39,11 @@ class IdentityProvider_Gallery_Driver implements IdentityProvider_Driver {
    * @see IdentityProvider_Driver::create_user.
    */
   public function create_user($name, $full_name, $password) {
-    return user::create($name, $full_name, $password);
+    $user = ORM::factory("user");
+    $user->name = $name;
+    $user->full_name = $full_name;
+    $user->password = $password;
+    return $user->save();
   }
 
   /**
@@ -91,7 +95,9 @@ class IdentityProvider_Gallery_Driver implements IdentityProvider_Driver {
    * @see IdentityProvider_Driver::create_group.
    */
   public function create_group($name) {
-    return group::create($name);
+    $group = ORM::factory("group");
+    $group->name = $name;
+    return $group->save();
   }
 
   /**
-- 
cgit v1.2.3


From f20fa2cfedc42f98a38a77d77186d180bd0c3426 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 20:37:25 -0800
Subject: Change IdentityProvider::create_user() to take $email as well, since
 that's a required parameter for the Gallery driver.

---
 modules/gallery/helpers/identity.php                        | 4 ++--
 modules/gallery/libraries/IdentityProvider.php              | 4 ++--
 modules/gallery/libraries/drivers/IdentityProvider.php      | 3 ++-
 modules/user/libraries/drivers/IdentityProvider/Gallery.php | 3 ++-
 4 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/modules/gallery/helpers/identity.php b/modules/gallery/helpers/identity.php
index eae0ea3e..ef93d72f 100644
--- a/modules/gallery/helpers/identity.php
+++ b/modules/gallery/helpers/identity.php
@@ -155,8 +155,8 @@ class identity_Core {
   /**
    * @see IdentityProvider_Driver::create_user.
    */
-  static function create_user($name, $full_name, $password) {
-    return IdentityProvider::instance()->create_user($name, $full_name, $password);
+  static function create_user($name, $full_name, $password, $email) {
+    return IdentityProvider::instance()->create_user($name, $full_name, $password, $email);
   }
 
   /**
diff --git a/modules/gallery/libraries/IdentityProvider.php b/modules/gallery/libraries/IdentityProvider.php
index bcb3056a..30d4efa4 100644
--- a/modules/gallery/libraries/IdentityProvider.php
+++ b/modules/gallery/libraries/IdentityProvider.php
@@ -119,8 +119,8 @@ class IdentityProvider_Core {
   /**
    * @see IdentityProvider_Driver::create_user.
    */
-  public function create_user($name, $full_name, $password) {
-    return $this->driver->create_user($name, $full_name, $password);
+  public function create_user($name, $full_name, $password, $email) {
+    return $this->driver->create_user($name, $full_name, $password, $email);
   }
 
   /**
diff --git a/modules/gallery/libraries/drivers/IdentityProvider.php b/modules/gallery/libraries/drivers/IdentityProvider.php
index a808c7e8..b7b1fbe8 100644
--- a/modules/gallery/libraries/drivers/IdentityProvider.php
+++ b/modules/gallery/libraries/drivers/IdentityProvider.php
@@ -38,9 +38,10 @@ interface IdentityProvider_Driver {
    * @param string  $name
    * @param string  $full_name
    * @param string  $password
+   * @param string  $email
    * @return User_Definition the user object
    */
-  public function create_user($name, $full_name, $password);
+  public function create_user($name, $full_name, $password, $email);
 
   /**
    * Is the password provided correct?
diff --git a/modules/user/libraries/drivers/IdentityProvider/Gallery.php b/modules/user/libraries/drivers/IdentityProvider/Gallery.php
index 9927ea33..666f185f 100644
--- a/modules/user/libraries/drivers/IdentityProvider/Gallery.php
+++ b/modules/user/libraries/drivers/IdentityProvider/Gallery.php
@@ -38,11 +38,12 @@ class IdentityProvider_Gallery_Driver implements IdentityProvider_Driver {
   /**
    * @see IdentityProvider_Driver::create_user.
    */
-  public function create_user($name, $full_name, $password) {
+  public function create_user($name, $full_name, $password, $email) {
     $user = ORM::factory("user");
     $user->name = $name;
     $user->full_name = $full_name;
     $user->password = $password;
+    $user->email = $email;
     return $user->save();
   }
 
-- 
cgit v1.2.3


From 6e73b08595c8fc3a2473eb38d6b51db558b21bb4 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 20:37:57 -0800
Subject: Mostly conver to model based validation.  Not all tests pass yet.

---
 modules/gallery/tests/Access_Helper_Test.php | 110 +++++++++++----------------
 1 file changed, 44 insertions(+), 66 deletions(-)

diff --git a/modules/gallery/tests/Access_Helper_Test.php b/modules/gallery/tests/Access_Helper_Test.php
index 084bfb47..ac41743a 100644
--- a/modules/gallery/tests/Access_Helper_Test.php
+++ b/modules/gallery/tests/Access_Helper_Test.php
@@ -40,8 +40,7 @@ class Access_Helper_Test extends Unit_Test_Case {
     } catch (Exception $e) { }
 
     // Reset some permissions that we mangle below
-    $root = ORM::factory("item", 1);
-    access::allow(identity::everybody(), "view", $root);
+    access::allow(identity::everybody(), "view", item::root());
   }
 
   public function setup() {
@@ -67,15 +66,14 @@ class Access_Helper_Test extends Unit_Test_Case {
   public function user_can_access_test() {
     $access_test = identity::create_group("access_test");
 
-    $root = ORM::factory("item", 1);
-    access::allow($access_test, "view", $root);
+    access::allow($access_test, "view", item::root());
 
-    $item = album::create($root,  rand(), "test album");
+    $item = test::random_album();
 
     access::deny(identity::everybody(), "view", $item);
     access::deny(identity::registered_users(), "view", $item);
 
-    $user = identity::create_user("access_test", "Access Test", "");
+    $user = identity::create_user("access_test", "Access Test", "*****", "user@user.com");
     foreach ($user->groups() as $group) {
       $user->remove($group);
     }
@@ -86,13 +84,12 @@ class Access_Helper_Test extends Unit_Test_Case {
   }
 
   public function user_can_no_access_test() {
-    $root = ORM::factory("item", 1);
-    $item = album::create($root,  rand(), "test album");
+    $item = test::random_album();
 
     access::deny(identity::everybody(), "view", $item);
     access::deny(identity::registered_users(), "view", $item);
 
-    $user = identity::create_user("access_test", "Access Test", "");
+    $user = identity::create_user("access_test", "Access Test", "*****", "user@user.com");
     foreach ($user->groups() as $group) {
       $user->remove($group);
     }
@@ -102,8 +99,7 @@ class Access_Helper_Test extends Unit_Test_Case {
   }
 
   public function adding_and_removing_items_adds_ands_removes_rows_test() {
-    $root = ORM::factory("item", 1);
-    $item = album::create($root,  rand(), "test album");
+    $item = test::random_album();
 
     // New rows exist
     $this->assert_true(ORM::factory("access_cache")->where("item_id", "=", $item->id)->find()->loaded());
@@ -118,19 +114,16 @@ class Access_Helper_Test extends Unit_Test_Case {
   }
 
   public function new_photos_inherit_parent_permissions_test() {
-    $root = ORM::factory("item", 1);
-
-    $album = album::create($root, rand(), "test album");
+    $album = test::random_album();
     access::allow(identity::everybody(), "view", $album);
 
-    $photo = photo::create($album, MODPATH . "gallery/images/gallery.png", "", "");
+    $photo = test::random_photo($album);
 
     $this->assert_true($photo->__get("view_" . identity::everybody()->id));
   }
 
   public function can_allow_deny_and_reset_intent_test() {
-    $root = ORM::factory("item", 1);
-    $album = album::create($root, rand(), "test album");
+    $album = test::random_album();
     $intent = ORM::factory("access_intent")->where("item_id", "=", $album->id)->find();
 
     // Allow
@@ -166,23 +159,21 @@ class Access_Helper_Test extends Unit_Test_Case {
   }
 
   public function can_view_item_test() {
-    $root = ORM::factory("item", 1);
-    access::allow(identity::everybody(), "view", $root);
-    $this->assert_true(access::group_can(identity::everybody(), "view", $root));
+    access::allow(identity::everybody(), "view", item::root());
+    $this->assert_true(access::group_can(identity::everybody(), "view", item::root()));
   }
 
   public function can_always_fails_on_unloaded_items_test() {
-    $root = ORM::factory("item", 1);
-    access::allow(identity::everybody(), "view", $root);
-    $this->assert_true(access::group_can(identity::everybody(), "view", $root));
+    access::allow(identity::everybody(), "view", item::root());
+    $this->assert_true(access::group_can(identity::everybody(), "view", item::root()));
 
     $bogus = ORM::factory("item", -1);
     $this->assert_false(access::group_can(identity::everybody(), "view", $bogus));
   }
 
   public function cant_view_child_of_hidden_parent_test() {
-    $root = ORM::factory("item", 1);
-    $album = album::create($root, rand(), "test album");
+    $root = item::root();
+    $album = test::random_album();
 
     $root->reload();
     access::deny(identity::everybody(), "view", $root);
@@ -193,28 +184,26 @@ class Access_Helper_Test extends Unit_Test_Case {
   }
 
   public function view_permissions_propagate_down_test() {
-    $root = ORM::factory("item", 1);
-    $album = album::create($root, rand(), "test album");
+    $album = test::random_album();
 
-    access::allow(identity::everybody(), "view", $root);
+    access::allow(identity::everybody(), "view", item::root());
     access::reset(identity::everybody(), "view", $album);
     $album->reload();
     $this->assert_true(access::group_can(identity::everybody(), "view", $album));
   }
 
   public function can_toggle_view_permissions_propagate_down_test() {
-    $root = ORM::factory("item", 1);
-    $album1 = album::create($root, rand(), "test album");
-    $album2 = album::create($album1, rand(), "test album");
-    $album3 = album::create($album2, rand(), "test album");
-    $album4 = album::create($album3, rand(), "test album");
+    $album1 = test::random_album(item::root());
+    $album2 = test::random_album($album1);
+    $album3 = test::random_album($album2);
+    $album4 = test::random_album($album3);
 
     $album1->reload();
     $album2->reload();
     $album3->reload();
     $album4->reload();
 
-    access::allow(identity::everybody(), "view", $root);
+    access::allow(identity::everybody(), "view", item::root());
     access::deny(identity::everybody(), "view", $album1);
     access::reset(identity::everybody(), "view", $album2);
     access::reset(identity::everybody(), "view", $album3);
@@ -229,9 +218,9 @@ class Access_Helper_Test extends Unit_Test_Case {
   }
 
   public function revoked_view_permissions_cant_be_allowed_lower_down_test() {
-    $root = ORM::factory("item", 1);
-    $album1 = album::create($root, rand(), "test album");
-    $album2 = album::create($album1, rand(), "test album");
+    $root = item::root();
+    $album1 = test::random_album($root);
+    $album2 = test::random_album($album1);
 
     $root->reload();
     access::deny(identity::everybody(), "view", $root);
@@ -245,38 +234,30 @@ class Access_Helper_Test extends Unit_Test_Case {
   }
 
   public function can_edit_item_test() {
-    $root = ORM::factory("item", 1);
+    $root = item::root();
     access::allow(identity::everybody(), "edit", $root);
     $this->assert_true(access::group_can(identity::everybody(), "edit", $root));
   }
 
   public function non_view_permissions_propagate_down_test() {
-    $root = ORM::factory("item", 1);
-    $album = album::create($root, rand(), "test album");
+    $album = test::random_album();
 
-    access::allow(identity::everybody(), "edit", $root);
+    access::allow(identity::everybody(), "edit", item::root());
     access::reset(identity::everybody(), "edit", $album);
     $this->assert_true(access::group_can(identity::everybody(), "edit", $album));
   }
 
   public function non_view_permissions_can_be_revoked_lower_down_test() {
-    $root = ORM::factory("item", 1);
-    $outer = album::create($root, rand(), "test album");
-    $outer_photo = ORM::factory("item");
-    $outer_photo->type = "photo";
-    $outer_photo->add_to_parent($outer);
-    access::add_item($outer_photo);
-
-    $inner = album::create($outer, rand(), "test album");
-    $inner_photo = ORM::factory("item");
-    $inner_photo->type = "photo";
-    $inner_photo->add_to_parent($inner);
-    access::add_item($inner_photo);
+    $outer = test::random_album();
+    $outer_photo = test::random_photo($outer);
+
+    $inner = test::random_album($outer);
+    $inner_photo = test::random_photo($inner);
 
     $outer->reload();
     $inner->reload();
 
-    access::allow(identity::everybody(), "edit", $root);
+    access::allow(identity::everybody(), "edit", item::root());
     access::deny(identity::everybody(), "edit", $outer);
     access::allow(identity::everybody(), "edit", $inner);
 
@@ -287,7 +268,7 @@ class Access_Helper_Test extends Unit_Test_Case {
 
   public function i_can_edit_test() {
     // Create a new user that belongs to no groups
-    $user = identity::create_user("access_test", "Access Test", "");
+    $user = identity::create_user("access_test", "Access Test", "*****", "user@user.com");
     foreach ($user->groups() as $group) {
       $user->remove($group);
     }
@@ -295,7 +276,7 @@ class Access_Helper_Test extends Unit_Test_Case {
     identity::set_active_user($user);
 
     // This user can't edit anything
-    $root = ORM::factory("item", 1);
+    $root = item::root();
     $this->assert_false(access::can("edit", $root));
 
     // Now add them to a group that has edit permission
@@ -312,8 +293,7 @@ class Access_Helper_Test extends Unit_Test_Case {
   }
 
   public function everybody_view_permission_maintains_htaccess_files_test() {
-    $root = ORM::factory("item", 1);
-    $album = album::create($root, rand(), "test album");
+    $album = test::random_album();
 
     $this->assert_false(file_exists($album->file_path() . "/.htaccess"));
 
@@ -331,8 +311,7 @@ class Access_Helper_Test extends Unit_Test_Case {
   }
 
   public function everybody_view_full_permission_maintains_htaccess_files_test() {
-    $root = ORM::factory("item", 1);
-    $album = album::create($root, rand(), "test album");
+    $album = test::random_album();
 
     $this->assert_false(file_exists($album->file_path() . "/.htaccess"));
     $this->assert_false(file_exists($album->resize_path() . "/.htaccess"));
@@ -362,16 +341,15 @@ class Access_Helper_Test extends Unit_Test_Case {
   public function moved_items_inherit_new_permissions_test() {
     identity::set_active_user(identity::lookup_user_by_name("admin"));
 
-    $root = ORM::factory("item", 1);
-    $public_album = album::create($root, rand(), "public album");
-    $public_photo = photo::create($public_album, MODPATH . "gallery/images/gallery.png", "", "");
+    $public_album = test::random_album();
+    $public_photo = test::random_photo($public_album);
     access::allow(identity::everybody(), "view", $public_album);
 
-    $root->reload();  // Account for MPTT changes
+    item::root()->reload();  // Account for MPTT changes
 
-    $private_album = album::create($root, rand(), "private album");
+    $private_album = test::random_album();
     access::deny(identity::everybody(), "view", $private_album);
-    $private_photo = photo::create($private_album, MODPATH . "gallery/images/gallery.png", "", "");
+    $private_photo = test::random_photo($private_album);
 
     // Make sure that we now have a public photo and private photo.
     $this->assert_true(access::group_can(identity::everybody(), "view", $public_photo));
-- 
cgit v1.2.3


From 9ddb961a91f99ccc043981bbe8c8a661f9646563 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 20:53:32 -0800
Subject: Partially updated for model based validation.

---
 modules/gallery/tests/Item_Model_Test.php | 74 ++++++++++---------------------
 1 file changed, 24 insertions(+), 50 deletions(-)

diff --git a/modules/gallery/tests/Item_Model_Test.php b/modules/gallery/tests/Item_Model_Test.php
index bf5fca1a..a3f590a1 100644
--- a/modules/gallery/tests/Item_Model_Test.php
+++ b/modules/gallery/tests/Item_Model_Test.php
@@ -19,20 +19,13 @@
  */
 class Item_Model_Test extends Unit_Test_Case {
   public function saving_sets_created_and_updated_dates_test() {
-    $item = self::_create_random_item();
+    $item = test::random_photo();
     $this->assert_true(!empty($item->created));
     $this->assert_true(!empty($item->updated));
   }
 
-  private static function _create_random_item($root=null, $rand=null) {
-    $root = $root ? $root : ORM::factory("item", 1);
-    $rand = $rand ? $rand : rand();
-    $item = photo::create($root, MODPATH . "gallery/tests/test.jpg", "$rand.jpg", $rand, $rand);
-    return $item;
-  }
-
   public function updating_doesnt_change_created_date_test() {
-    $item = self::_create_random_item();
+    $item = test::random_photo();
 
     // Force the creation date to something well known
     db::build()
@@ -50,7 +43,7 @@ class Item_Model_Test extends Unit_Test_Case {
   }
 
   public function updating_view_count_only_doesnt_change_updated_date_test() {
-    $item = self::_create_random_item();
+    $item = test::random_photo();
     $item->reload();
     $this->assert_same(0, $item->view_count);
 
@@ -69,8 +62,7 @@ class Item_Model_Test extends Unit_Test_Case {
   }
 
   public function rename_photo_test() {
-    // Create a test photo
-    $item = self::_create_random_item();
+    $item = test::random_photo();
 
     file_put_contents($item->thumb_path(), "thumb");
     file_put_contents($item->resize_path(), "resize");
@@ -93,10 +85,8 @@ class Item_Model_Test extends Unit_Test_Case {
   }
 
   public function rename_album_test() {
-    // Create an album with a photo in it
-    $root = ORM::factory("item", 1);
-    $album = album::create($root, rand(), rand(), rand());
-    $photo = self::_create_random_item($album);
+    $album = test::random_album();
+    $photo = test::random_photo($album);
 
     file_put_contents($photo->thumb_path(), "thumb");
     file_put_contents($photo->resize_path(), "resize");
@@ -130,8 +120,7 @@ class Item_Model_Test extends Unit_Test_Case {
   }
 
   public function item_rename_wont_accept_slash_test() {
-    // Create a test photo
-    $item = self::_create_random_item();
+    $item = test::random_photo();
 
     $new_name = rand() . "/";
 
@@ -146,8 +135,8 @@ class Item_Model_Test extends Unit_Test_Case {
 
   public function item_rename_fails_with_existing_name_test() {
     // Create a test photo
-    $item = self::_create_random_item();
-    $item2 = self::_create_random_item();
+    $item = test::random_photo();
+    $item2 = test::random_photo();
 
     $new_name = $item2->name;
 
@@ -163,7 +152,7 @@ class Item_Model_Test extends Unit_Test_Case {
   }
 
   public function save_original_values_test() {
-    $item = self::_create_random_item();
+    $item = test::random_photo_unsaved();
     $item->title = "ORIGINAL_VALUE";
     $item->save();
     $item->title = "NEW_VALUE";
@@ -173,7 +162,7 @@ class Item_Model_Test extends Unit_Test_Case {
   }
 
   public function urls_are_rawurlencoded_test() {
-    $item = self::_create_random_item();
+    $item = test::random_photo_unsaved();
     $item->slug = "foo bar";
     $item->name = "foo bar.jpg";
     $item->save();
@@ -183,18 +172,16 @@ class Item_Model_Test extends Unit_Test_Case {
   }
 
   public function move_album_test() {
-    // Create an album with a photo in it
-    $root = ORM::factory("item", 1);
-    $album2 = album::create($root, rand(), rand(), rand());
-    $album = album::create($album2, rand(), rand(), rand());
-    $photo = self::_create_random_item($album);
+    $album2 = test::random_album();
+    $album = test::random_album($album2);
+    $photo = test::random_photo($album);
 
     file_put_contents($photo->thumb_path(), "thumb");
     file_put_contents($photo->resize_path(), "resize");
     file_put_contents($photo->file_path(), "file");
 
     // Now move the album
-    $album->move_to($root);
+    $album->move_to(item::root());
     $photo->reload();
 
     // Expected:
@@ -212,11 +199,9 @@ class Item_Model_Test extends Unit_Test_Case {
   }
 
   public function move_photo_test() {
-    // Create an album with a photo in it
-    $root = ORM::factory("item", 1);
-    $album2 = album::create($root, rand(), rand(), rand());
-    $album = album::create($album2, rand(), rand(), rand());
-    $photo = self::_create_random_item($album);
+    $album2 = test::random_album();
+    $album = test::random_album($album2);
+    $photo  = test::random_photo($album);
 
     file_put_contents($photo->thumb_path(), "thumb");
     file_put_contents($photo->resize_path(), "resize");
@@ -241,32 +226,23 @@ class Item_Model_Test extends Unit_Test_Case {
   }
 
   public function move_album_fails_invalid_target_test() {
-    // Create an album with a photo in it
-    $root = ORM::factory("item", 1);
-    $name = rand();
-    $album = album::create($root, $name, $name, $name);
-    $source = album::create($album, $name, $name, $name);
+    $album = test::random_album();
+    $source = test::random_album($album);
 
     try {
-      $source->move_to($root);
+      $source->move_to(item::root());
     } catch (Exception $e) {
       // pass
       $this->assert_true(strpos($e->getMessage(), "INVALID_MOVE_TARGET_EXISTS") !== false,
                          "incorrect exception.");
       return;
     }
-
-    $this->assert_false(true, "Item_Model::rename should not accept / characters");
   }
 
   public function move_photo_fails_invalid_target_test() {
-    // Create an album with a photo in it
-    $root = ORM::factory("item", 1);
-    $photo_name = rand();
-    $photo1 = self::_create_random_item($root, $photo_name);
-    $name = rand();
-    $album = album::create($root, $name, $name, $name);
-    $photo2 = self::_create_random_item($album, $photo_name);
+    $photo1 = test::random_photo();
+    $album = test::random_album();
+    $photo2 = test::random_photo($album);
 
     try {
       $photo2->move_to($root);
@@ -276,7 +252,5 @@ class Item_Model_Test extends Unit_Test_Case {
                          "incorrect exception.");
       return;
     }
-
-    $this->assert_false(true, "Item_Model::rename should not accept / characters");
   }
 }
-- 
cgit v1.2.3


From b35a3c8b81cc4867fc6143b3a401937b20ea82e2 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 20:54:08 -0800
Subject: Fix rename_photo_test().

---
 modules/gallery/tests/Item_Model_Test.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/gallery/tests/Item_Model_Test.php b/modules/gallery/tests/Item_Model_Test.php
index a3f590a1..52e0f799 100644
--- a/modules/gallery/tests/Item_Model_Test.php
+++ b/modules/gallery/tests/Item_Model_Test.php
@@ -72,7 +72,8 @@ class Item_Model_Test extends Unit_Test_Case {
     $new_name = rand();
 
     // Now rename it
-    $item->rename($new_name)->save();
+    $item->name = $new_name;
+    $item->save();
 
     // Expected: the name changed, the name is now baked into all paths, and all files were moved.
     $this->assert_equal($new_name, $item->name);
-- 
cgit v1.2.3


From 710e472edc95dd4b7a192348e11b81636ac83e52 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 21:03:15 -0800
Subject: Fix rename_album_test()

---
 modules/gallery/tests/Item_Model_Test.php | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/modules/gallery/tests/Item_Model_Test.php b/modules/gallery/tests/Item_Model_Test.php
index 52e0f799..a2720f7d 100644
--- a/modules/gallery/tests/Item_Model_Test.php
+++ b/modules/gallery/tests/Item_Model_Test.php
@@ -88,6 +88,7 @@ class Item_Model_Test extends Unit_Test_Case {
   public function rename_album_test() {
     $album = test::random_album();
     $photo = test::random_photo($album);
+    $album->reload();
 
     file_put_contents($photo->thumb_path(), "thumb");
     file_put_contents($photo->resize_path(), "resize");
@@ -98,7 +99,8 @@ class Item_Model_Test extends Unit_Test_Case {
     $new_album_name = rand();
 
     // Now rename the album
-    $album->rename($new_album_name)->save();
+    $album->name = $new_album_name;
+    $album->save();
     $photo->reload();
 
     // Expected:
-- 
cgit v1.2.3


From 06541f0e2a5cb9ee78b6b1553dd522dcc33a1b3d Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 21:49:48 -0800
Subject: Fix item_rename_fails_with_existing_name_test() -- broken because of
 http://dev.kohanaphp.com/issues/2504

---
 modules/gallery/tests/Item_Model_Test.php | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/modules/gallery/tests/Item_Model_Test.php b/modules/gallery/tests/Item_Model_Test.php
index a2720f7d..c4e150a6 100644
--- a/modules/gallery/tests/Item_Model_Test.php
+++ b/modules/gallery/tests/Item_Model_Test.php
@@ -141,17 +141,16 @@ class Item_Model_Test extends Unit_Test_Case {
     $item = test::random_photo();
     $item2 = test::random_photo();
 
-    $new_name = $item2->name;
-
     try {
-      $item->rename($new_name)->save();
-    } catch (Exception $e) {
-      // pass
-      $this->assert_true(strpos($e->getMessage(), "INVALID_RENAME_FILE_EXISTS") !== false,
-                         "incorrect exception.");
+      $item->name = $item2->name;
+      $item->validate();  // @todo: switch this to save() once
+                          // http://dev.kohanaphp.com/issues/2504 is fixed.
+    } catch (ORM_Validation_Exception $e) {
+      $this->assert_true(in_array("conflict", $e->validation->errors()));
       return;
     }
-    $this->assert_false(true, "Item_Model::rename should fail.");
+
+    $this->assert_false(true, "rename should conflict");
   }
 
   public function save_original_values_test() {
-- 
cgit v1.2.3


From 31ecb009bac2d9177329aafb9596fbfa65bd6a04 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 23:45:18 -0800
Subject: Get rid of urls_are_rawurlencoded_test -- it's no longer necessary
 since we can't have unsafe slugs.

Add basic_validation_test.
---
 modules/gallery/tests/Item_Model_Test.php | 40 +++++++++++++++++++++++--------
 1 file changed, 30 insertions(+), 10 deletions(-)

diff --git a/modules/gallery/tests/Item_Model_Test.php b/modules/gallery/tests/Item_Model_Test.php
index c4e150a6..ea6c2af6 100644
--- a/modules/gallery/tests/Item_Model_Test.php
+++ b/modules/gallery/tests/Item_Model_Test.php
@@ -163,16 +163,6 @@ class Item_Model_Test extends Unit_Test_Case {
     $this->assert_same("NEW_VALUE", $item->title);
   }
 
-  public function urls_are_rawurlencoded_test() {
-    $item = test::random_photo_unsaved();
-    $item->slug = "foo bar";
-    $item->name = "foo bar.jpg";
-    $item->save();
-
-    $this->assert_equal("foo%20bar", $item->relative_url());
-    $this->assert_equal("foo%20bar.jpg", $item->relative_path());
-  }
-
   public function move_album_test() {
     $album2 = test::random_album();
     $album = test::random_album($album2);
@@ -255,4 +245,34 @@ class Item_Model_Test extends Unit_Test_Case {
       return;
     }
   }
+
+  public function basic_validation_test() {
+    $item = ORM::factory("item");
+    $item->album_cover_item_id = rand();  // invalid
+    $item->description = str_repeat("x", 70000);  // invalid
+    $item->name = null;
+    $item->parent_id = rand();
+    $item->slug = null;
+    $item->sort_column = "bogus";
+    $item->sort_order = "bogus";
+    $item->title = null;
+    $item->type = "bogus";
+    try {
+      $item->save();
+    } catch (ORM_Validation_Exception $e) {
+      $this->assert_same(array("description" => "length",
+                               "name" => "required",
+                               "slug" => "required",
+                               "title" => "required",
+                               "album_cover_item_id" => "invalid_item",
+                               "parent_id" => "invalid",
+                               "sort_column" => "invalid",
+                               "sort_order" => "invalid",
+                               "type" => "invalid"),
+                         $e->validation->errors());
+      return;
+    }
+
+    $this->assert_false(true, "Shouldn't get here");
+  }
 }
-- 
cgit v1.2.3


From 53735f6b166fe823f5606e6f3cf527d98105593c Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 17 Jan 2010 23:50:42 -0800
Subject: Convert a $root to item::root() to fix a test.

---
 modules/gallery/tests/Item_Model_Test.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/gallery/tests/Item_Model_Test.php b/modules/gallery/tests/Item_Model_Test.php
index ea6c2af6..c1df70c6 100644
--- a/modules/gallery/tests/Item_Model_Test.php
+++ b/modules/gallery/tests/Item_Model_Test.php
@@ -237,7 +237,7 @@ class Item_Model_Test extends Unit_Test_Case {
     $photo2 = test::random_photo($album);
 
     try {
-      $photo2->move_to($root);
+      $photo2->move_to(item::root());
     } catch (Exception $e) {
       // pass
       $this->assert_true(strpos($e->getMessage(), "INVALID_MOVE_TARGET_EXISTS") !== false,
-- 
cgit v1.2.3


From dc286cc2bd96a70505c16487905b4aae761feeff Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Mon, 18 Jan 2010 09:00:14 -0800
Subject: Add a test to verify that bug #2504 is still around.  When this test
 starts failing, the bug is fixed and we can go fix our code that works around
 it.

---
 modules/gallery/tests/Kohana_Bug_Test.php | 38 +++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 modules/gallery/tests/Kohana_Bug_Test.php

diff --git a/modules/gallery/tests/Kohana_Bug_Test.php b/modules/gallery/tests/Kohana_Bug_Test.php
new file mode 100644
index 00000000..61f5d69e
--- /dev/null
+++ b/modules/gallery/tests/Kohana_Bug_Test.php
@@ -0,0 +1,38 @@
+<?php defined("SYSPATH") or die("No direct script access.");
+/**
+ * Gallery - a web based photo album viewer and editor
+ * Copyright (C) 2000-2009 Bharat Mediratta
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or (at
+ * your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+class Kohana_Bug_Test extends Unit_Test_Case {
+  function double_save_test_should_fail_test() {
+    // http://dev.kohanaframework.org/issues/2504
+    $group = ORM::factory("group");
+    $group->name = rand();
+    $group->save();      // this save works
+
+    try {
+      $group->name = null; // now I change to an illegal value
+      $group->save();      // this passes, but it shouldn't.  My model is broken!
+
+      // This is the normal state when the bug is not fixed.
+    } catch (ORM_Validation_Exception $e) {
+      // When this triggers, the bug is fixed.  Find any references to ticket #2504 in the code
+      // and update those accordingly
+      $this->assert_true(false, "Bug #2504 has been fixed");
+    }
+  }
+}
-- 
cgit v1.2.3


From 92ed5d45e6e81b39f4d6b8621c36b597a1b315d8 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Mon, 18 Jan 2010 12:56:49 -0800
Subject: In item_rename_fails_with_existing_name_test switch validate() to
 save() now that Kohana ticket #2504 is resolved.

---
 modules/gallery/tests/Item_Model_Test.php | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/modules/gallery/tests/Item_Model_Test.php b/modules/gallery/tests/Item_Model_Test.php
index b41740d6..12f69a34 100644
--- a/modules/gallery/tests/Item_Model_Test.php
+++ b/modules/gallery/tests/Item_Model_Test.php
@@ -143,8 +143,7 @@ class Item_Model_Test extends Unit_Test_Case {
 
     try {
       $item->name = $item2->name;
-      $item->validate();  // @todo: switch this to save() once
-                          // http://dev.kohanaphp.com/issues/2504 is fixed.
+      $item->save();
     } catch (ORM_Validation_Exception $e) {
       $this->assert_true(in_array("conflict", $e->validation->errors()));
       return;
-- 
cgit v1.2.3


From f492436317a61aa8387d1fb2232f8e5255ed5d3c Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Mon, 18 Jan 2010 13:03:59 -0800
Subject: Add random_name().

---
 modules/gallery_unit_test/helpers/test.php | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/modules/gallery_unit_test/helpers/test.php b/modules/gallery_unit_test/helpers/test.php
index 5368539f..29a7a79a 100644
--- a/modules/gallery_unit_test/helpers/test.php
+++ b/modules/gallery_unit_test/helpers/test.php
@@ -47,4 +47,12 @@ class test_Core {
   static function random_photo($parent=null) {
     return test::random_photo_unsaved($parent)->save();
   }
+
+  static function random_name($item=null) {
+    $rand = "name_" . rand();
+    if ($item && $item->is_photo()) {
+      $rand .= ".jpg";
+    }
+    return $rand;
+  }
 }
-- 
cgit v1.2.3


From 1cfee16e38b483d97dddc723b383f5c8cef0f229 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Mon, 18 Jan 2010 13:09:58 -0800
Subject: In valid_name, don't query on the id if it's null.

---
 modules/gallery/models/item.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php
index fcd9b8e6..e04b1314 100644
--- a/modules/gallery/models/item.php
+++ b/modules/gallery/models/item.php
@@ -839,8 +839,8 @@ class Item_Model extends ORM_MPTT {
     if (db::build()
         ->from("items")
         ->where("parent_id", "=", $this->parent_id)
-        ->where("id", "<>", $this->id)
         ->where("name", "=", $this->name)
+        ->merge_where($this->id ? array(array("id", "<>", $this->id)) : null)
         ->count_records()) {
       $v->add_error("name", "conflict");
     }
-- 
cgit v1.2.3


From b93000c0ce6fc2fd90df0e4a3e427d15cb262117 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Mon, 18 Jan 2010 17:20:12 -0800
Subject: Kohana ticket #2504 is resolved, so this test is no longer necessary.

---
 modules/gallery/tests/Kohana_Bug_Test.php | 38 -------------------------------
 1 file changed, 38 deletions(-)
 delete mode 100644 modules/gallery/tests/Kohana_Bug_Test.php

diff --git a/modules/gallery/tests/Kohana_Bug_Test.php b/modules/gallery/tests/Kohana_Bug_Test.php
deleted file mode 100644
index 61f5d69e..00000000
--- a/modules/gallery/tests/Kohana_Bug_Test.php
+++ /dev/null
@@ -1,38 +0,0 @@
-<?php defined("SYSPATH") or die("No direct script access.");
-/**
- * Gallery - a web based photo album viewer and editor
- * Copyright (C) 2000-2009 Bharat Mediratta
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or (at
- * your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
- */
-class Kohana_Bug_Test extends Unit_Test_Case {
-  function double_save_test_should_fail_test() {
-    // http://dev.kohanaframework.org/issues/2504
-    $group = ORM::factory("group");
-    $group->name = rand();
-    $group->save();      // this save works
-
-    try {
-      $group->name = null; // now I change to an illegal value
-      $group->save();      // this passes, but it shouldn't.  My model is broken!
-
-      // This is the normal state when the bug is not fixed.
-    } catch (ORM_Validation_Exception $e) {
-      // When this triggers, the bug is fixed.  Find any references to ticket #2504 in the code
-      // and update those accordingly
-      $this->assert_true(false, "Bug #2504 has been fixed");
-    }
-  }
-}
-- 
cgit v1.2.3


From 0e2f4a7a372567ba1916e2533ce24ee6e1cc7d36 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Mon, 18 Jan 2010 20:13:46 -0800
Subject: Fix renaming in save() by moving the actual rename action under
 parent::save().  This is consistent with other changes because all filesystem
 operations happen after the database change is committed.

Also, inline rename() since it's fairly simple now.
---
 modules/gallery/models/item.php | 73 +++++++++++++++++++++--------------------
 1 file changed, 38 insertions(+), 35 deletions(-)

diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php
index e04b1314..b3f749eb 100644
--- a/modules/gallery/models/item.php
+++ b/modules/gallery/models/item.php
@@ -139,33 +139,6 @@ class Item_Model extends ORM_MPTT {
     return $this;
   }
 
-  /**
-   * Rename the underlying file for this item to a new name and move all related files.
-   *
-   * @chainable
-   */
-  private function rename($new_name) {
-    $old_relative_path = urldecode($this->original()->relative_path());
-    $new_relative_path = dirname($old_relative_path) . "/" . $new_name;
-    if (file_exists(VARPATH . "albums/$new_relative_path")) {
-      throw new Exception("@todo INVALID_RENAME_FILE_EXISTS: $new_relative_path");
-    }
-
-    @rename(VARPATH . "albums/$old_relative_path", VARPATH . "albums/$new_relative_path");
-    @rename(VARPATH . "resizes/$old_relative_path", VARPATH . "resizes/$new_relative_path");
-    if ($this->is_movie()) {
-      // Movie thumbnails have a .jpg extension
-      $old_relative_thumb_path = preg_replace("/...$/", "jpg", $old_relative_path);
-      $new_relative_thumb_path = preg_replace("/...$/", "jpg", $new_relative_path);
-      @rename(VARPATH . "thumbs/$old_relative_thumb_path",
-              VARPATH . "thumbs/$new_relative_thumb_path");
-    } else {
-      @rename(VARPATH . "thumbs/$old_relative_path", VARPATH . "thumbs/$new_relative_path");
-    }
-
-    return $this;
-  }
-
   /**
    * Specify the path to the data file associated with this item.  To actually associate it,
    * you still have to call save().
@@ -482,20 +455,35 @@ class Item_Model extends ORM_MPTT {
         module::event("item_created", $this);
       } else {
         // Update an existing item
-        if ($this->original()->name != $this->name) {
-          $this->rename($this->name);
+
+        // The new values have to be valid before we do anything with them.  If we make any
+        // other changes before we call parent::save() below, we'll have to validate those changes
+        // again.  But, we can't take any action on these values until we know they're ok so this
+        // is unavoidable.
+        if (!$this->_valid) {
+          $this->validate();
+        }
+
+        $original = clone $this->original();
+
+        if ($original->name != $this->name) {
+          // Get the old relative path for when we rename below
+          if (!isset($this->relative_path_cache)) {
+            $this->_build_relative_caches();  // but don't call save()
+          }
+          $old_relative_path = $this->relative_path_cache;
           $this->relative_path_cache = null;
         }
 
-        if ($this->original()->slug != $this->slug) {
-          // Clear the relative url cache for this item and all children
+        if ($original->slug != $this->slug) {
           $this->relative_url_cache = null;
         }
 
+        parent::save();
+
         // Changing the name or the slug ripples downwards
         if ($this->is_album() &&
-            ($this->original()->name != $this->name ||
-             $this->original()->slug != $this->slug)) {
+            ($original->name != $this->name || $original->slug != $this->slug)) {
           db::build()
             ->update("items")
             ->set("relative_url_cache", null)
@@ -504,8 +492,23 @@ class Item_Model extends ORM_MPTT {
             ->where("right_ptr", "<", $this->right_ptr)
             ->execute();
         }
-        $original = clone $this->original();
-        parent::save();
+
+        // If we renamed this item, move all of its associated data files.
+        if ($original->name != $this->name) {
+          $relative_path = urldecode($this->relative_path());
+          @rename(VARPATH . "albums/$old_relative_path", VARPATH . "albums/$relative_path");
+          @rename(VARPATH . "resizes/$old_relative_path", VARPATH . "resizes/$relative_path");
+          if ($this->is_movie()) {
+            // Movie thumbnails have a .jpg extension
+            $old_relative_thumb_path = preg_replace("/...$/", "jpg", $old_relative_path);
+            $relative_thumb_path = preg_replace("/...$/", "jpg", $relative_path);
+            @rename(VARPATH . "thumbs/$old_relative_thumb_path",
+                    VARPATH . "thumbs/$relative_thumb_path");
+          } else {
+            @rename(VARPATH . "thumbs/$old_relative_path", VARPATH . "thumbs/$relative_path");
+          }
+        }
+
         module::event("item_updated", $original, $this);
       }
     } else if (!empty($this->changed)) {
-- 
cgit v1.2.3


From 38c13760afaae693af245e814b6bbe76c20fcae4 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Mon, 18 Jan 2010 20:14:09 -0800
Subject: Switch to using test::random_name() to avoid integer names. Fix up
 rename_photo_test.

---
 modules/gallery/tests/Item_Model_Test.php | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/modules/gallery/tests/Item_Model_Test.php b/modules/gallery/tests/Item_Model_Test.php
index 12f69a34..542cf371 100644
--- a/modules/gallery/tests/Item_Model_Test.php
+++ b/modules/gallery/tests/Item_Model_Test.php
@@ -63,16 +63,14 @@ class Item_Model_Test extends Unit_Test_Case {
 
   public function rename_photo_test() {
     $item = test::random_photo();
+    $original_name = $item->name;
 
     file_put_contents($item->thumb_path(), "thumb");
     file_put_contents($item->resize_path(), "resize");
     file_put_contents($item->file_path(), "file");
 
-    $original_name = $item->name;
-    $new_name = rand();
-
     // Now rename it
-    $item->name = $new_name;
+    $item->name = ($new_name = test::random_name($item));
     $item->save();
 
     // Expected: the name changed, the name is now baked into all paths, and all files were moved.
@@ -96,7 +94,7 @@ class Item_Model_Test extends Unit_Test_Case {
 
     $original_album_name = $album->name;
     $original_photo_name = $photo->name;
-    $new_album_name = rand();
+    $new_album_name = test::random_name();
 
     // Now rename the album
     $album->name = $new_album_name;
@@ -125,7 +123,7 @@ class Item_Model_Test extends Unit_Test_Case {
   public function item_rename_wont_accept_slash_test() {
     $item = test::random_photo();
 
-    $new_name = rand() . "/";
+    $new_name = test::random_name() . "/";
 
     try {
       $item->rename($new_name)->save();
-- 
cgit v1.2.3


From 677fb080026612725d9ed317b5ff6732e00f6514 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Mon, 18 Jan 2010 21:12:26 -0800
Subject: Updated tests to match what the expected new API for moving items.
 Now to move an item, you just change its parent_id.

---
 modules/gallery/tests/Item_Model_Test.php | 82 +++++++++++++++++++++----------
 1 file changed, 56 insertions(+), 26 deletions(-)

diff --git a/modules/gallery/tests/Item_Model_Test.php b/modules/gallery/tests/Item_Model_Test.php
index 542cf371..b2193e90 100644
--- a/modules/gallery/tests/Item_Model_Test.php
+++ b/modules/gallery/tests/Item_Model_Test.php
@@ -127,9 +127,8 @@ class Item_Model_Test extends Unit_Test_Case {
 
     try {
       $item->rename($new_name)->save();
-    } catch (Exception $e) {
-      // pass
-      return;
+    } catch (ORM_Validation_Exception $e) {
+      $this->assert_equals(array("name" => "no_slashes"), $e->validation->errors());
     }
     $this->assert_false(true, "Item_Model::rename should not accept / characters");
   }
@@ -170,14 +169,18 @@ class Item_Model_Test extends Unit_Test_Case {
     file_put_contents($photo->file_path(), "file");
 
     // Now move the album
-    $album->move_to(item::root());
+    $album->parent_id = item::root()->id;
+    $album->save();
     $photo->reload();
 
     // Expected:
-    // * the album dirs are all moved
+    // * album is not inside album2 anymore
     // * the photo's paths are all inside the albums paths
     // * the photo files are all still intact and accessible
 
+    $this->assert_same(null, strpos($album->relative_path(), $album2->relative_path()),
+                       $album2->relative_path() . " should not be in: " . $album->relative_path());
+
     $this->assert_same(0, strpos($photo->file_path(), $album->file_path()));
     $this->assert_same(0, strpos($photo->thumb_path(), dirname($album->thumb_path())));
     $this->assert_same(0, strpos($photo->resize_path(), dirname($album->resize_path())));
@@ -188,26 +191,26 @@ class Item_Model_Test extends Unit_Test_Case {
   }
 
   public function move_photo_test() {
+    $album1 = test::random_album();
+    $photo  = test::random_photo($album1);
+
     $album2 = test::random_album();
-    $album = test::random_album($album2);
-    $photo  = test::random_photo($album);
 
     file_put_contents($photo->thumb_path(), "thumb");
     file_put_contents($photo->resize_path(), "resize");
     file_put_contents($photo->file_path(), "file");
 
-    // Now move the album
-    $photo->move_to($album2);
-    $photo->reload();
+    // Now move the photo
+    $photo->parent_id = $album2->id;
+    $photo->save();
 
     // Expected:
-    // * the album dirs are all moved
-    // * the photo's paths are all inside the albums paths
+    // * the photo's paths are inside the album2 not album1
     // * the photo files are all still intact and accessible
 
-    $this->assert_same(0, strpos($photo->file_path(), $album->file_path()));
-    $this->assert_same(0, strpos($photo->thumb_path(), dirname($album->thumb_path())));
-    $this->assert_same(0, strpos($photo->resize_path(), dirname($album->resize_path())));
+    $this->assert_same(0, strpos($photo->file_path(), $album2->file_path()));
+    $this->assert_same(0, strpos($photo->thumb_path(), dirname($album2->thumb_path())));
+    $this->assert_same(0, strpos($photo->resize_path(), dirname($album2->resize_path())));
 
     $this->assert_equal("thumb", file_get_contents($photo->thumb_path()));
     $this->assert_equal("resize", file_get_contents($photo->resize_path()));
@@ -216,33 +219,60 @@ class Item_Model_Test extends Unit_Test_Case {
 
   public function move_album_fails_invalid_target_test() {
     $album = test::random_album();
-    $source = test::random_album($album);
+    $source = test::random_album_unsaved($album);
+    $source->name = $album->name;
+    $source->save();
+
+    // $source and $album have the same name, so if we move $source into the root they should
+    // conflict.
 
     try {
-      $source->move_to(item::root());
-    } catch (Exception $e) {
-      // pass
-      $this->assert_true(strpos($e->getMessage(), "INVALID_MOVE_TARGET_EXISTS") !== false,
-                         "incorrect exception.");
-      return;
+      $source->parent_id = item::root()->id;
+      $source->save();
+      $this->assert_true(false, "Shouldn't get here");
+    } catch (ORM_Validation_Exception $e) {
+      $this->assert_equal(
+        array("name" => "conflict", "slug" => "conflict"), $e->validation->errors());
     }
   }
 
   public function move_photo_fails_invalid_target_test() {
     $photo1 = test::random_photo();
     $album = test::random_album();
-    $photo2 = test::random_photo($album);
+    $photo2 = test::random_photo_unsaved($album);
+    $photo2->name = $photo1->name;
+    $photo2->save();
+
+    // $photo1 and $photo2 have the same name, so if we move $photo1 into the root they should
+    // conflict.
 
     try {
-      $photo2->move_to(item::root());
+      $photo2->parent_id = item::root()->id;
+      $photo2->save();
+      $this->assert_true(false, "Shouldn't get here");
     } catch (Exception $e) {
       // pass
-      $this->assert_true(strpos($e->getMessage(), "INVALID_MOVE_TARGET_EXISTS") !== false,
-                         "incorrect exception.");
+      $this->assert_equal(
+        array("name" => "conflict", "slug" => "conflict"), $e->validation->errors());
       return;
     }
   }
 
+  public function move_album_inside_descendent_fails_test() {
+    $album = test::random_album();
+    $album2 = test::random_album($album);
+    $album3 = test::random_album($album2);
+
+    try {
+      $album->parent_id = $album3->id;
+      $album->save();
+      $this->assert_true(false, "Shouldn't get here");
+    } catch (ORM_Validation_Exception $e) {
+      $this->assert_equal(array("parent_id" => "invalid"), $e->validation->errors());
+    }
+  }
+
+
   public function basic_validation_test() {
     $item = ORM::factory("item");
     $item->album_cover_item_id = rand();  // invalid
-- 
cgit v1.2.3


From b4e6834a28e557c3143f5f3cc91144d1565c18f0 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Mon, 18 Jan 2010 21:14:43 -0800
Subject: Added move_album_fails_wrong_target_type_test()

---
 modules/gallery/tests/Item_Model_Test.php | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/modules/gallery/tests/Item_Model_Test.php b/modules/gallery/tests/Item_Model_Test.php
index b2193e90..abe872d2 100644
--- a/modules/gallery/tests/Item_Model_Test.php
+++ b/modules/gallery/tests/Item_Model_Test.php
@@ -217,7 +217,7 @@ class Item_Model_Test extends Unit_Test_Case {
     $this->assert_equal("file", file_get_contents($photo->file_path()));
   }
 
-  public function move_album_fails_invalid_target_test() {
+  public function move_album_fails_conflicting_target_test() {
     $album = test::random_album();
     $source = test::random_album_unsaved($album);
     $source->name = $album->name;
@@ -236,7 +236,23 @@ class Item_Model_Test extends Unit_Test_Case {
     }
   }
 
-  public function move_photo_fails_invalid_target_test() {
+  public function move_album_fails_wrong_target_type_test() {
+    $album = test::random_album();
+    $photo = test::random_photo();
+
+    // $source and $album have the same name, so if we move $source into the root they should
+    // conflict.
+
+    try {
+      $album->parent_id = $photo->id;
+      $album->save();
+      $this->assert_true(false, "Shouldn't get here");
+    } catch (ORM_Validation_Exception $e) {
+      $this->assert_equal(array("parent_id" => "invalid"), $e->validation->errors());
+    }
+  }
+
+  public function move_photo_fails_conflicting_target_test() {
     $photo1 = test::random_photo();
     $album = test::random_album();
     $photo2 = test::random_photo_unsaved($album);
-- 
cgit v1.2.3


From efa4e230da33e1bf28ebf77e4d1e1b4f293117b1 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Mon, 18 Jan 2010 21:40:00 -0800
Subject: in move_to(), move the lock to before we do any calculations so that
 we have the latest data.

---
 modules/gallery/libraries/ORM_MPTT.php | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/modules/gallery/libraries/ORM_MPTT.php b/modules/gallery/libraries/ORM_MPTT.php
index 404d61ff..53e11ece 100644
--- a/modules/gallery/libraries/ORM_MPTT.php
+++ b/modules/gallery/libraries/ORM_MPTT.php
@@ -232,6 +232,10 @@ class ORM_MPTT_Core extends ORM {
       throw new Exception("@todo INVALID_TARGET can't move item inside itself");
     }
 
+    $this->lock();
+    $this->reload();  // Assume that the prior lock holder may have changed this entry
+    $target->reload();
+
     $number_to_move = (int)(($this->right_ptr - $this->left_ptr) / 2 + 1);
     $size_of_hole = $number_to_move * 2;
     $original_left_ptr = $this->left_ptr;
@@ -239,9 +243,6 @@ class ORM_MPTT_Core extends ORM {
     $target_right_ptr = $target->right_ptr;
     $level_delta = ($target->level + 1) - $this->level;
 
-    $this->lock();
-    $this->reload();  // Assume that the prior lock holder may have changed this entry
-    $target->reload();
     try {
       if ($level_delta) {
         // Update the levels for the to-be-moved items
-- 
cgit v1.2.3


From 703882f4df712089e02e14baf8970ab26b62c24f Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Mon, 18 Jan 2010 22:50:50 -0800
Subject: Update valid_parent() to disallow moving an item inside its own
 hierarchy. Move move_to() inside save()

---
 modules/gallery/models/item.php | 102 +++++++++++++---------------------------
 1 file changed, 33 insertions(+), 69 deletions(-)

diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php
index b3f749eb..e2f7dc5e 100644
--- a/modules/gallery/models/item.php
+++ b/modules/gallery/models/item.php
@@ -91,54 +91,6 @@ class Item_Model extends ORM_MPTT {
     module::event("item_deleted", $old);
   }
 
-  /**
-   * Move this item to the specified target.
-   * @chainable
-   * @param   Item_Model $target  Target item (must be an album)
-   * @return  ORM_MPTT
-   */
-  function move_to($target) {
-    if (!$target->is_album()) {
-      throw new Exception("@todo INVALID_MOVE_TYPE $target->type");
-    }
-
-    if (file_exists($target_file = "{$target->file_path()}/$this->name")) {
-      throw new Exception("@todo INVALID_MOVE_TARGET_EXISTS: $target_file");
-    }
-
-    if ($this->id == 1) {
-      throw new Exception("@todo INVALID_SOURCE root album");
-    }
-
-    $original_path = $this->file_path();
-    $original_resize_path = $this->resize_path();
-    $original_thumb_path = $this->thumb_path();
-    $original_parent = $this->parent();
-
-    parent::move_to($target, true);
-    model_cache::clear();
-    $this->relative_path_cache = null;
-
-    rename($original_path, $this->file_path());
-    if ($this->is_album()) {
-      @rename(dirname($original_resize_path), dirname($this->resize_path()));
-      @rename(dirname($original_thumb_path), dirname($this->thumb_path()));
-      db::build()
-        ->update("items")
-        ->set("relative_path_cache", null)
-        ->set("relative_url_cache", null)
-        ->where("left_ptr", ">", $this->left_ptr)
-        ->where("right_ptr", "<", $this->right_ptr)
-        ->execute();
-    } else {
-      @rename($original_resize_path, $this->resize_path());
-      @rename($original_thumb_path, $this->thumb_path());
-    }
-
-    module::event("item_moved", $this, $original_parent);
-    return $this;
-  }
-
   /**
    * Specify the path to the data file associated with this item.  To actually associate it,
    * you still have to call save().
@@ -466,12 +418,12 @@ class Item_Model extends ORM_MPTT {
 
         $original = clone $this->original();
 
-        if ($original->name != $this->name) {
-          // Get the old relative path for when we rename below
+        if ($original->name != $this->name || $original->parent_id != $this->parent_id) {
+          // Get the old relative path for when we rename or move below
           if (!isset($this->relative_path_cache)) {
             $this->_build_relative_caches();  // but don't call save()
           }
-          $old_relative_path = $this->relative_path_cache;
+          $before_save = clone $this;
           $this->relative_path_cache = null;
         }
 
@@ -481,9 +433,33 @@ class Item_Model extends ORM_MPTT {
 
         parent::save();
 
-        // Changing the name or the slug ripples downwards
+        if ($original->parent_id != $this->parent_id || $original->name != $this->name) {
+          if ($original->parent_id != $this->parent_id) {
+            // Move the ORM pointers around
+            parent::move_to($this->parent());
+          }
+
+          // Move all of the items associated data files
+          @rename($before_save->file_path(), $this->file_path());
+          if ($this->is_album()) {
+            @rename(dirname($before_save->resize_path()), dirname($this->resize_path()));
+            @rename(dirname($before_save->thumb_path()), dirname($this->thumb_path()));
+          } else {
+            @rename($before_save->resize_path(), $this->resize_path());
+            @rename($before_save->thumb_path(), $this->thumb_path());
+          }
+
+          if ($original->parent_id != $this->parent_id) {
+            // This will result in 2 events since we'll still fire the item_updated event below
+            module::event("item_moved", $this, $original->parent());
+          }
+        }
+
+        // Changing the name, slug or parent ripples downwards
         if ($this->is_album() &&
-            ($original->name != $this->name || $original->slug != $this->slug)) {
+            ($original->name != $this->name ||
+             $original->slug != $this->slug ||
+             $original->parent_id != $this->parent_id)) {
           db::build()
             ->update("items")
             ->set("relative_url_cache", null)
@@ -493,22 +469,6 @@ class Item_Model extends ORM_MPTT {
             ->execute();
         }
 
-        // If we renamed this item, move all of its associated data files.
-        if ($original->name != $this->name) {
-          $relative_path = urldecode($this->relative_path());
-          @rename(VARPATH . "albums/$old_relative_path", VARPATH . "albums/$relative_path");
-          @rename(VARPATH . "resizes/$old_relative_path", VARPATH . "resizes/$relative_path");
-          if ($this->is_movie()) {
-            // Movie thumbnails have a .jpg extension
-            $old_relative_thumb_path = preg_replace("/...$/", "jpg", $old_relative_path);
-            $relative_thumb_path = preg_replace("/...$/", "jpg", $relative_path);
-            @rename(VARPATH . "thumbs/$old_relative_thumb_path",
-                    VARPATH . "thumbs/$relative_thumb_path");
-          } else {
-            @rename(VARPATH . "thumbs/$old_relative_path", VARPATH . "thumbs/$relative_path");
-          }
-        }
-
         module::event("item_updated", $original, $this);
       }
     } else if (!empty($this->changed)) {
@@ -873,6 +833,10 @@ class Item_Model extends ORM_MPTT {
           ->from("items")
           ->where("id", "=", $this->parent_id)
           ->where("type", "=", "album")
+          ->and_open()
+          ->where("left_ptr", "<", $this->left_ptr)
+          ->or_where("right_ptr", ">", $this->right_ptr)
+          ->close()
           ->count_records() != 1) {
         $v->add_error("parent_id", "invalid");
       }
-- 
cgit v1.2.3


From cfc0f3d0c0935839e9eedd11322e35e9baaca0df Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Mon, 18 Jan 2010 22:51:40 -0800
Subject: Minor test cleanup.

---
 modules/gallery/tests/Item_Model_Test.php | 48 +++++++++++++++----------------
 1 file changed, 24 insertions(+), 24 deletions(-)

diff --git a/modules/gallery/tests/Item_Model_Test.php b/modules/gallery/tests/Item_Model_Test.php
index abe872d2..5a59e6d0 100644
--- a/modules/gallery/tests/Item_Model_Test.php
+++ b/modules/gallery/tests/Item_Model_Test.php
@@ -122,15 +122,14 @@ class Item_Model_Test extends Unit_Test_Case {
 
   public function item_rename_wont_accept_slash_test() {
     $item = test::random_photo();
-
-    $new_name = test::random_name() . "/";
-
     try {
-      $item->rename($new_name)->save();
+      $item->name = test::random_name() . "/";
+      $item->save();
     } catch (ORM_Validation_Exception $e) {
-      $this->assert_equals(array("name" => "no_slashes"), $e->validation->errors());
+      $this->assert_equal(array("name" => "no_slashes"), $e->validation->errors());
+      return;
     }
-    $this->assert_false(true, "Item_Model::rename should not accept / characters");
+    $this->assert_true(false, "Shouldn't get here");
   }
 
   public function item_rename_fails_with_existing_name_test() {
@@ -161,16 +160,16 @@ class Item_Model_Test extends Unit_Test_Case {
 
   public function move_album_test() {
     $album2 = test::random_album();
-    $album = test::random_album($album2);
-    $photo = test::random_photo($album);
+    $album1 = test::random_album($album2);
+    $photo = test::random_photo($album1);
 
     file_put_contents($photo->thumb_path(), "thumb");
     file_put_contents($photo->resize_path(), "resize");
     file_put_contents($photo->file_path(), "file");
 
     // Now move the album
-    $album->parent_id = item::root()->id;
-    $album->save();
+    $album1->parent_id = item::root()->id;
+    $album1->save();
     $photo->reload();
 
     // Expected:
@@ -178,12 +177,10 @@ class Item_Model_Test extends Unit_Test_Case {
     // * the photo's paths are all inside the albums paths
     // * the photo files are all still intact and accessible
 
-    $this->assert_same(null, strpos($album->relative_path(), $album2->relative_path()),
-                       $album2->relative_path() . " should not be in: " . $album->relative_path());
-
-    $this->assert_same(0, strpos($photo->file_path(), $album->file_path()));
-    $this->assert_same(0, strpos($photo->thumb_path(), dirname($album->thumb_path())));
-    $this->assert_same(0, strpos($photo->resize_path(), dirname($album->resize_path())));
+    $this->assert_false(test::starts_with($album2->file_path(), $album1->file_path()));
+    $this->assert_true(test::starts_with($photo->file_path(), $album1->file_path()));
+    $this->assert_true(test::starts_with($photo->thumb_path(), dirname($album1->thumb_path())));
+    $this->assert_true(test::starts_with($photo->resize_path(), dirname($album1->resize_path())));
 
     $this->assert_equal("thumb", file_get_contents($photo->thumb_path()));
     $this->assert_equal("resize", file_get_contents($photo->resize_path()));
@@ -229,11 +226,12 @@ class Item_Model_Test extends Unit_Test_Case {
     try {
       $source->parent_id = item::root()->id;
       $source->save();
-      $this->assert_true(false, "Shouldn't get here");
     } catch (ORM_Validation_Exception $e) {
       $this->assert_equal(
         array("name" => "conflict", "slug" => "conflict"), $e->validation->errors());
+      return;
     }
+    $this->assert_true(false, "Shouldn't get here");
   }
 
   public function move_album_fails_wrong_target_type_test() {
@@ -246,10 +244,11 @@ class Item_Model_Test extends Unit_Test_Case {
     try {
       $album->parent_id = $photo->id;
       $album->save();
-      $this->assert_true(false, "Shouldn't get here");
     } catch (ORM_Validation_Exception $e) {
       $this->assert_equal(array("parent_id" => "invalid"), $e->validation->errors());
+      return;
     }
+    $this->assert_true(false, "Shouldn't get here");
   }
 
   public function move_photo_fails_conflicting_target_test() {
@@ -265,27 +264,28 @@ class Item_Model_Test extends Unit_Test_Case {
     try {
       $photo2->parent_id = item::root()->id;
       $photo2->save();
-      $this->assert_true(false, "Shouldn't get here");
     } catch (Exception $e) {
       // pass
       $this->assert_equal(
         array("name" => "conflict", "slug" => "conflict"), $e->validation->errors());
       return;
     }
+    $this->assert_true(false, "Shouldn't get here");
   }
 
   public function move_album_inside_descendent_fails_test() {
-    $album = test::random_album();
-    $album2 = test::random_album($album);
+    $album1 = test::random_album();
+    $album2 = test::random_album($album1);
     $album3 = test::random_album($album2);
 
     try {
-      $album->parent_id = $album3->id;
-      $album->save();
-      $this->assert_true(false, "Shouldn't get here");
+      $album1->parent_id = $album3->id;
+      $album1->save();
     } catch (ORM_Validation_Exception $e) {
       $this->assert_equal(array("parent_id" => "invalid"), $e->validation->errors());
+      return;
     }
+    $this->assert_true(false, "Shouldn't get here");
   }
 
 
-- 
cgit v1.2.3


From f94fa25e0868e9988ebf7168701dd059b1135fdb Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Mon, 18 Jan 2010 22:51:52 -0800
Subject: Add starts_with().

---
 modules/gallery_unit_test/helpers/test.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/gallery_unit_test/helpers/test.php b/modules/gallery_unit_test/helpers/test.php
index 29a7a79a..77948465 100644
--- a/modules/gallery_unit_test/helpers/test.php
+++ b/modules/gallery_unit_test/helpers/test.php
@@ -55,4 +55,8 @@ class test_Core {
     }
     return $rand;
   }
+
+  static function starts_with($outer, $inner) {
+    return strpos($outer, $inner) === 0;
+  }
 }
-- 
cgit v1.2.3


From dc570aaca96e34d1deb76ef03f90cb6fb0acd71c Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Mon, 18 Jan 2010 22:52:23 -0800
Subject: Switch from ORM_MPTT::$db_builder to db::build().

---
 modules/gallery/libraries/ORM_MPTT.php | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/modules/gallery/libraries/ORM_MPTT.php b/modules/gallery/libraries/ORM_MPTT.php
index 53e11ece..40168606 100644
--- a/modules/gallery/libraries/ORM_MPTT.php
+++ b/modules/gallery/libraries/ORM_MPTT.php
@@ -52,12 +52,12 @@ class ORM_MPTT_Core extends ORM {
 
       try {
         // Make a hole in the parent for this new item
-        $this->db_builder
+        db::build()
           ->update($this->table_name)
           ->set("left_ptr", new Database_Expression("`left_ptr` + 2"))
           ->where("left_ptr", ">=", $parent->right_ptr)
           ->execute();
-        $this->db_builder
+        db::build()
           ->update($this->table_name)
           ->set("right_ptr", new Database_Expression("`right_ptr` + 2"))
           ->where("right_ptr", ">=", $parent->right_ptr)
@@ -102,12 +102,12 @@ class ORM_MPTT_Core extends ORM {
     $this->lock();
     $this->reload();  // Assume that the prior lock holder may have changed this entry
     try {
-      $this->db_builder
+      db::build()
         ->update($this->table_name)
         ->set("left_ptr", new Database_Expression("`left_ptr` - 2"))
         ->where("left_ptr", ">", $this->right_ptr)
         ->execute();
-      $this->db_builder
+      db::build()
         ->update($this->table_name)
         ->set("right_ptr", new Database_Expression("`right_ptr` - 2"))
         ->where("right_ptr", ">", $this->right_ptr)
@@ -246,7 +246,7 @@ class ORM_MPTT_Core extends ORM {
     try {
       if ($level_delta) {
         // Update the levels for the to-be-moved items
-        $this->db_builder
+        db::build()
           ->update($this->table_name)
           ->set("level", new Database_Expression("`level` + $level_delta"))
           ->where("left_ptr", ">=", $original_left_ptr)
@@ -255,19 +255,19 @@ class ORM_MPTT_Core extends ORM {
       }
 
       // Make a hole in the target for the move
-      $target->db_builder
+      db::build()
         ->update($this->table_name)
         ->set("left_ptr", new Database_Expression("`left_ptr` + $size_of_hole"))
         ->where("left_ptr", ">=", $target_right_ptr)
         ->execute();
-      $target->db_builder
+      db::build()
         ->update($this->table_name)
         ->set("right_ptr", new Database_Expression("`right_ptr` + $size_of_hole"))
         ->where("right_ptr", ">=", $target_right_ptr)
         ->execute();
 
       // Change the parent.
-      $this->db_builder
+      db::build()
         ->update($this->table_name)
         ->set("parent_id", $target->id)
         ->where("id", "=", $this->id)
@@ -282,7 +282,7 @@ class ORM_MPTT_Core extends ORM {
       }
 
       $new_offset = $target->right_ptr - $left_ptr;
-      $this->db_builder
+      db::build()
         ->update($this->table_name)
         ->set("left_ptr", new Database_Expression("`left_ptr` + $new_offset"))
         ->set("right_ptr", new Database_Expression("`right_ptr` + $new_offset"))
@@ -291,12 +291,12 @@ class ORM_MPTT_Core extends ORM {
         ->execute();
 
       // Close the hole in the source's parent after the move
-      $this->db_builder
+      db::build()
         ->update($this->table_name)
         ->set("left_ptr", new Database_Expression("`left_ptr` - $size_of_hole"))
         ->where("left_ptr", ">", $right_ptr)
         ->execute();
-      $this->db_builder
+      db::build()
         ->update($this->table_name)
         ->set("right_ptr", new Database_Expression("`right_ptr` - $size_of_hole"))
         ->where("right_ptr", ">", $right_ptr)
-- 
cgit v1.2.3


From 71a8375554ed6a4216abfe31a496be5ba012d4db Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Mon, 18 Jan 2010 22:52:58 -0800
Subject: Whitespace.

---
 modules/gallery/libraries/ORM_MPTT.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/gallery/libraries/ORM_MPTT.php b/modules/gallery/libraries/ORM_MPTT.php
index 40168606..ba61131a 100644
--- a/modules/gallery/libraries/ORM_MPTT.php
+++ b/modules/gallery/libraries/ORM_MPTT.php
@@ -273,7 +273,8 @@ class ORM_MPTT_Core extends ORM {
         ->where("id", "=", $this->id)
         ->execute();
 
-      // If the source is to the right of the target then we just adjusted its left_ptr and right_ptr above.
+      // If the source is to the right of the target then we just adjusted its left_ptr and
+      // right_ptr above.
       $left_ptr = $original_left_ptr;
       $right_ptr = $original_right_ptr;
       if ($original_left_ptr > $target_right_ptr) {
-- 
cgit v1.2.3


From 9eedf5c2072ee508d539e3e25ce4f02eff746476 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Mon, 18 Jan 2010 22:55:16 -0800
Subject: switch to test::starts_with().

---
 modules/gallery/tests/Item_Model_Test.php | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/modules/gallery/tests/Item_Model_Test.php b/modules/gallery/tests/Item_Model_Test.php
index 5a59e6d0..5294836d 100644
--- a/modules/gallery/tests/Item_Model_Test.php
+++ b/modules/gallery/tests/Item_Model_Test.php
@@ -111,9 +111,9 @@ class Item_Model_Test extends Unit_Test_Case {
     $this->assert_equal($new_album_name, basename(dirname($album->thumb_path())));
     $this->assert_equal($new_album_name, basename(dirname($album->resize_path())));
 
-    $this->assert_same(0, strpos($photo->file_path(), $album->file_path()));
-    $this->assert_same(0, strpos($photo->thumb_path(), dirname($album->thumb_path())));
-    $this->assert_same(0, strpos($photo->resize_path(), dirname($album->resize_path())));
+    $this->assert_true(test::starts_with($photo->file_path(), $album->file_path()));
+    $this->assert_true(test::starts_with($photo->thumb_path(), dirname($album->thumb_path())));
+    $this->assert_true(test::starts_with($photo->resize_path(), dirname($album->resize_path())));
 
     $this->assert_equal("thumb", file_get_contents($photo->thumb_path()));
     $this->assert_equal("resize", file_get_contents($photo->resize_path()));
@@ -205,9 +205,9 @@ class Item_Model_Test extends Unit_Test_Case {
     // * the photo's paths are inside the album2 not album1
     // * the photo files are all still intact and accessible
 
-    $this->assert_same(0, strpos($photo->file_path(), $album2->file_path()));
-    $this->assert_same(0, strpos($photo->thumb_path(), dirname($album2->thumb_path())));
-    $this->assert_same(0, strpos($photo->resize_path(), dirname($album2->resize_path())));
+    $this->assert_true(test::starts_with($photo->file_path(), $album2->file_path()));
+    $this->assert_true(test::starts_with($photo->thumb_path(), dirname($album2->thumb_path())));
+    $this->assert_true(test::starts_with($photo->resize_path(), dirname($album2->resize_path())));
 
     $this->assert_equal("thumb", file_get_contents($photo->thumb_path()));
     $this->assert_equal("resize", file_get_contents($photo->resize_path()));
-- 
cgit v1.2.3


From cc61e7a3e0a0004196617ffacc6519e9b6d79139 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Mon, 18 Jan 2010 23:11:02 -0800
Subject: Update for model based validation.  Use test helper.  Reduce the code
 size greatly!

---
 modules/gallery/tests/ORM_MPTT_Test.php | 148 ++++++++++----------------------
 1 file changed, 47 insertions(+), 101 deletions(-)

diff --git a/modules/gallery/tests/ORM_MPTT_Test.php b/modules/gallery/tests/ORM_MPTT_Test.php
index 69b6bea9..30adf2a0 100644
--- a/modules/gallery/tests/ORM_MPTT_Test.php
+++ b/modules/gallery/tests/ORM_MPTT_Test.php
@@ -19,19 +19,8 @@
  */
 class ORM_MPTT_Test extends Unit_Test_Case {
 
-  private function create_item_and_add_to_parent($parent) {
-    $album = album::create($parent,  rand(), "test album");
-    return $album;
-  }
-
   public function add_to_parent_test() {
-    $root = ORM::factory("item", 1);
-    $album = ORM::factory("item");
-    $album->type = "album";
-    $album->rand_key = ((float)mt_rand()) / (float)mt_getrandmax();
-    $album->sort_column = "weight";
-    $album->sort_order = "ASC";
-    $album->add_to_parent($root);
+    $album = test::random_album();
 
     $this->assert_equal($album->parent()->right_ptr - 2, $album->left_ptr);
     $this->assert_equal($album->parent()->right_ptr - 1, $album->right_ptr);
@@ -40,12 +29,11 @@ class ORM_MPTT_Test extends Unit_Test_Case {
   }
 
   public function add_hierarchy_test() {
-    $root = ORM::factory("item", 1);
-    $album1 = self::create_item_and_add_to_parent($root);
-    $album1_1 = self::create_item_and_add_to_parent($album1);
-    $album1_2 = self::create_item_and_add_to_parent($album1);
-    $album1_1_1 = self::create_item_and_add_to_parent($album1_1);
-    $album1_1_2 = self::create_item_and_add_to_parent($album1_1);
+    $album1 = test::random_album();
+    $album1_1 = test::random_album($album1);
+    $album1_2 = test::random_album($album1);
+    $album1_1_1 = test::random_album($album1_1);
+    $album1_1_2 = test::random_album($album1_1);
 
     $album1->reload();
     $this->assert_equal(9, $album1->right_ptr - $album1->left_ptr);
@@ -55,12 +43,11 @@ class ORM_MPTT_Test extends Unit_Test_Case {
   }
 
   public function delete_hierarchy_test() {
-    $root = ORM::factory("item", 1);
-    $album1 = self::create_item_and_add_to_parent($root);
-    $album1_1 = self::create_item_and_add_to_parent($album1);
-    $album1_2 = self::create_item_and_add_to_parent($album1);
-    $album1_1_1 = self::create_item_and_add_to_parent($album1_1);
-    $album1_1_2 = self::create_item_and_add_to_parent($album1_1);
+    $album1 = test::random_album();
+    $album1_1 = test::random_album($album1);
+    $album1_2 = test::random_album($album1);
+    $album1_1_1 = test::random_album($album1_1);
+    $album1_1_2 = test::random_album($album1_1);
 
     $album1_1->delete();
     $album1->reload();
@@ -70,12 +57,11 @@ class ORM_MPTT_Test extends Unit_Test_Case {
   }
 
   public function move_to_test() {
-    $root = ORM::factory("item", 1);
-    $album1 = album::create($root, "move_to_test_1", "move_to_test_1");
-    $album1_1 = album::create($album1, "move_to_test_1_1", "move_to_test_1_1");
-    $album1_2 = album::create($album1, "move_to_test_1_2", "move_to_test_1_2");
-    $album1_1_1 = album::create($album1_1, "move_to_test_1_1_1", "move_to_test_1_1_1");
-    $album1_1_2 = album::create($album1_1, "move_to_test_1_1_2", "move_to_test_1_1_2");
+    $album1 = test::random_album();
+    $album1_1 = test::random_album($album1);
+    $album1_2 = test::random_album($album1);
+    $album1_1_1 = test::random_album($album1_1);
+    $album1_1_2 = test::random_album($album1_1);
 
     $album1_2->reload();
     $album1_1_1->reload();
@@ -89,39 +75,37 @@ class ORM_MPTT_Test extends Unit_Test_Case {
     $this->assert_equal(3, $album1_2->right_ptr - $album1_2->left_ptr);
 
     $this->assert_equal(
-      array($album1_1_2->id => "move_to_test_1_1_2"),
+      array($album1_1_2->id => $album1_1_2->name),
       $album1_1->children()->select_list());
 
     $this->assert_equal(
-      array($album1_1_1->id => "move_to_test_1_1_1"),
+      array($album1_1_1->id => $album1_1_1->name),
       $album1_2->children()->select_list());
   }
 
   public function cant_move_parent_into_own_subtree_test() {
-    $album1 = album::create(item::root(), "move_to_test", "move_to_test");
-    $album2 = album::create($album1, "move_to_test", "move_to_test");
-    $album3 = album::create($album2, "move_to_test", "move_to_test");
+    $album1 = test::random_album(item::root());
+    $album2 = test::random_album($album1);
+    $album3 = test::random_album($album2);
 
     try {
       $album1->move_to($album3);
-      $self->assert_true(false, "We should be unable to move an item inside its own hierarchy");
+      $this->assert_true(false, "We should be unable to move an item inside its own hierarchy");
     } catch (Exception $e) {
       // pass
     }
   }
 
   public function parent_test() {
-    $root = ORM::factory("item", 1);
-    $album = self::create_item_and_add_to_parent($root);
+    $album = test::random_album();
 
     $parent = ORM::factory("item", 1);
     $this->assert_equal($parent->id, $album->parent()->id);
   }
 
   public function parents_test() {
-    $root = ORM::factory("item", 1);
-    $outer = self::create_item_and_add_to_parent($root);
-    $inner = self::create_item_and_add_to_parent($outer);
+    $outer = test::random_album();
+    $inner = test::random_album($outer);
 
     $parent_ids = array();
     foreach ($inner->parents() as $parent) {
@@ -131,10 +115,9 @@ class ORM_MPTT_Test extends Unit_Test_Case {
   }
 
   public function children_test() {
-    $root = ORM::factory("item", 1);
-    $outer = self::create_item_and_add_to_parent($root);
-    $inner1 = self::create_item_and_add_to_parent($outer);
-    $inner2 = self::create_item_and_add_to_parent($outer);
+    $outer = test::random_album();
+    $inner1 = test::random_album($outer);
+    $inner2 = test::random_album($outer);
 
     $child_ids = array();
     foreach ($outer->children() as $child) {
@@ -144,48 +127,27 @@ class ORM_MPTT_Test extends Unit_Test_Case {
   }
 
   public function children_limit_test() {
-    $root = ORM::factory("item", 1);
-    $outer = self::create_item_and_add_to_parent($root);
-    $inner1 = self::create_item_and_add_to_parent($outer);
-    $inner2 = self::create_item_and_add_to_parent($outer);
+    $outer = test::random_album();
+    $inner1 = test::random_album($outer);
+    $inner2 = test::random_album($outer);
 
     $this->assert_equal(array($inner2->id => $inner2->name),
                         $outer->children(1, 1)->select_list('id'));
   }
 
   public function children_count_test() {
-    $root = ORM::factory("item", 1);
-    $outer = self::create_item_and_add_to_parent($root);
-    $inner1 = self::create_item_and_add_to_parent($outer);
-    $inner2 = self::create_item_and_add_to_parent($outer);
+    $outer = test::random_album();
+    $inner1 = test::random_album($outer);
+    $inner2 = test::random_album($outer);
 
     $this->assert_equal(2, $outer->children_count());
   }
 
   public function descendant_test() {
-    $root = ORM::factory("item", 1);
-
-    $parent = ORM::factory("item");
-    $parent->type = "album";
-    $parent->rand_key = ((float)mt_rand()) / (float)mt_getrandmax();
-    $parent->sort_column = "weight";
-    $parent->sort_order = "ASC";
-    $parent->add_to_parent($root);
-
-    $photo = ORM::factory("item");
-    $photo->type = "photo";
-    $photo->add_to_parent($parent);
-
-    $album1 = ORM::factory("item");
-    $album1->type = "album";
-    $album1->rand_key = ((float)mt_rand()) / (float)mt_getrandmax();
-    $album1->sort_column = "weight";
-    $album1->sort_order = "ASC";
-    $album1->add_to_parent($parent);
-
-    $photo1 = ORM::factory("item");
-    $photo1->type = "photo";
-    $photo1->add_to_parent($album1);
+    $parent = test::random_album();
+    $photo = test::random_photo($parent);
+    $album1 = test::random_album($parent);
+    $photo1 = test::random_photo($album1);
 
     $parent->reload();
 
@@ -195,36 +157,20 @@ class ORM_MPTT_Test extends Unit_Test_Case {
   }
 
   public function descendant_limit_test() {
-    $root = ORM::factory("item", 1);
-
-    $parent = self::create_item_and_add_to_parent($root);
-    $album1 = self::create_item_and_add_to_parent($parent);
-    $album2 = self::create_item_and_add_to_parent($parent);
-    $album3 = self::create_item_and_add_to_parent($parent);
-
+    $parent = test::random_album();
+    $album1 = test::random_album($parent);
+    $album2 = test::random_album($parent);
+    $album3 = test::random_album($parent);
     $parent->reload();
+
     $this->assert_equal(2, $parent->descendants(2)->count());
   }
 
   public function descendant_count_test() {
-    $root = ORM::factory("item", 1);
-
-    $parent = ORM::factory("item");
-    $parent->type = "album";
-    $parent->add_to_parent($root);
-
-    $photo = ORM::factory("item");
-    $photo->type = "photo";
-    $photo->add_to_parent($parent);
-
-    $album1 = ORM::factory("item");
-    $album1->type = "album";
-    $album1->add_to_parent($parent);
-
-    $photo1 = ORM::factory("item");
-    $photo1->type = "photo";
-    $photo1->add_to_parent($album1);
-
+    $parent = test::random_album();
+    $photo = test::random_photo($parent);
+    $album1 = test::random_album($parent);
+    $photo1 = test::random_photo($album1);
     $parent->reload();
 
     $this->assert_equal(3, $parent->descendants_count());
-- 
cgit v1.2.3


From c6bd3c5b2629012a7c100658705a254bda19877b Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Mon, 18 Jan 2010 23:23:31 -0800
Subject: Updated for model based validation.

change_album_no_csrf_fails_test() had been broken since we got rid of
REST_Controller, but was poorly written so we didn't realize it.  Boo.
---
 modules/gallery/tests/Albums_Controller_Test.php | 32 ++++++++++--------------
 1 file changed, 13 insertions(+), 19 deletions(-)

diff --git a/modules/gallery/tests/Albums_Controller_Test.php b/modules/gallery/tests/Albums_Controller_Test.php
index 4d8935cd..8ba2c7bc 100644
--- a/modules/gallery/tests/Albums_Controller_Test.php
+++ b/modules/gallery/tests/Albums_Controller_Test.php
@@ -24,16 +24,11 @@ class Albums_Controller_Test extends Unit_Test_Case {
 
   public function teardown() {
     list($_POST, $_SERVER) = $this->_save;
-    if (isset($this->_album)) {
-      $this->_album->delete();
-    }
   }
 
   public function change_album_test() {
     $controller = new Albums_Controller();
-    $root = ORM::factory("item", 1);
-    $this->_album = album::create($root, "test", "test", "test");
-    $orig_name = $this->_album->name;
+    $album = test::random_album();
 
     // Randomize to avoid conflicts.
     $new_dirname = "new_name_" . rand();
@@ -45,36 +40,35 @@ class Albums_Controller_Test extends Unit_Test_Case {
     $_POST["direction"] = "ASC";
     $_POST["csrf"] = access::csrf_token();
     $_POST["slug"] = "new-name";
-    access::allow(identity::everybody(), "edit", $root);
+    access::allow(identity::everybody(), "edit", item::root());
 
     ob_start();
-    $controller->update($this->_album->id);
-    $this->_album->reload();
+    $controller->update($album->id);
+    $album->reload();
     $results = ob_get_contents();
     ob_end_clean();
 
-    $this->assert_equal(
-      json_encode(array("result" => "success")),
-      $results);
-    $this->assert_equal($new_dirname, $this->_album->name);
-    $this->assert_equal("new title", $this->_album->title);
-    $this->assert_equal("new description", $this->_album->description);
+    $this->assert_equal(json_encode(array("result" => "success")), $results);
+    $this->assert_equal($new_dirname, $album->name);
+    $this->assert_equal("new title", $album->title);
+    $this->assert_equal("new description", $album->description);
   }
 
   public function change_album_no_csrf_fails_test() {
     $controller = new Albums_Controller();
-    $root = ORM::factory("item", 1);
-    $this->_album = album::create($root, "test", "test", "test");
+    $album = test::random_album();
+
     $_POST["name"] = "new name";
     $_POST["title"] = "new title";
     $_POST["description"] = "new description";
-    access::allow(identity::everybody(), "edit", $root);
+    access::allow(identity::everybody(), "edit", item::root());
 
     try {
-      $controller->_update($this->_album);
+      $controller->update($album->id);
       $this->assert_true(false, "This should fail");
     } catch (Exception $e) {
       // pass
+      $this->assert_same("@todo FORBIDDEN", $e->getMessage());
     }
   }
 }
-- 
cgit v1.2.3


From f0215052086f2031ddaadbaf715ca9a5d202f691 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Mon, 18 Jan 2010 23:24:06 -0800
Subject: No longer necessary; all relevant album helper code is now in the
 model.

---
 modules/gallery/tests/Album_Helper_Test.php | 88 -----------------------------
 1 file changed, 88 deletions(-)
 delete mode 100644 modules/gallery/tests/Album_Helper_Test.php

diff --git a/modules/gallery/tests/Album_Helper_Test.php b/modules/gallery/tests/Album_Helper_Test.php
deleted file mode 100644
index ef0905da..00000000
--- a/modules/gallery/tests/Album_Helper_Test.php
+++ /dev/null
@@ -1,88 +0,0 @@
-<?php defined("SYSPATH") or die("No direct script access.");
-/**
- * Gallery - a web based photo album viewer and editor
- * Copyright (C) 2000-2009 Bharat Mediratta
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or (at
- * your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
- */
-class Album_Helper_Test extends Unit_Test_Case {
-  public function create_album_test() {
-    $rand = rand();
-    $root = ORM::factory("item", 1);
-    $album = album::create($root, $rand, $rand, $rand);
-
-    $this->assert_equal(VARPATH . "albums/$rand", $album->file_path());
-    $this->assert_equal(VARPATH . "thumbs/$rand/.album.jpg", $album->thumb_path());
-    $this->assert_true(is_dir(VARPATH . "thumbs/$rand"), "missing thumb dir");
-
-    // It's unclear that a resize makes sense for an album.  But we have one.
-    $this->assert_equal(VARPATH . "resizes/$rand/.album.jpg", $album->resize_path());
-    $this->assert_true(is_dir(VARPATH . "resizes/$rand"), "missing resizes dir");
-
-    $this->assert_equal(1, $album->parent_id);  // MPTT tests will cover other hierarchy checks
-    $this->assert_equal($rand, $album->name);
-    $this->assert_equal($rand, $album->title);
-    $this->assert_equal($rand, $album->description);
-  }
-
-  public function create_conflicting_album_test() {
-    $rand = "name_" . rand();
-    $root = ORM::factory("item", 1);
-    $album1 = album::create($root, $rand, $rand, $rand);
-    $album2 = album::create($root, $rand, $rand, $rand);
-    $this->assert_true($album1->name != $album2->name);
-  }
-
-  public function thumb_url_test() {
-    $rand = rand();
-    $root = ORM::factory("item", 1);
-    $album = album::create($root, $rand, $rand, $rand);
-    $this->assert_equal(
-      "http://./var/thumbs/$rand/.album.jpg?m={$album->updated}", $album->thumb_url());
-  }
-
-  public function resize_url_test() {
-    $rand = rand();
-    $root = ORM::factory("item", 1);
-    $album = album::create($root, $rand, $rand, $rand);
-    $this->assert_equal("http://./var/resizes/$rand/.album.jpg?m={$album->updated}", $album->resize_url());
-  }
-
-  public function create_album_shouldnt_allow_names_with_slash_test() {
-    $rand = rand();
-    $root = ORM::factory("item", 1);
-    try {
-      $album = album::create($root, $rand . "/", $rand, $rand);
-    } catch (Exception $e) {
-      // pass
-      return;
-    }
-
-    $this->assert_true(false, "Shouldn't create an album with / in the name");
-  }
-
-  public function create_album_silently_trims_trailing_periods_test() {
-    $rand = rand();
-    $root = ORM::factory("item", 1);
-    try {
-      $album = album::create($root, $rand . "..", $rand, $rand);
-    } catch (Exception $e) {
-      $this->assert_equal("@todo NAME_CANNOT_END_IN_PERIOD", $e->getMessage());
-      return;
-    }
-
-    $this->assert_true(false, "Shouldn't create an album with trailing . in the name");
-  }
-}
-- 
cgit v1.2.3


From e06ceebaa6b9631ce27939beae477e684f949352 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Mon, 18 Jan 2010 23:25:09 -0800
Subject: No longer necessary; all photo and movie helper code is now in the
 model.

---
 modules/gallery/tests/Movie_Helper_Test.php |  56 ------------
 modules/gallery/tests/Photo_Helper_Test.php | 130 ----------------------------
 2 files changed, 186 deletions(-)
 delete mode 100644 modules/gallery/tests/Movie_Helper_Test.php
 delete mode 100644 modules/gallery/tests/Photo_Helper_Test.php

diff --git a/modules/gallery/tests/Movie_Helper_Test.php b/modules/gallery/tests/Movie_Helper_Test.php
deleted file mode 100644
index 23544934..00000000
--- a/modules/gallery/tests/Movie_Helper_Test.php
+++ /dev/null
@@ -1,56 +0,0 @@
-<?php defined("SYSPATH") or die("No direct script access.");
-/**
- * Gallery - a web based photo album viewer and editor
- * Copyright (C) 2000-2009 Bharat Mediratta
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or (at
- * your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
- */
-class Movie_Helper_Test extends Unit_Test_Case {
-  public function create_movie_shouldnt_allow_names_with_slash_test() {
-    $rand = rand();
-    $root = ORM::factory("item", 1);
-    try {
-      $movie = movie::create($root, MODPATH . "gallery/tests/test.flv", "$rand/.flv", $rand, $rand);
-    } catch (Exception $e) {
-      // pass
-      return;
-    }
-
-    $this->assert_true(false, "Shouldn't create a movie with / in the name");
-  }
-
-  public function create_movie_shouldnt_allow_names_with_trailing_periods_test() {
-    $rand = rand();
-    $root = ORM::factory("item", 1);
-    try {
-      $movie = movie::create($root, MODPATH . "gallery/tests/test.flv", "$rand.flv.", $rand, $rand);
-    } catch (Exception $e) {
-      $this->assert_equal("@todo NAME_CANNOT_END_IN_PERIOD", $e->getMessage());
-      return;
-    }
-
-    $this->assert_true(false, "Shouldn't create a movie with trailing . in the name");
-  }
-
-  public function create_movie_creates_reasonable_slug_test() {
-    $rand = rand();
-    $root = ORM::factory("item", 1);
-    $album = album::create($root, $rand, $rand, $rand);
-    $movie = movie::create(
-      $album, MODPATH . "gallery/tests/test.flv", "This (is) my file%name.flv", $rand, $rand);
-
-    $this->assert_equal("This-is-my-file-name", $movie->slug);
-  }
-}
diff --git a/modules/gallery/tests/Photo_Helper_Test.php b/modules/gallery/tests/Photo_Helper_Test.php
deleted file mode 100644
index 97923f90..00000000
--- a/modules/gallery/tests/Photo_Helper_Test.php
+++ /dev/null
@@ -1,130 +0,0 @@
-<?php defined("SYSPATH") or die("No direct script access.");
-/**
- * Gallery - a web based photo album viewer and editor
- * Copyright (C) 2000-2009 Bharat Mediratta
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or (at
- * your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
- */
-class Photo_Helper_Test extends Unit_Test_Case {
-  public function create_photo_test() {
-    $rand = rand();
-
-    $filename = MODPATH . "gallery/tests/test.jpg";
-    $image_info = getimagesize($filename);
-
-    $root = ORM::factory("item", 1);
-    $photo = photo::create($root, $filename, "$rand.jpg", $rand, $rand);
-
-    $this->assert_equal(VARPATH . "albums/$rand.jpg", $photo->file_path());
-    $this->assert_equal(VARPATH . "thumbs/{$rand}.jpg", $photo->thumb_path());
-    $this->assert_equal(VARPATH . "resizes/{$rand}.jpg", $photo->resize_path());
-
-    $this->assert_true(is_file($photo->file_path()), "missing: {$photo->file_path()}");
-    $this->assert_true(is_file($photo->resize_path()), "missing: {$photo->resize_path()}");
-    $this->assert_true(is_file($photo->thumb_path()), "missing: {$photo->thumb_path()}");
-
-    $this->assert_equal($root->id, $photo->parent_id); // MPTT tests cover other hierarchy checks
-    $this->assert_equal("$rand.jpg", $photo->name);
-    $this->assert_equal($rand, $photo->title);
-    $this->assert_equal($rand, $photo->description);
-    $this->assert_equal("image/jpeg", $photo->mime_type);
-    $this->assert_equal($image_info[0], $photo->width);
-    $this->assert_equal($image_info[1], $photo->height);
-
-    $this->assert_equal($photo->parent()->right_ptr - 2, $photo->left_ptr);
-    $this->assert_equal($photo->parent()->right_ptr - 1, $photo->right_ptr);
-  }
-
-  public function create_conflicting_photo_test() {
-    $rand = rand();
-    $root = ORM::factory("item", 1);
-    $photo1 = photo::create($root, MODPATH . "gallery/tests/test.jpg", "$rand.jpg", $rand, $rand);
-    $photo2 = photo::create($root, MODPATH . "gallery/tests/test.jpg", "$rand.jpg", $rand, $rand);
-    $this->assert_true($photo1->name != $photo2->name);
-  }
-
-  public function create_photo_with_no_extension_test() {
-    $root = ORM::factory("item", 1);
-    try {
-      photo::create($root, "/tmp", "name", "title", "description");
-      $this->assert_false("should fail with an exception");
-    } catch (Exception $e) {
-      // pass
-    }
-  }
-
-  public function thumb_url_test() {
-    $rand = rand();
-    $root = ORM::factory("item", 1);
-    $photo = photo::create($root, MODPATH . "gallery/tests/test.jpg", "$rand.jpg", $rand, $rand);
-    $this->assert_equal("http://./var/thumbs/{$rand}.jpg?m={$photo->updated}", $photo->thumb_url());
-  }
-
-  public function resize_url_test() {
-    $rand = rand();
-    $root = ORM::factory("item", 1);
-    $album = album::create($root, $rand, $rand, $rand);
-    $photo = photo::create($album, MODPATH . "gallery/tests/test.jpg", "$rand.jpg", $rand, $rand);
-
-    $this->assert_equal(
-      "http://./var/resizes/{$rand}/{$rand}.jpg?m={$photo->updated}", $photo->resize_url());
-  }
-
-  public function file_url_test() {
-    $rand = rand();
-    $root = ORM::factory("item", 1);
-    $album = album::create($root, $rand, $rand, $rand);
-    $photo = photo::create($album, MODPATH . "gallery/tests/test.jpg", "$rand.jpg", $rand, $rand);
-
-    $this->assert_equal(
-      "http://./var/albums/{$rand}/{$rand}.jpg?m={$photo->updated}", $photo->file_url());
-  }
-
-  public function create_photo_creates_reasonable_slug_test() {
-    $rand = rand();
-    $root = ORM::factory("item", 1);
-    $album = album::create($root, $rand, $rand, $rand);
-    $photo = photo::create(
-      $album, MODPATH . "gallery/tests/test.jpg", "This (is) my file%name.jpg", $rand, $rand);
-
-    $this->assert_equal("This-is-my-file-name", $photo->slug);
-  }
-
-  public function create_photo_shouldnt_allow_names_with_slash_test() {
-    $rand = rand();
-    $root = ORM::factory("item", 1);
-    try {
-      $photo = photo::create($root, MODPATH . "gallery/tests/test.jpg", "$rand/.jpg", $rand, $rand);
-    } catch (Exception $e) {
-      // pass
-      return;
-    }
-
-    $this->assert_true(false, "Shouldn't create a photo with / in the name");
-  }
-
-  public function create_photo_silently_trims_trailing_periods_test() {
-    $rand = rand();
-    $root = ORM::factory("item", 1);
-    try {
-      $photo = photo::create($root, MODPATH . "gallery/tests/test.jpg", "$rand.jpg.", $rand, $rand);
-    } catch (Exception $e) {
-      $this->assert_equal("@todo NAME_CANNOT_END_IN_PERIOD", $e->getMessage());
-      return;
-    }
-
-    $this->assert_true(false, "Shouldn't create a photo with trailing . in the name");
-  }
-}
-- 
cgit v1.2.3


From 2687762aec243d157f38de765f4b5c8465fc23ec Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Mon, 18 Jan 2010 23:38:18 -0800
Subject: Update for model validation.  Move the url safe tests into
 Item_Model_Test.

---
 modules/gallery/tests/Item_Helper_Test.php | 30 ++----------------------------
 1 file changed, 2 insertions(+), 28 deletions(-)

diff --git a/modules/gallery/tests/Item_Helper_Test.php b/modules/gallery/tests/Item_Helper_Test.php
index f0c653c0..b3896c7a 100644
--- a/modules/gallery/tests/Item_Helper_Test.php
+++ b/modules/gallery/tests/Item_Helper_Test.php
@@ -20,9 +20,8 @@
 class Item_Helper_Test extends Unit_Test_Case {
 
   public function viewable_test() {
-    $root = ORM::factory("item", 1);
-    $album = album::create($root, rand(), rand(), rand());
-    $item = self::_create_random_item($album);
+    $album = test::random_album();
+    $item = test::random_photo($album);
     identity::set_active_user(identity::guest());
 
     // We can see the item when permissions are granted
@@ -38,33 +37,8 @@ class Item_Helper_Test extends Unit_Test_Case {
       ORM::factory("item")->viewable()->where("id", "=", $item->id)->count_all());
   }
 
-  public function validate_url_safe_test() {
-    $input = new MockInput();
-    $input->value = "Ab_cd-ef-d9";
-    item::validate_url_safe($input);
-    $this->assert_true(!isset($input->not_url_safe));
-
-    $input->value = "ab&cd";
-    item::validate_url_safe($input);
-    $this->assert_equal(1, $input->not_url_safe);
-  }
-
   public function convert_filename_to_slug_test() {
     $this->assert_equal("foo", item::convert_filename_to_slug("{[foo]}"));
     $this->assert_equal("foo-bar", item::convert_filename_to_slug("{[foo!@#!$@#^$@($!(@bar]}"));
   }
-
-  private static function _create_random_item($album) {
-    // Set all required fields (values are irrelevant)
-    $item = ORM::factory("item");
-    $item->name = rand();
-    $item->type = "photo";
-    return $item->add_to_parent($album);
-  }
 }
-
-class MockInput {
-  function add_error($error, $value) {
-    $this->$error = $value;
-  }
-}
\ No newline at end of file
-- 
cgit v1.2.3


From 4418993db96a6d9c4444957b78588b4ce01556f4 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Mon, 18 Jan 2010 23:38:39 -0800
Subject: Add slug_is_url_safe_test()

---
 modules/gallery/tests/Item_Model_Test.php | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/modules/gallery/tests/Item_Model_Test.php b/modules/gallery/tests/Item_Model_Test.php
index 5294836d..afb131fc 100644
--- a/modules/gallery/tests/Item_Model_Test.php
+++ b/modules/gallery/tests/Item_Model_Test.php
@@ -318,4 +318,20 @@ class Item_Model_Test extends Unit_Test_Case {
 
     $this->assert_false(true, "Shouldn't get here");
   }
+
+  public function slug_is_url_safe_test() {
+    $album = test::random_album_unsaved();
+
+    try {
+      $album->slug = "illegal chars! !@#@#$!@~";
+      $album->save();
+      $this->assert_true(false, "Shouldn't be able to save");
+    } catch (ORM_Validation_Exception $e) {
+      $this->assert_same(array("slug" => "not_url_safe"), $e->validation->errors());
+    }
+
+    // This should work
+    $album->slug = "the_quick_brown_fox";
+    $album->save();
+  }
 }
-- 
cgit v1.2.3


From c059a444c77c0adc6d003b8ece38ba654e4f45f0 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Mon, 18 Jan 2010 23:49:00 -0800
Subject: Updated for model based validation.  Fixed
 change_photo_no_csrf_fails_test() which has been broken since we deleted
 Rest_Controller.

---
 modules/gallery/tests/Photos_Controller_Test.php | 28 ++++++++++--------------
 1 file changed, 11 insertions(+), 17 deletions(-)

diff --git a/modules/gallery/tests/Photos_Controller_Test.php b/modules/gallery/tests/Photos_Controller_Test.php
index b6c6df47..31e0bc21 100644
--- a/modules/gallery/tests/Photos_Controller_Test.php
+++ b/modules/gallery/tests/Photos_Controller_Test.php
@@ -29,19 +29,14 @@ class Photos_Controller_Test extends Unit_Test_Case {
 
   public function change_photo_test() {
     $controller = new Photos_Controller();
-    $root = ORM::factory("item", 1);
-    $photo = photo::create(
-      $root, MODPATH . "gallery/tests/test.jpg", "test.jpeg",
-      "test", "test", identity::active_user()->id, "slug");
-    $orig_name = $photo->name;
+    $photo = test::random_photo();
 
-    $_POST["filename"] = "test.jpeg";
-    $_POST["name"] = "new name";
+    $_POST["filename"] = "new name.jpg";
     $_POST["title"] = "new title";
     $_POST["description"] = "new description";
     $_POST["slug"] = "new-slug";
     $_POST["csrf"] = access::csrf_token();
-    access::allow(identity::everybody(), "edit", $root);
+    access::allow(identity::everybody(), "edit", item::root());
 
     ob_start();
     $controller->update($photo->id);
@@ -53,26 +48,25 @@ class Photos_Controller_Test extends Unit_Test_Case {
     $this->assert_equal("new-slug", $photo->slug);
     $this->assert_equal("new title", $photo->title);
     $this->assert_equal("new description", $photo->description);
-
-    // We don't change the name, yet.
-    $this->assert_equal($orig_name, $photo->name);
+    $this->assert_equal("new name.jpeg", $photo->name);
   }
 
   public function change_photo_no_csrf_fails_test() {
     $controller = new Photos_Controller();
-    $root = ORM::factory("item", 1);
-    $photo = photo::create(
-      $root, MODPATH . "gallery/tests/test.jpg", "test.jpg", "test", "test");
-    $_POST["name"] = "new name";
+    $photo = test::random_photo();
+
+    $_POST["filename"] = "new name.jpg";
     $_POST["title"] = "new title";
     $_POST["description"] = "new description";
-    access::allow(identity::everybody(), "edit", $root);
+    $_POST["slug"] = "new slug";
+    access::allow(identity::everybody(), "edit", item::root());
 
     try {
-      $controller->_update($photo);
+      $controller->update($photo);
       $this->assert_true(false, "This should fail");
     } catch (Exception $e) {
       // pass
+      $this->assert_same("@todo FORBIDDEN", $e->getMessage());
     }
   }
 }
-- 
cgit v1.2.3


From c23bf312c41102efc2af320a8f63a5180fe84eea Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 19 Jan 2010 00:34:48 -0800
Subject: Our own version of Unit_Test_Case that adds useful functions like
 assert_equal_array().

---
 .../libraries/Gallery_Unit_Test_Case.php           | 32 ++++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 modules/gallery_unit_test/libraries/Gallery_Unit_Test_Case.php

diff --git a/modules/gallery_unit_test/libraries/Gallery_Unit_Test_Case.php b/modules/gallery_unit_test/libraries/Gallery_Unit_Test_Case.php
new file mode 100644
index 00000000..81bd3330
--- /dev/null
+++ b/modules/gallery_unit_test/libraries/Gallery_Unit_Test_Case.php
@@ -0,0 +1,32 @@
+<?php defined("SYSPATH") or die("No direct script access.");
+/**
+ * Gallery - a web based photo album viewer and editor
+ * Copyright (C) 2000-2009 Bharat Mediratta
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or (at
+ * your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+class Gallery_Unit_Test_Case extends Unit_Test_Case {
+  public function assert_equal_array($expected, $actual, $debug=null) {
+    if ($expected !== $actual) {
+      throw new Kohana_Unit_Test_Exception(
+        sprintf("Expected (%s) %s but received (%s) %s\n Diff: %s",
+                gettype($expected), var_export($expected, true),
+                gettype($actual), var_export($actual, true),
+                diff::compare(var_export($expected, true), var_export($actual, true))),
+        $debug);
+    }
+    return $this;
+  }
+}
-- 
cgit v1.2.3


From 2c0b0aaebca6ec1149585853d7d849d50bea4184 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 19 Jan 2010 00:35:32 -0800
Subject: Add rest::url() for convenience.

---
 modules/rest/helpers/rest.php | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/modules/rest/helpers/rest.php b/modules/rest/helpers/rest.php
index 121191f2..423765bb 100644
--- a/modules/rest/helpers/rest.php
+++ b/modules/rest/helpers/rest.php
@@ -71,4 +71,14 @@ class rest_Core {
 
     return call_user_func(array($class, "resolve"), !empty($components[2]) ? $components[2] : null);
   }
+
+  /**
+   * Return an absolute url used for REST resource location.
+   * @param  string  module name (eg, "gallery", "tags")
+   * @param  string  relative path (eg "Family/Weddings.jpg")
+   * @return string  complete url
+   */
+  static function url($module, $path) {
+    return url::abs_site("rest/$module/$path");
+  }
 }
-- 
cgit v1.2.3


From eea936877725b9d682dc9969d0904b886c095420 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 19 Jan 2010 00:36:19 -0800
Subject: Have the rest calls return an array and print it out in the
 controller.  This is a clearer workflow; controllers generate output, not
 helpers.  It's also easier to test.

---
 modules/rest/controllers/rest.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/rest/controllers/rest.php b/modules/rest/controllers/rest.php
index cac49740..a3e7313c 100644
--- a/modules/rest/controllers/rest.php
+++ b/modules/rest/controllers/rest.php
@@ -73,7 +73,7 @@ class Rest_Controller extends Controller {
       }
 
       try {
-        print call_user_func(array($handler_class, $handler_method), $request);
+        print rest::reply(call_user_func(array($handler_class, $handler_method), $request));
       } catch (ORM_Validation_Exception $e) {
         foreach ($e->validation->errors() as $key => $value) {
           $msgs[] = "$key: $value";
-- 
cgit v1.2.3


From cb7c263b470bd1452c47a3e29d67373869150d2c Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 19 Jan 2010 00:36:40 -0800
Subject: Return arrays instead of calling rest::reply.

---
 modules/gallery/helpers/gallery_rest.php | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/modules/gallery/helpers/gallery_rest.php b/modules/gallery/helpers/gallery_rest.php
index 24733f20..7f93bd38 100644
--- a/modules/gallery/helpers/gallery_rest.php
+++ b/modules/gallery/helpers/gallery_rest.php
@@ -91,7 +91,7 @@ class gallery_rest_Core {
       $members[] = url::abs_site("rest/gallery/" . $child->relative_url());
     }
 
-    return rest::reply(array("resource" => $item->as_array(), "members" => $members));
+    return array("resource" => $item->as_array(), "members" => $members);
   }
 
   static function put($request) {
@@ -112,7 +112,7 @@ class gallery_rest_Core {
     }
     $item->save();
 
-    return rest::reply(array("url" => url::abs_site("/rest/gallery/" . $item->relative_url())));
+    return array("url" => url::abs_site("/rest/gallery/" . $item->relative_url()));
   }
 
   static function post($request) {
@@ -146,7 +146,7 @@ class gallery_rest_Core {
       throw new Rest_Exception("Invalid type: $args->type", 400);
     }
 
-    return rest::reply(array("url" => url::abs_site("/rest/gallery/" . $item->relative_url())));
+    return array("url" => url::abs_site("/rest/gallery/" . $item->relative_url()));
   }
 
   static function delete($request) {
@@ -154,7 +154,6 @@ class gallery_rest_Core {
     access::required("edit", $item);
 
     $item->delete();
-    return rest::reply();
   }
 
   static function resolve($path) {
-- 
cgit v1.2.3


From a587426cfda4a0cd4e8f3f53607c8e3ad2305506 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 19 Jan 2010 01:12:09 -0800
Subject: Don't try to set the album cover for the grandparent if we don't have
 edit permissions for it.

---
 modules/gallery/helpers/item.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/gallery/helpers/item.php b/modules/gallery/helpers/item.php
index 53291ccc..7821e628 100644
--- a/modules/gallery/helpers/item.php
+++ b/modules/gallery/helpers/item.php
@@ -59,7 +59,7 @@ class item_Core {
     $parent->save();
     graphics::generate($parent);
     $grand_parent = $parent->parent();
-    if ($grand_parent && $grand_parent->album_cover_item_id == null)  {
+    if (access::can("edit", $grand_parent) && $grand_parent->album_cover_item_id == null)  {
       item::make_album_cover($parent);
     }
   }
-- 
cgit v1.2.3


From 069a23e81192578f5f02f6a52a07536ceb6c0bcd Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 19 Jan 2010 01:16:59 -0800
Subject: Make scope default to direct. Add slug to the post params. Fix minor
 output bug.

---
 modules/gallery/helpers/gallery_rest.php | 26 +++++++++++++++-----------
 1 file changed, 15 insertions(+), 11 deletions(-)

diff --git a/modules/gallery/helpers/gallery_rest.php b/modules/gallery/helpers/gallery_rest.php
index 7f93bd38..827da122 100644
--- a/modules/gallery/helpers/gallery_rest.php
+++ b/modules/gallery/helpers/gallery_rest.php
@@ -65,17 +65,19 @@ class gallery_rest_Core {
       $orm = ORM::factory("item")->viewable();
     }
 
-    if (!empty($p->scope) && !in_array($p->scope, array("direct", "all"))) {
+    if (empty($p->scope)) {
+      $p->scope = "direct";
+    }
+
+    if (!in_array($p->scope, array("direct", "all"))) {
       throw new Exception("Bad Request", 400);
     }
-    if (!empty($p->scope)) {
-      if ($p->scope == "direct") {
-        $orm->where("parent_id", "=", $item->id);
-      } else {
-        $orm->where("left_ptr", ">=", $item->left_ptr);
-        $orm->where("right_ptr", "<=", $item->left_ptr);
-        $orm->where("id", "<>", $item->id);
-      }
+
+    if ($p->scope == "direct") {
+      $orm->where("parent_id", "=", $item->id);
+    } else {
+      $orm->where("left_ptr", ">", $item->left_ptr);
+      $orm->where("right_ptr", "<", $item->right_ptr);
     }
 
     if (isset($p->name)) {
@@ -128,6 +130,7 @@ class gallery_rest_Core {
       $item->name = $params->name;
       $item->title = isset($params->title) ? $params->title : $name;
       $item->description = isset($params->description) ? $params->description : null;
+      $item->slug = isset($params->slug) ? $params->slug : null;
       $item->save();
       break;
 
@@ -137,13 +140,14 @@ class gallery_rest_Core {
       $item->parent_id = $parent->id;
       $item->set_data_file($request->file);
       $item->name = $params->name;
-      $item->title = isset($params->title) ? $params->title : $name;
+      $item->title = isset($params->title) ? $params->title : $params->name;
       $item->description = isset($params->description) ? $params->description : null;
+      $item->slug = isset($params->slug) ? $params->slug : null;
       $item->save();
       break;
 
     default:
-      throw new Rest_Exception("Invalid type: $args->type", 400);
+      throw new Rest_Exception("Invalid type: $params->type", 400);
     }
 
     return array("url" => url::abs_site("/rest/gallery/" . $item->relative_url()));
-- 
cgit v1.2.3


From f95442c314f84004c48758579f076ae209aace43 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 19 Jan 2010 01:17:29 -0800
Subject: Rewrite the tests entirely to cover the new REST code.

---
 modules/gallery/tests/Gallery_Rest_Helper_Test.php | 347 ++++++++-------------
 1 file changed, 138 insertions(+), 209 deletions(-)

diff --git a/modules/gallery/tests/Gallery_Rest_Helper_Test.php b/modules/gallery/tests/Gallery_Rest_Helper_Test.php
index dac221b3..35fd0daf 100644
--- a/modules/gallery/tests/Gallery_Rest_Helper_Test.php
+++ b/modules/gallery/tests/Gallery_Rest_Helper_Test.php
@@ -17,262 +17,191 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class Gallery_Rest_Helper_Test extends Unit_Test_Case {
+class Gallery_Rest_Helper_Test extends Gallery_Unit_Test_Case {
   public function setup() {
     $this->_save = array($_GET, $_POST, $_SERVER, $_FILES);
-    $this->_saved_active_user = identity::active_user();
   }
 
   public function teardown() {
     list($_GET, $_POST, $_SERVER, $_FILES) = $this->_save;
-    identity::set_active_user($this->_saved_active_user);
-    if (!empty($this->_user)) {
-      try {
-        $this->_user->delete();
-      } catch (Exception $e) { }
-    }
   }
 
-  private function _create_user() {
-    if (empty($this->_user)) {
-      $this->_user = identity::create_user("access_test" . rand(), "Access Test", "password");
-      $key = ORM::factory("user_access_token");
-      $key->access_key = md5($this->_user->name . rand());
-      $key->user_id = $this->_user->id;
-      $key->save();
-      identity::set_active_user($this->_user);
-    }
-    return $this->_user;
+  public function resolve_test() {
+    $album = test::random_album();
+    $resolved = rest::resolve(rest::url("gallery", $album->relative_url()));
+    $this->assert_equal($album->id, $resolved->id);
   }
 
-  private function _create_album($parent=null) {
-    $album_name = "rest_album_" . rand();
-    if (empty($parent)) {
-      $parent = ORM::factory("item", 1);
-    }
-    return album::create($parent, $album_name, $album_name, $album_name);
-  }
+  public function get_scope_test() {
+    $album1 = test::random_album();
+    $photo1 = test::random_photo($album1);
+    $album2 = test::random_album($album1);
+    $photo2 = test::random_photo($album2);
+    $album1->reload();
 
-  private function _create_image($parent=null) {
-    $filename = MODPATH . "gallery/tests/test.jpg";
-    $image_name = "rest_image_" . rand();
-    if (empty($parent)) {
-      $parent = ORM::factory("item", 1);
-    }
-    return photo::create($parent, $filename, "$image_name.jpg", $image_name);
-  }
+    // No scope is the same as "direct"
+    $request->url = rest::url("gallery", $album1->relative_url());
+    $request->params = new stdClass();
+    $this->assert_equal_array(
+      array("resource" => $album1->as_array(),
+            "members" => array(
+              rest::url("gallery", $photo1->relative_url()),
+              rest::url("gallery", $album2->relative_url()))),
+      gallery_rest::get($request));
 
-  public function gallery_rest_get_album_test() {
-    $album = $this->_create_album();
-    $child = $this->_create_album($album);
-    $photo = $this->_create_image($child);
-    $child->reload();
-    $request = (object)array("arguments" => explode("/", $child->relative_url()));
+    $request->url = rest::url("gallery", $album1->relative_url());
+    $request->params->scope = "direct";
+    $this->assert_equal_array(
+      array("resource" => $album1->as_array(),
+            "members" => array(
+              rest::url("gallery", $photo1->relative_url()),
+              rest::url("gallery", $album2->relative_url()))),
+      gallery_rest::get($request));
 
-    $this->assert_equal(
-      json_encode(array("status" => "OK",
-                        "resource" =>
-                          array("type" => $child->type,
-                                "name" => $child->name,
-                                "path" => $child->relative_url(),
-                                "parent_path" => $album->relative_url(),
-                                "title" => $child->title,
-                                "thumb_url" => $child->thumb_url(),
-                                "thumb_size" => array("height" => $child->thumb_height,
-                                                      "width" => $child->thumb_width),
-                                "resize_url" => $child->resize_url(),
-                                "resize_size" => array("height" => 0,
-                                                       "width" => 0),
-                                "url" => $child->file_url(),
-                                "size" => array("height" => $child->height,
-                                                "width" => $child->width),
-                                "description" => $child->description,
-                                "slug" => $child->slug,
-                                "children" => array(array(
-                                   "type" => "photo",
-                                   "has_children" => false,
-                                   "path" => $photo->relative_url(),
-                                   "thumb_url" => $photo->thumb_url(),
-                                   "thumb_dimensions" => array(
-                                     "width" => (string)$photo->thumb_width,
-                                     "height" => (string)$photo->thumb_height),
-                                   "has_thumb" => true,
-                                   "title" => $photo->title))))),
+    $request->url = rest::url("gallery", $album1->relative_url());
+    $request->params->scope = "all";
+    $this->assert_equal_array(
+      array("resource" => $album1->as_array(),
+            "members" => array(
+              rest::url("gallery", $photo1->relative_url()),
+              rest::url("gallery", $album2->relative_url()),
+              rest::url("gallery", $photo2->relative_url()))),
       gallery_rest::get($request));
   }
 
-  public function gallery_rest_get_photo_test() {
-    $child = $this->_create_album();
-    $photo = $this->_create_image($child);
-    $request = (object)array("arguments" => explode("/", $photo->relative_url()));
-
-    $this->assert_equal(
-      json_encode(array("status" => "OK",
-                        "resource" =>
-                        array("type" => $photo->type,
-                              "name" => $photo->name,
-                              "path" => $photo->relative_url(),
-                              "parent_path" => $child->relative_url(),
-                              "title" => $photo->title,
-                              "thumb_url" => $photo->thumb_url(),
-                              "thumb_size" => array("height" => (string)$photo->thumb_height,
-                                                    "width" => (string)$photo->thumb_width),
-                              "resize_url" => $photo->resize_url(),
-                              "resize_size" => array("height" => $photo->resize_height,
-                                                       "width" => $photo->resize_width),
-                              "url" => $photo->file_url(),
-                              "size" => array("height" => (string)$photo->height,
-                                              "width" => (string)$photo->width),
-                              "description" => $photo->description,
-                              "slug" => $photo->slug))),
+  public function get_children_like_test() {
+    $album1 = test::random_album();
+    $photo1 = test::random_photo($album1);
+    $photo2 = test::random_photo_unsaved($album1);
+    $photo2->name = "foo.jpg";
+    $photo2->save();
+    $album1->reload();
+
+    $request->url = rest::url("gallery", $album1->relative_url());
+    $request->params->name = "foo";
+    $this->assert_equal_array(
+      array("resource" => $album1->as_array(),
+            "members" => array(
+              rest::url("gallery", $photo2->relative_url()))),
       gallery_rest::get($request));
   }
 
-  public function gallery_rest_put_album_no_path_test() {
-    $request = (object)array("description" => "Updated description",
-                             "title" => "Updated Title",
-                             "name" => "new name");
+  public function get_children_type_test() {
+    $album1 = test::random_album();
+    $photo1 = test::random_photo($album1);
+    $album2 = test::random_album($album1);
+    $album1->reload();
 
-    try {
-      gallery_rest::put($request);
-    } catch (Rest_Exception $e) {
-      $this->assert_equal("Bad request", $e->getMessage());
-      $this->assert_equal(400, $e->getCode());
-    } catch (Exception $e) {
-      $this->assert_false(true, $e->__toString());
-    }
+    $request->url = rest::url("gallery", $album1->relative_url());
+    $request->params->type = "album";
+    $this->assert_equal_array(
+      array("resource" => $album1->as_array(),
+            "members" => array(
+              rest::url("gallery", $album2->relative_url()))),
+      gallery_rest::get($request));
   }
 
-  public function gallery_rest_put_album_not_found_test() {
-    $photo = $this->_create_image();
-    $request = (object)array("arguments" => explode("/", $photo->relative_url() . rand()),
-                             "description" => "Updated description",
-                             "title" => "Updated Title",
-                             "name" => "new name");
+  public function update_album_test() {
+    $album1 = test::random_album();
+    access::allow(identity::everybody(), "edit", $album1);
 
-    try {
-      gallery_rest::put($request);
-    } catch (Kohana_404_Exception $k404) {
-    } catch (Exception $e) {
-      $this->assert_false(true, $e->__toString());
-    }
+    $request->url = rest::url("gallery", $album1->relative_url());
+    $request->params->title = "my new title";
+
+    $this->assert_equal_array(
+      array("url" => rest::url("gallery", $album1->relative_url())),
+      gallery_rest::put($request));
+    $this->assert_equal("my new title", $album1->reload()->title);
   }
 
-  public function gallery_rest_put_album_no_edit_permission_test() {
-    $child = $this->_create_album();
-    $this->_create_user();
-    $request = (object)array("arguments" => explode("/", $child->relative_url()),
-                             "description" => "Updated description",
-                             "title" => "Updated Title",
-                             "name" => "new name");
+  public function update_album_illegal_value_fails_test() {
+    $album1 = test::random_album();
+    access::allow(identity::everybody(), "edit", $album1);
+
+    $request->url = rest::url("gallery", $album1->relative_url());
+    $request->params->title = "my new title";
+    $request->params->slug = "not url safe";
 
     try {
       gallery_rest::put($request);
-    } catch (Kohana_404_Exception $k404) {
-    } catch (Exception $e) {
-      $this->assert_false(true, $e->__toString());
+    } catch (ORM_Validation_Exception $e) {
+      $this->assert_equal(array("slug" => "not_url_safe"), $e->validation->errors());
+      return;
     }
+    $this->assert_true(false, "Shouldn't get here");
   }
 
-  public function gallery_rest_put_album_rename_conflict_test() {
-    $child = $this->_create_album();
-    $sibling = $this->_create_image();
-    $this->_create_user();
-    access::allow(identity::registered_users(), "edit", $child);
-    $request = (object)array("arguments" => explode("/", $child->relative_url()),
-                             "description" => "Updated description",
-                             "title" => "Updated Title",
-                             "name" => $sibling->name);
-
-    $this->assert_equal(
-      json_encode(array("status" => "VALIDATE_ERROR",
-                        "fields" => array("slug" => "Duplicate Internet address"))),
-      gallery_rest::put($request));
-  }
-
-  public function gallery_rest_put_album_test() {
-    $child = $this->_create_album();
-    $sibling = $this->_create_image();
-    $this->_create_user();
-    access::allow(identity::registered_users(), "edit", $child);
+  public function add_album_test() {
+    $album1 = test::random_album();
+    access::allow(identity::everybody(), "edit", $album1);
 
-    $new_name = "new_album_name" . rand();
-    $request = (object)array("arguments" => explode("/", $child->relative_url()),
-                             "description" => "Updated description",
-                             "title" => "Updated Title",
-                             "name" => $new_name);
+    $request->url = rest::url("gallery", $album1->relative_url());
+    $request->params->type = "album";
+    $request->params->name = "my album";
+    $request->params->title = "my album";
+    $response = gallery_rest::post($request);
+    $new_album = rest::resolve($response["url"]);
 
-    $this->assert_equal(json_encode(array("status" => "OK")), gallery_rest::put($request));
-    $child->reload();
-    $this->assert_equal("Updated description", $child->description);
-    $this->assert_equal("Updated Title", $child->title);
-    $this->assert_equal($new_name,  $child->name);
+    $this->assert_true($new_album->is_album());
+    $this->assert_equal($album1->id, $new_album->parent_id);
   }
 
-  public function gallery_rest_put_photo_test() {
-    $child = $this->_create_album();
-    $photo = $this->_create_image($child);
-    $this->_create_user();
-    access::allow(identity::registered_users(), "edit", $child);
+  public function add_album_illegal_value_fails_test() {
+    $album1 = test::random_album();
+    access::allow(identity::everybody(), "edit", $album1);
 
-    $request = (object)array("arguments" => explode("/", $photo->relative_url()),
-                             "description" => "Updated description",
-                             "title" => "Updated Title",
-                             "name" => "new name");
+    $request->url = rest::url("gallery", $album1->relative_url());
+    $request->params->type = "album";
+    $request->params->name = "my album";
+    $request->params->title = "my album";
+    $request->params->slug = "not url safe";
 
-    $this->assert_equal(json_encode(array("status" => "OK")), gallery_rest::put($request));
-    $photo->reload();
-    $this->assert_equal("Updated description", $photo->description);
-    $this->assert_equal("Updated Title", $photo->title);
-    $this->assert_equal("new name",  $photo->name);
+    try {
+      gallery_rest::post($request);
+    } catch (ORM_Validation_Exception $e) {
+      $this->assert_equal(array("slug" => "not_url_safe"), $e->validation->errors());
+      return;
+    }
+    $this->assert_true(false, "Shouldn't get here");
   }
 
-  public function gallery_rest_delete_album_test() {
-    $album = $this->_create_album();
-    $child = $this->_create_album($album);
-    $this->_create_user();
-    access::allow(identity::registered_users(), "edit", $album);
 
-    $request = (object)array("arguments" => explode("/", $child->relative_url()));
+  public function add_photo_test() {
+    $album1 = test::random_album();
+    access::allow(identity::everybody(), "edit", $album1);
+
+    $request->url = rest::url("gallery", $album1->relative_url());
+    $request->params->type = "photo";
+    $request->params->name = "my photo.jpg";
+    $request->file = MODPATH . "gallery/tests/test.jpg";
+    $response = gallery_rest::post($request);
+    $new_photo = rest::resolve($response["url"]);
 
-    $this->assert_equal(json_encode(array("status" => "OK",
-                                          "resource" => array(
-                                            "parent_path" => $album->relative_url()))),
-                        gallery_rest::delete($request));
-    $child->reload();
-    $this->assert_false($child->loaded());
+    $this->assert_true($new_photo->is_photo());
+    $this->assert_equal($album1->id, $new_photo->parent_id);
   }
 
-  public function gallery_rest_delete_photo_test() {
-    $album = $this->_create_album();
-    $photo = $this->_create_image($album);
-    $this->_create_user();
-    access::allow(identity::registered_users(), "edit", $album);
+  public function delete_album_test() {
+    $album1 = test::random_album();
+    access::allow(identity::everybody(), "edit", $album1);
 
-    $request = (object)array("arguments" => explode("/", $photo->relative_url()));
+    $request->url = rest::url("gallery", $album1->relative_url());
+    gallery_rest::delete($request);
 
-    $this->assert_equal(json_encode(array("status" => "OK",
-                                          "resource" => array(
-                                            "parent_path" => $album->relative_url()))),
-                        gallery_rest::delete($request));
-    $photo->reload();
-    $this->assert_false($photo->loaded());
+    $album1->reload();
+    $this->assert_false($album1->loaded());
   }
 
-  public function gallery_rest_post_album_test() {
-    $album = $this->_create_album();
-    $this->_create_user();
-    access::allow(identity::registered_users(), "edit", $album);
+  public function delete_album_fails_without_permission_test() {
+    $album1 = test::random_album();
 
-    $new_path = $album->relative_url() . "/new%20child";
-    $request = (object)array("arguments" => explode("/", $new_path));
-
-    $this->assert_equal(json_encode(array("status" => "OK", "path" => $new_path)),
-                        gallery_rest::post($request));
-    $album = ORM::factory("item")
-      ->where("relative_url_cache", "=", $new_path)
-      ->find();
-    $this->assert_true($album->loaded());
-    $this->assert_equal("new child", $album->slug);
+    $request->url = rest::url("gallery", $album1->relative_url());
+    try {
+      gallery_rest::delete($request);
+    } catch (Exception $e) {
+      $this->assert_equal("@todo FORBIDDEN", $e->getMessage());
+      return;
+    }
+    $this->assert_true(false, "Shouldn't get here");
   }
 }
-- 
cgit v1.2.3


From c590fed132b07647c38b1d5b4a93ffe30b6ac4bf Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 19 Jan 2010 01:33:57 -0800
Subject: Change rest::url() to take a module name and a resource.  The module
 does the rest.  This function is symmetrical to rest::resolve.

---
 modules/gallery/helpers/gallery_rest.php           | 28 ++++---------
 modules/gallery/tests/Gallery_Rest_Helper_Test.php | 46 +++++++++++-----------
 modules/rest/helpers/rest.php                      | 12 ++++--
 modules/tag/helpers/tag_rest.php                   | 15 ++++---
 modules/tag/helpers/tags_rest.php                  |  6 +--
 5 files changed, 50 insertions(+), 57 deletions(-)

diff --git a/modules/gallery/helpers/gallery_rest.php b/modules/gallery/helpers/gallery_rest.php
index 827da122..5fd73a2e 100644
--- a/modules/gallery/helpers/gallery_rest.php
+++ b/modules/gallery/helpers/gallery_rest.php
@@ -17,25 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-
-// @todo Add logging
-
-// Validation questions
-//
-// We need to be able to properly validate anything we want to enter here.  But all of our
-// validation currently happens at the controller / form level, and we're not using the same
-// controllers or forms.
-//
-// Possible solutions:
-// 1) Move validation into the model and use it both here and in the regular controllers.  But
-// if we do that, how do we translate validation failures into a user-consumable output which
-// we need so that we can return proper error responses to form submissions?
-//
-// 2) Create some kind of validation helper that can validate every field.  Wait, isn't this
-// just like #1 except in a helper instead of in the model?
-
 class gallery_rest_Core {
-
   /**
    * For items that are collections, you can specify the following additional query parameters to
    * query the collection.  You can specify them in any combination.
@@ -90,7 +72,7 @@ class gallery_rest_Core {
 
     $members = array();
     foreach ($orm->find_all() as $child) {
-      $members[] = url::abs_site("rest/gallery/" . $child->relative_url());
+      $members[] = rest::url("gallery", $child);
     }
 
     return array("resource" => $item->as_array(), "members" => $members);
@@ -114,7 +96,7 @@ class gallery_rest_Core {
     }
     $item->save();
 
-    return array("url" => url::abs_site("/rest/gallery/" . $item->relative_url()));
+    return array("url" => rest::url("gallery", $item));
   }
 
   static function post($request) {
@@ -150,7 +132,7 @@ class gallery_rest_Core {
       throw new Rest_Exception("Invalid type: $params->type", 400);
     }
 
-    return array("url" => url::abs_site("/rest/gallery/" . $item->relative_url()));
+    return array("url" => rest::url("gallery", $item));
   }
 
   static function delete($request) {
@@ -163,4 +145,8 @@ class gallery_rest_Core {
   static function resolve($path) {
     return url::get_item_from_uri($path);
   }
+
+  static function url($item) {
+    return url::abs_site("rest/gallery/" . $item->relative_url());
+  }
 }
diff --git a/modules/gallery/tests/Gallery_Rest_Helper_Test.php b/modules/gallery/tests/Gallery_Rest_Helper_Test.php
index 35fd0daf..dcd9a9db 100644
--- a/modules/gallery/tests/Gallery_Rest_Helper_Test.php
+++ b/modules/gallery/tests/Gallery_Rest_Helper_Test.php
@@ -28,7 +28,7 @@ class Gallery_Rest_Helper_Test extends Gallery_Unit_Test_Case {
 
   public function resolve_test() {
     $album = test::random_album();
-    $resolved = rest::resolve(rest::url("gallery", $album->relative_url()));
+    $resolved = rest::resolve(rest::url("gallery", $album));
     $this->assert_equal($album->id, $resolved->id);
   }
 
@@ -40,32 +40,32 @@ class Gallery_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $album1->reload();
 
     // No scope is the same as "direct"
-    $request->url = rest::url("gallery", $album1->relative_url());
+    $request->url = rest::url("gallery", $album1);
     $request->params = new stdClass();
     $this->assert_equal_array(
       array("resource" => $album1->as_array(),
             "members" => array(
-              rest::url("gallery", $photo1->relative_url()),
-              rest::url("gallery", $album2->relative_url()))),
+              rest::url("gallery", $photo1),
+              rest::url("gallery", $album2))),
       gallery_rest::get($request));
 
-    $request->url = rest::url("gallery", $album1->relative_url());
+    $request->url = rest::url("gallery", $album1);
     $request->params->scope = "direct";
     $this->assert_equal_array(
       array("resource" => $album1->as_array(),
             "members" => array(
-              rest::url("gallery", $photo1->relative_url()),
-              rest::url("gallery", $album2->relative_url()))),
+              rest::url("gallery", $photo1),
+              rest::url("gallery", $album2))),
       gallery_rest::get($request));
 
-    $request->url = rest::url("gallery", $album1->relative_url());
+    $request->url = rest::url("gallery", $album1);
     $request->params->scope = "all";
     $this->assert_equal_array(
       array("resource" => $album1->as_array(),
             "members" => array(
-              rest::url("gallery", $photo1->relative_url()),
-              rest::url("gallery", $album2->relative_url()),
-              rest::url("gallery", $photo2->relative_url()))),
+              rest::url("gallery", $photo1),
+              rest::url("gallery", $album2),
+              rest::url("gallery", $photo2))),
       gallery_rest::get($request));
   }
 
@@ -77,12 +77,12 @@ class Gallery_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $photo2->save();
     $album1->reload();
 
-    $request->url = rest::url("gallery", $album1->relative_url());
+    $request->url = rest::url("gallery", $album1);
     $request->params->name = "foo";
     $this->assert_equal_array(
       array("resource" => $album1->as_array(),
             "members" => array(
-              rest::url("gallery", $photo2->relative_url()))),
+              rest::url("gallery", $photo2))),
       gallery_rest::get($request));
   }
 
@@ -92,12 +92,12 @@ class Gallery_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $album2 = test::random_album($album1);
     $album1->reload();
 
-    $request->url = rest::url("gallery", $album1->relative_url());
+    $request->url = rest::url("gallery", $album1);
     $request->params->type = "album";
     $this->assert_equal_array(
       array("resource" => $album1->as_array(),
             "members" => array(
-              rest::url("gallery", $album2->relative_url()))),
+              rest::url("gallery", $album2))),
       gallery_rest::get($request));
   }
 
@@ -105,11 +105,11 @@ class Gallery_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $album1 = test::random_album();
     access::allow(identity::everybody(), "edit", $album1);
 
-    $request->url = rest::url("gallery", $album1->relative_url());
+    $request->url = rest::url("gallery", $album1);
     $request->params->title = "my new title";
 
     $this->assert_equal_array(
-      array("url" => rest::url("gallery", $album1->relative_url())),
+      array("url" => rest::url("gallery", $album1)),
       gallery_rest::put($request));
     $this->assert_equal("my new title", $album1->reload()->title);
   }
@@ -118,7 +118,7 @@ class Gallery_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $album1 = test::random_album();
     access::allow(identity::everybody(), "edit", $album1);
 
-    $request->url = rest::url("gallery", $album1->relative_url());
+    $request->url = rest::url("gallery", $album1);
     $request->params->title = "my new title";
     $request->params->slug = "not url safe";
 
@@ -135,7 +135,7 @@ class Gallery_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $album1 = test::random_album();
     access::allow(identity::everybody(), "edit", $album1);
 
-    $request->url = rest::url("gallery", $album1->relative_url());
+    $request->url = rest::url("gallery", $album1);
     $request->params->type = "album";
     $request->params->name = "my album";
     $request->params->title = "my album";
@@ -150,7 +150,7 @@ class Gallery_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $album1 = test::random_album();
     access::allow(identity::everybody(), "edit", $album1);
 
-    $request->url = rest::url("gallery", $album1->relative_url());
+    $request->url = rest::url("gallery", $album1);
     $request->params->type = "album";
     $request->params->name = "my album";
     $request->params->title = "my album";
@@ -170,7 +170,7 @@ class Gallery_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $album1 = test::random_album();
     access::allow(identity::everybody(), "edit", $album1);
 
-    $request->url = rest::url("gallery", $album1->relative_url());
+    $request->url = rest::url("gallery", $album1);
     $request->params->type = "photo";
     $request->params->name = "my photo.jpg";
     $request->file = MODPATH . "gallery/tests/test.jpg";
@@ -185,7 +185,7 @@ class Gallery_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $album1 = test::random_album();
     access::allow(identity::everybody(), "edit", $album1);
 
-    $request->url = rest::url("gallery", $album1->relative_url());
+    $request->url = rest::url("gallery", $album1);
     gallery_rest::delete($request);
 
     $album1->reload();
@@ -195,7 +195,7 @@ class Gallery_Rest_Helper_Test extends Gallery_Unit_Test_Case {
   public function delete_album_fails_without_permission_test() {
     $album1 = test::random_album();
 
-    $request->url = rest::url("gallery", $album1->relative_url());
+    $request->url = rest::url("gallery", $album1);
     try {
       gallery_rest::delete($request);
     } catch (Exception $e) {
diff --git a/modules/rest/helpers/rest.php b/modules/rest/helpers/rest.php
index 423765bb..93ad2bd3 100644
--- a/modules/rest/helpers/rest.php
+++ b/modules/rest/helpers/rest.php
@@ -75,10 +75,14 @@ class rest_Core {
   /**
    * Return an absolute url used for REST resource location.
    * @param  string  module name (eg, "gallery", "tags")
-   * @param  string  relative path (eg "Family/Weddings.jpg")
-   * @return string  complete url
+   * @param  object  resource
    */
-  static function url($module, $path) {
-    return url::abs_site("rest/$module/$path");
+  static function url($module, $resource) {
+    $class = "{$module}_rest";
+    if (!method_exists($class, "url")) {
+      throw new Exception("@todo MISSING REST CLASS: $class");
+    }
+
+    return call_user_func(array($class, "url"), $resource);
   }
 }
diff --git a/modules/tag/helpers/tag_rest.php b/modules/tag/helpers/tag_rest.php
index 0aac5291..a4eaee90 100644
--- a/modules/tag/helpers/tag_rest.php
+++ b/modules/tag/helpers/tag_rest.php
@@ -22,10 +22,10 @@ class tag_rest_Core {
     $tag = rest::resolve($request->url);
     $items = array();
     foreach ($tag->items() as $item) {
-      $items[] = url::abs_site("rest/gallery/" . $item->relative_url());
+      $items[] = rest::url("gallery", $item);
     }
 
-    return rest::reply(array("resource" => $tag->as_array(), "members" => $items));
+    return array("resource" => $tag->as_array(), "members" => $items);
   }
 
   static function post($request) {
@@ -38,7 +38,7 @@ class tag_rest_Core {
     access::required("edit", $item);
 
     tag::add($item, $tag->name);
-    return rest::reply(array("url" => url::abs_site("rest/tag/" . rawurlencode($tag->name))));
+    return array("url" => rest::url("tag", $tag));
   }
 
   static function put($request) {
@@ -61,7 +61,7 @@ class tag_rest_Core {
     }
 
     $tag->save();
-    return rest::reply(array("url" => url::abs_site("rest/tag/" . rawurlencode($tag->name))));
+    return array("url" => rest::url("tag", $tag));
   }
 
   static function delete($request) {
@@ -70,7 +70,6 @@ class tag_rest_Core {
     if (empty($request->params->url)) {
       // Delete the tag
       $tag->delete();
-      return rest::reply();
     } else {
       // Remove an item from the tag
       $item = rest::resolve($request->params->url);
@@ -78,7 +77,7 @@ class tag_rest_Core {
       $tag->save();
 
       tag::compact();
-      return rest::reply(array("url" => url::abs_site("rest/tag/" . rawurlencode($tag->name))));
+      return array("url" => rest::url("tag", $tag));
     }
   }
 
@@ -90,4 +89,8 @@ class tag_rest_Core {
 
     return $tag;
   }
+
+  static function url($item) {
+    return url::abs_site("rest/tag/" . rawurlencode($tag->name));
+  }
 }
diff --git a/modules/tag/helpers/tags_rest.php b/modules/tag/helpers/tags_rest.php
index 7f0ed66a..dd23e97f 100644
--- a/modules/tag/helpers/tags_rest.php
+++ b/modules/tag/helpers/tags_rest.php
@@ -21,9 +21,9 @@ class tags_rest_Core {
   static function get($request) {
     $tags = array();
     foreach (ORM::factory("tag")->find_all() as $tag) {
-      $tags[$tag->name] = url::abs_site("rest/tags/" . rawurlencode($tag->name));
+      $tags[$tag->name] = rest::url("tags", $tag);
     }
-    return rest::reply(array("members" => $tags));
+    return array("members" => $tags);
   }
 
   static function post($request) {
@@ -43,6 +43,6 @@ class tags_rest_Core {
       $tag->save();
     }
 
-    return rest::reply(array("url" => url::abs_site("rest/tag/" . rawurlencode($tag->name))));
+    return array("url" => rest::url("tag", $tag));
   }
 }
-- 
cgit v1.2.3


From 549b88643acd571367a3b21f6dce6d42af7e7edf Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 19 Jan 2010 01:35:59 -0800
Subject: Fix a typo "tags" -> "tag"

---
 modules/tag/helpers/tags_rest.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/tag/helpers/tags_rest.php b/modules/tag/helpers/tags_rest.php
index dd23e97f..41317ecd 100644
--- a/modules/tag/helpers/tags_rest.php
+++ b/modules/tag/helpers/tags_rest.php
@@ -21,7 +21,7 @@ class tags_rest_Core {
   static function get($request) {
     $tags = array();
     foreach (ORM::factory("tag")->find_all() as $tag) {
-      $tags[$tag->name] = rest::url("tags", $tag);
+      $tags[$tag->name] = rest::url("tag", $tag);
     }
     return array("members" => $tags);
   }
-- 
cgit v1.2.3


From 0b5ce9dbc1c5571ad80d5f4a1df3f21ab29429b4 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 19 Jan 2010 01:36:15 -0800
Subject: Fix a typo: $item -> $tag.

---
 modules/tag/helpers/tag_rest.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/tag/helpers/tag_rest.php b/modules/tag/helpers/tag_rest.php
index a4eaee90..e7be9afa 100644
--- a/modules/tag/helpers/tag_rest.php
+++ b/modules/tag/helpers/tag_rest.php
@@ -90,7 +90,7 @@ class tag_rest_Core {
     return $tag;
   }
 
-  static function url($item) {
+  static function url($tag) {
     return url::abs_site("rest/tag/" . rawurlencode($tag->name));
   }
 }
-- 
cgit v1.2.3


From c3ed64fc6c0c1c9001d32191b0f1a5c21ec4b7c5 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 19 Jan 2010 01:46:45 -0800
Subject: Use property_exists() on our stdClass instead of array_key_exists()

---
 modules/gallery/helpers/gallery_rest.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/gallery/helpers/gallery_rest.php b/modules/gallery/helpers/gallery_rest.php
index 5fd73a2e..49096100 100644
--- a/modules/gallery/helpers/gallery_rest.php
+++ b/modules/gallery/helpers/gallery_rest.php
@@ -90,7 +90,7 @@ class gallery_rest_Core {
                    "resize_height", "resize_width", "slug", "sort_column", "sort_order",
                    "thumb_dirty", "thumb_height", "thumb_width", "title", "view_count",
                    "weight", "width") as $key) {
-      if (array_key_exists($key, $request->params)) {
+      if (property_exists($request->params, $key)) {
         $item->$key = $request->params->$key;
       }
     }
-- 
cgit v1.2.3


From 512910962d62a2011d7770da1b6e68bd6bbad983 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 19 Jan 2010 19:24:46 -0800
Subject: Change "dirname" to "name" in the edit album form.  I'd rather have
 consistency between field names than deal with underlying issues with Forge
 bitching about the "name" property.

---
 modules/gallery/controllers/albums.php           | 5 +----
 modules/gallery/helpers/album.php                | 4 ++--
 modules/gallery/tests/Albums_Controller_Test.php | 6 +++---
 3 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/modules/gallery/controllers/albums.php b/modules/gallery/controllers/albums.php
index 7658a913..a378f3ee 100644
--- a/modules/gallery/controllers/albums.php
+++ b/modules/gallery/controllers/albums.php
@@ -141,15 +141,12 @@ class Albums_Controller extends Items_Controller {
       $album->description = $form->edit_item->description->value;
       $album->sort_column = $form->edit_item->sort_order->column->value;
       $album->sort_order = $form->edit_item->sort_order->direction->value;
-      $album->name = $form->edit_item->dirname->value;
+      $album->name = $form->edit_item->inputs["name"]->value;
       $album->slug = $form->edit_item->slug->value;
       $album->validate();
     } catch (ORM_Validation_Exception $e) {
       // Translate ORM validation errors into form error messages
       foreach ($e->validation->errors() as $key => $error) {
-        if ($key == "name") {
-          $key = "dirname";
-        }
         $form->edit_item->inputs[$key]->add_error($error, 1);
       }
       $valid = false;
diff --git a/modules/gallery/helpers/album.php b/modules/gallery/helpers/album.php
index e99770e9..55282252 100644
--- a/modules/gallery/helpers/album.php
+++ b/modules/gallery/helpers/album.php
@@ -52,7 +52,7 @@ class album_Core {
     $group->input("title")->label(t("Title"))->value($parent->title);
     $group->textarea("description")->label(t("Description"))->value($parent->description);
     if ($parent->id != 1) {
-      $group->input("dirname")->label(t("Directory Name"))->value($parent->name)
+      $group->input("name")->label(t("Directory Name"))->value($parent->name)
         ->rules("required")
         ->error_messages(
           "conflict", t("There is already a movie, photo or album with this name"))
@@ -65,7 +65,7 @@ class album_Core {
           "not_url_safe",
           t("The internet address should contain only letters, numbers, hyphens and underscores"));
     } else {
-      $group->hidden("dirname")->value($parent->name);
+      $group->hidden("name")->value($parent->name);
       $group->hidden("slug")->value($parent->slug);
     }
 
diff --git a/modules/gallery/tests/Albums_Controller_Test.php b/modules/gallery/tests/Albums_Controller_Test.php
index 8ba2c7bc..26dc2571 100644
--- a/modules/gallery/tests/Albums_Controller_Test.php
+++ b/modules/gallery/tests/Albums_Controller_Test.php
@@ -31,9 +31,9 @@ class Albums_Controller_Test extends Unit_Test_Case {
     $album = test::random_album();
 
     // Randomize to avoid conflicts.
-    $new_dirname = "new_name_" . rand();
+    $new_name = "new_name_" . rand();
 
-    $_POST["dirname"] = $new_dirname;
+    $_POST["name"] = $new_name;
     $_POST["title"] = "new title";
     $_POST["description"] = "new description";
     $_POST["column"] = "weight";
@@ -49,7 +49,7 @@ class Albums_Controller_Test extends Unit_Test_Case {
     ob_end_clean();
 
     $this->assert_equal(json_encode(array("result" => "success")), $results);
-    $this->assert_equal($new_dirname, $album->name);
+    $this->assert_equal($new_name, $album->name);
     $this->assert_equal("new title", $album->title);
     $this->assert_equal("new description", $album->description);
   }
-- 
cgit v1.2.3


From afe2128bb07938d47e98857b897d9d917062831d Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 19 Jan 2010 19:30:18 -0800
Subject: Make video/x-flv a valid movie mime_type

---
 modules/gallery/models/item.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php
index e2f7dc5e..036ad796 100644
--- a/modules/gallery/models/item.php
+++ b/modules/gallery/models/item.php
@@ -862,7 +862,7 @@ class Item_Model extends ORM_MPTT {
     switch($field) {
     case "mime_type":
       if ($this->is_movie()) {
-        $legal_values = array("video/flv", "video/mp4");
+        $legal_values = array("video/flv", "video/x-flv", "video/mp4");
       } if ($this->is_photo()) {
         $legal_values = array("image/jpeg", "image/gif", "image/png");
       }
-- 
cgit v1.2.3


From e02675b730fb814105e1cb9dceb0e25fdcbd3e27 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 19 Jan 2010 19:31:01 -0800
Subject: Change "filename" to "name" in the edit album form.  I'd rather have
 consistency between field names than deal with underlying issues with Forge
 bitching about the "name" property.

---
 modules/gallery/controllers/movies.php           | 5 +----
 modules/gallery/controllers/photos.php           | 5 +----
 modules/gallery/helpers/movie.php                | 2 +-
 modules/gallery/helpers/photo.php                | 2 +-
 modules/gallery/tests/Photos_Controller_Test.php | 4 ++--
 5 files changed, 6 insertions(+), 12 deletions(-)

diff --git a/modules/gallery/controllers/movies.php b/modules/gallery/controllers/movies.php
index 0908e281..b51282b3 100644
--- a/modules/gallery/controllers/movies.php
+++ b/modules/gallery/controllers/movies.php
@@ -66,14 +66,11 @@ class Movies_Controller extends Items_Controller {
       $movie->title = $form->edit_item->title->value;
       $movie->description = $form->edit_item->description->value;
       $movie->slug = $form->edit_item->slug->value;
-      $movie->name = $form->edit_item->filename->value;
+      $movie->name = $form->edit_item->inputs["name"]->value;
       $movie->validate();
     } catch (ORM_Validation_Exception $e) {
       // Translate ORM validation errors into form error messages
       foreach ($e->validation->errors() as $key => $error) {
-        if ($key == "name") {
-          $key = "filename";
-        }
         $form->edit_item->inputs[$key]->add_error($error, 1);
       }
       $valid = false;
diff --git a/modules/gallery/controllers/photos.php b/modules/gallery/controllers/photos.php
index 98f2126d..b5da3884 100644
--- a/modules/gallery/controllers/photos.php
+++ b/modules/gallery/controllers/photos.php
@@ -66,14 +66,11 @@ class Photos_Controller extends Items_Controller {
       $photo->title = $form->edit_item->title->value;
       $photo->description = $form->edit_item->description->value;
       $photo->slug = $form->edit_item->slug->value;
-      $photo->name = $form->edit_item->filename->value;
+      $photo->name = $form->edit_item->inputs["name"]->value;
       $photo->validate();
     } catch (ORM_Validation_Exception $e) {
       // Translate ORM validation errors into form error messages
       foreach ($e->validation->errors() as $key => $error) {
-        if ($key == "name") {
-          $key = "filename";
-        }
         $form->edit_item->inputs[$key]->add_error($error, 1);
       }
       $valid = false;
diff --git a/modules/gallery/helpers/movie.php b/modules/gallery/helpers/movie.php
index b2e846d3..b07a9e69 100644
--- a/modules/gallery/helpers/movie.php
+++ b/modules/gallery/helpers/movie.php
@@ -30,7 +30,7 @@ class movie_Core {
     $group = $form->group("edit_item")->label(t("Edit Movie"));
     $group->input("title")->label(t("Title"))->value($movie->title);
     $group->textarea("description")->label(t("Description"))->value($movie->description);
-    $group->input("filename")->label(t("Filename"))->value($movie->name)
+    $group->input("name")->label(t("Filename"))->value($movie->name)
       ->error_messages(
         "conflict", t("There is already a movie, photo or album with this name"))
       ->error_messages("no_slashes", t("The movie name can't contain a \"/\""))
diff --git a/modules/gallery/helpers/photo.php b/modules/gallery/helpers/photo.php
index cb94772e..9bd277bc 100644
--- a/modules/gallery/helpers/photo.php
+++ b/modules/gallery/helpers/photo.php
@@ -30,7 +30,7 @@ class photo_Core {
     $group = $form->group("edit_item")->label(t("Edit Photo"));
     $group->input("title")->label(t("Title"))->value($photo->title);
     $group->textarea("description")->label(t("Description"))->value($photo->description);
-    $group->input("filename")->label(t("Filename"))->value($photo->name)
+    $group->input("name")->label(t("Filename"))->value($photo->name)
       ->error_messages("conflict", t("There is already a movie, photo or album with this name"))
       ->error_messages("no_slashes", t("The photo name can't contain a \"/\""))
       ->error_messages("no_trailing_period", t("The photo name can't end in \".\""))
diff --git a/modules/gallery/tests/Photos_Controller_Test.php b/modules/gallery/tests/Photos_Controller_Test.php
index 31e0bc21..f548b40d 100644
--- a/modules/gallery/tests/Photos_Controller_Test.php
+++ b/modules/gallery/tests/Photos_Controller_Test.php
@@ -31,7 +31,7 @@ class Photos_Controller_Test extends Unit_Test_Case {
     $controller = new Photos_Controller();
     $photo = test::random_photo();
 
-    $_POST["filename"] = "new name.jpg";
+    $_POST["name"] = "new name.jpg";
     $_POST["title"] = "new title";
     $_POST["description"] = "new description";
     $_POST["slug"] = "new-slug";
@@ -55,7 +55,7 @@ class Photos_Controller_Test extends Unit_Test_Case {
     $controller = new Photos_Controller();
     $photo = test::random_photo();
 
-    $_POST["filename"] = "new name.jpg";
+    $_POST["name"] = "new name.jpg";
     $_POST["title"] = "new title";
     $_POST["description"] = "new description";
     $_POST["slug"] = "new slug";
-- 
cgit v1.2.3


From b8c09b6d872d00ad74d2f41d7699e12ee10bd361 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 19 Jan 2010 19:31:24 -0800
Subject: Use an appropriate json content type

---
 modules/rest/helpers/rest.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/rest/helpers/rest.php b/modules/rest/helpers/rest.php
index 93ad2bd3..27bafabd 100644
--- a/modules/rest/helpers/rest.php
+++ b/modules/rest/helpers/rest.php
@@ -22,6 +22,7 @@ class rest_Core {
     Session::abort_save();
 
     if ($data) {
+      header("Content-type: application/json");
       print json_encode($data);
     }
   }
-- 
cgit v1.2.3


From 6aee6cde2519b125a3b1209d3a6cd441b5d3c526 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 19 Jan 2010 20:53:21 -0800
Subject: Move data initialization into the constructor so that it happens
 before validate() is called, which is important with our two phase web
 controllers.

Make valid_parent smarter about moving existing items, vs new items.
---
 modules/gallery/models/item.php | 54 +++++++++++++++++++++++++----------------
 1 file changed, 33 insertions(+), 21 deletions(-)

diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php
index 036ad796..a7f73d0e 100644
--- a/modules/gallery/models/item.php
+++ b/modules/gallery/models/item.php
@@ -22,6 +22,21 @@ class Item_Model extends ORM_MPTT {
   protected $sorting = array();
   protected $data_file = null;
 
+  public function __construct($id=null) {
+    parent::__construct($id);
+
+    if (!$this->loaded()) {
+      // Set reasonable defaults
+      $this->created = time();
+      $this->rand_key = ((float)mt_rand()) / (float)mt_getrandmax();
+      $this->thumb_dirty = 1;
+      $this->resize_dirty = 1;
+      $this->sort_column = "created";
+      $this->sort_order = "ASC";
+      $this->owner_id = identity::active_user()->id;
+    }
+  }
+
   /**
    * Add a set of restrictions to any following queries to restrict access only to items
    * viewable by the active user.
@@ -298,20 +313,12 @@ class Item_Model extends ORM_MPTT {
     if (!empty($this->changed) && $significant_changes) {
       $this->updated = time();
       if (!$this->loaded()) {
-        // Create a new item.  Use whatever fields are set, and specify defaults for the rest.
-        $this->created = $this->updated;
-        $this->weight = item::get_max_weight();
-        $this->rand_key = ((float)mt_rand()) / (float)mt_getrandmax();
-        $this->thumb_dirty = 1;
-        $this->resize_dirty = 1;
-        if (empty($this->sort_column)) {
-          $this->sort_column = "created";
-        }
-        if (empty($this->sort_order)) {
-          $this->sort_order = "ASC";
-        }
-        if (empty($this->owner_id)) {
-          $this->owner_id = identity::active_user()->id;
+        // Create a new item.
+
+        // Set a weight if it's missing.  We don't do this in the constructor because it's not a
+        // simple assignment.
+        if (empty($this->weight)) {
+          $this->weight = item::get_max_weight();
         }
 
         // Make an url friendly slug from the name, if necessary
@@ -829,15 +836,20 @@ class Item_Model extends ORM_MPTT {
         $v->add_error("parent_id", "invalid");
       }
     } else {
-      if (db::build()
-          ->from("items")
-          ->where("id", "=", $this->parent_id)
-          ->where("type", "=", "album")
-          ->and_open()
+      $query = db::build()
+        ->from("items")
+        ->where("id", "=", $this->parent_id)
+        ->where("type", "=", "album");
+
+      // If this is an existing item, make sure the new parent is not part of our hierarchy
+      if ($this->loaded()) {
+        $query->and_open()
           ->where("left_ptr", "<", $this->left_ptr)
           ->or_where("right_ptr", ">", $this->right_ptr)
-          ->close()
-          ->count_records() != 1) {
+          ->close();
+      }
+
+      if ($query->count_records() != 1) {
         $v->add_error("parent_id", "invalid");
       }
     }
-- 
cgit v1.2.3


From e39c8df19fc0dadcfe65cb8a3ed6529648c6c9cf Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 19 Jan 2010 21:20:36 -0800
Subject: Fix some validation checks to check to see if the original was loaded
 before deciding whether or not we changed a value.

Change valid_name to be cascading, not parallel.
---
 modules/gallery/models/item.php           | 18 +++++-------------
 modules/gallery/tests/Item_Model_Test.php | 16 ++++++++++++++--
 2 files changed, 19 insertions(+), 15 deletions(-)

diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php
index a7f73d0e..58ff86ed 100644
--- a/modules/gallery/models/item.php
+++ b/modules/gallery/models/item.php
@@ -782,21 +782,15 @@ class Item_Model extends ORM_MPTT {
     if (strpos($this->name, "/") !== false) {
       $v->add_error("name", "no_slashes");
       return;
-    }
-
-    if (rtrim($this->name, ".") !== $this->name) {
+    } else if (rtrim($this->name, ".") !== $this->name) {
       $v->add_error("name", "no_trailing_period");
-      return;
-    }
-
-    if ($this->is_movie() || $this->is_photo()) {
-      if ($this->loaded()) {
+    } else if ($this->is_movie() || $this->is_photo()) {
+      if ($this->original()->loaded()) {
         // Existing items can't change their extension
         $new_ext = pathinfo($this->name, PATHINFO_EXTENSION);
         $old_ext = pathinfo($this->original()->name, PATHINFO_EXTENSION);
         if (strcasecmp($new_ext, $old_ext)) {
           $v->add_error("name", "illegal_data_file_extension");
-          return;
         }
       } else {
         // New items must have an extension
@@ -804,9 +798,7 @@ class Item_Model extends ORM_MPTT {
           $v->add_error("name", "illegal_data_file_extension");
         }
       }
-    }
-
-    if (db::build()
+    } else if (db::build()
         ->from("items")
         ->where("parent_id", "=", $this->parent_id)
         ->where("name", "=", $this->name)
@@ -908,7 +900,7 @@ class Item_Model extends ORM_MPTT {
    * This field cannot be changed after it's been set.
    */
   public function read_only(Validation $v, $field) {
-    if ($this->loaded() && $this->original()->$field != $this->$field) {
+    if ($this->original()->loaded() && $this->original()->$field != $this->$field) {
       $v->add_error($field, "read_only");
     }
   }
diff --git a/modules/gallery/tests/Item_Model_Test.php b/modules/gallery/tests/Item_Model_Test.php
index afb131fc..284491a0 100644
--- a/modules/gallery/tests/Item_Model_Test.php
+++ b/modules/gallery/tests/Item_Model_Test.php
@@ -320,9 +320,8 @@ class Item_Model_Test extends Unit_Test_Case {
   }
 
   public function slug_is_url_safe_test() {
-    $album = test::random_album_unsaved();
-
     try {
+      $album = test::random_album_unsaved();
       $album->slug = "illegal chars! !@#@#$!@~";
       $album->save();
       $this->assert_true(false, "Shouldn't be able to save");
@@ -334,4 +333,17 @@ class Item_Model_Test extends Unit_Test_Case {
     $album->slug = "the_quick_brown_fox";
     $album->save();
   }
+
+  public function cant_change_item_type_test() {
+    $photo = test::random_photo();
+    try {
+      $photo->type = "movie";
+      $photo->mime_type = "video/x-flv";
+      $photo->save();
+    } catch (ORM_Validation_Exception $e) {
+      $this->assert_same(array("type" => "read_only"), $e->validation->errors());
+      return;  // pass
+    }
+    $this->assert_true(false, "Shouldn't get here");
+  }
 }
-- 
cgit v1.2.3


From 409c4dcc47c2da39cc8465b6975196cde07840fb Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 19 Jan 2010 21:27:54 -0800
Subject: Do a better job of guarding against missing images.

---
 modules/image_block/helpers/image_block_block.php | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/modules/image_block/helpers/image_block_block.php b/modules/image_block/helpers/image_block_block.php
index f28e775f..185df850 100644
--- a/modules/image_block/helpers/image_block_block.php
+++ b/modules/image_block/helpers/image_block_block.php
@@ -26,14 +26,13 @@ class image_block_block_Core {
     $block = "";
     switch ($block_id) {
     case "random_image":
-      $block = new Block();
-      $block->css_id = "g-image-block";
-      $block->title = t("Random image");
-      $block->content = new View("image_block_block.html");
-      $block->content->items = item::random_query(array(array("type", "!=", "album")))->find_all(1);
-
-      if ($block->content->items->count() == 0) {
-        $block = "";
+      $item = item::random_query(array(array("type", "!=", "album")))->find_all(1)->current();
+      if ($item && $item->loaded()) {
+        $block = new Block();
+        $block->css_id = "g-image-block";
+        $block->title = t("Random image");
+        $block->content = new View("image_block_block.html");
+        $block->content->item = $item;
       }
       break;
     }
-- 
cgit v1.2.3


From fc4250f5d899dadcfd0dfce6076e66cfaff68941 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 19 Jan 2010 22:37:38 -0800
Subject: Use $input instead of Input::instance()

---
 modules/rest/controllers/rest.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/rest/controllers/rest.php b/modules/rest/controllers/rest.php
index a3e7313c..a932a285 100644
--- a/modules/rest/controllers/rest.php
+++ b/modules/rest/controllers/rest.php
@@ -47,11 +47,11 @@ class Rest_Controller extends Controller {
     $input = Input::instance();
     switch ($method = strtolower($input->server("REQUEST_METHOD"))) {
     case "get":
-      $request->params = (object) Input::instance()->get();
+      $request->params = (object) $input->get();
       break;
 
     case "post":
-      $request->params = (object) Input::instance()->post();
+      $request->params = (object) $input->post();
       if (isset($_FILES["file"])) {
         $request->file = upload::save("file");
       }
-- 
cgit v1.2.3


From a774dc5447a1d90cd5c361e9196ab41fd91f92cf Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 19 Jan 2010 22:38:03 -0800
Subject: Don't send headers if they're already sent.

---
 modules/rest/helpers/rest.php | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/modules/rest/helpers/rest.php b/modules/rest/helpers/rest.php
index 27bafabd..76ecef23 100644
--- a/modules/rest/helpers/rest.php
+++ b/modules/rest/helpers/rest.php
@@ -50,7 +50,9 @@ class rest_Core {
   }
 
   static function send_headers($exception) {
-    header("HTTP/1.1 " . $exception->getCode() . " " . $exception->getMessage());
+    if (!headers_sent()) {
+      header("HTTP/1.1 " . $exception->getCode() . " " . $exception->getMessage());
+    }
   }
 
   /**
-- 
cgit v1.2.3


From 76da85a1a08cdf065bf186c81ea444d03d6f8935 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 19 Jan 2010 22:38:19 -0800
Subject: Extend Gallery_Unit_Test_Case instead of Unit_Test_Case.

---
 modules/akismet/tests/Akismet_Helper_Test.php     |   2 +-
 modules/comment/tests/Comment_Event_Test.php      |   2 +-
 modules/comment/tests/Comment_Helper_Test.php     |   2 +-
 modules/comment/tests/Comment_Model_Test.php      |   2 +-
 modules/digibug/tests/Digibug_Controller_Test.php |   2 +-
 modules/exif/tests/Exif_Test.php                  |   2 +-
 modules/gallery/tests/Access_Helper_Test.php      |   2 +-
 modules/gallery/tests/Albums_Controller_Test.php  |   2 +-
 modules/gallery/tests/Cache_Test.php              |   2 +-
 modules/gallery/tests/Controller_Auth_Test.php    |   2 +-
 modules/gallery/tests/Database_Test.php           |   2 +-
 modules/gallery/tests/Dir_Helper_Test.php         |   2 +-
 modules/gallery/tests/DrawForm_Test.php           |   2 +-
 modules/gallery/tests/File_Structure_Test.php     |   2 +-
 modules/gallery/tests/Gallery_I18n_Test.php       |   2 +-
 modules/gallery/tests/Gallery_Installer_Test.php  |   2 +-
 modules/gallery/tests/Html_Helper_Test.php        |   2 +-
 modules/gallery/tests/Item_Helper_Test.php        |   2 +-
 modules/gallery/tests/Item_Model_Test.php         |   2 +-
 modules/gallery/tests/Locales_Helper_Test.php     |   2 +-
 modules/gallery/tests/Menu_Test.php               |   2 +-
 modules/gallery/tests/ORM_MPTT_Test.php           |   2 +-
 modules/gallery/tests/Photos_Controller_Test.php  |   2 +-
 modules/gallery/tests/SafeString_Test.php         |   2 +-
 modules/gallery/tests/Sendmail_Test.php           |   2 +-
 modules/gallery/tests/Url_Security_Test.php       |   2 +-
 modules/gallery/tests/Var_Test.php                |   2 +-
 modules/gallery/tests/Xss_Security_Test.php       |   2 +-
 modules/gallery_unit_test/helpers/test.php        |  11 ++
 modules/rest/tests/Rest_Controller_Test.php       | 142 ++++------------------
 modules/tag/tests/Tag_Rest_Helper_Test.php        |   2 +-
 modules/tag/tests/Tag_Test.php                    |   2 +-
 modules/user/tests/No_Direct_ORM_Access_Test.php  |   2 +-
 modules/user/tests/User_Groups_Test.php           |   2 +-
 modules/user/tests/User_Installer_Test.php        |   2 +-
 35 files changed, 68 insertions(+), 151 deletions(-)

diff --git a/modules/akismet/tests/Akismet_Helper_Test.php b/modules/akismet/tests/Akismet_Helper_Test.php
index b32e9a02..e185f280 100644
--- a/modules/akismet/tests/Akismet_Helper_Test.php
+++ b/modules/akismet/tests/Akismet_Helper_Test.php
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class Akismet_Helper_Test extends Unit_Test_Case {
+class Akismet_Helper_Test extends Gallery_Unit_Test_Case {
   private $_comment;
 
   public function setup() {
diff --git a/modules/comment/tests/Comment_Event_Test.php b/modules/comment/tests/Comment_Event_Test.php
index 5b7daef4..27272055 100644
--- a/modules/comment/tests/Comment_Event_Test.php
+++ b/modules/comment/tests/Comment_Event_Test.php
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class Comment_Event_Test extends Unit_Test_Case {
+class Comment_Event_Test extends Gallery_Unit_Test_Case {
   public function deleting_an_item_deletes_its_comments_too_test() {
     $album = test::random_album();
 
diff --git a/modules/comment/tests/Comment_Helper_Test.php b/modules/comment/tests/Comment_Helper_Test.php
index d780aba6..7ba024c7 100644
--- a/modules/comment/tests/Comment_Helper_Test.php
+++ b/modules/comment/tests/Comment_Helper_Test.php
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class Comment_Helper_Test extends Unit_Test_Case {
+class Comment_Helper_Test extends Gallery_Unit_Test_Case {
   private $_ip_address;
   private $_user_agent;
 
diff --git a/modules/comment/tests/Comment_Model_Test.php b/modules/comment/tests/Comment_Model_Test.php
index c98eb63c..f0449c05 100644
--- a/modules/comment/tests/Comment_Model_Test.php
+++ b/modules/comment/tests/Comment_Model_Test.php
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class Comment_Model_Test extends Unit_Test_Case {
+class Comment_Model_Test extends Gallery_Unit_Test_Case {
 
   public function cant_view_comments_for_unviewable_items_test() {
     $album = test::random_album();
diff --git a/modules/digibug/tests/Digibug_Controller_Test.php b/modules/digibug/tests/Digibug_Controller_Test.php
index 38dcd8e9..561dd3c9 100644
--- a/modules/digibug/tests/Digibug_Controller_Test.php
+++ b/modules/digibug/tests/Digibug_Controller_Test.php
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class Digibug_Controller_Test extends Unit_Test_Case {
+class Digibug_Controller_Test extends Gallery_Unit_Test_Case {
   private $_server;
 
   public function setup() {
diff --git a/modules/exif/tests/Exif_Test.php b/modules/exif/tests/Exif_Test.php
index 191bdb99..e4835b7f 100644
--- a/modules/exif/tests/Exif_Test.php
+++ b/modules/exif/tests/Exif_Test.php
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class Exif_Test extends Unit_Test_Case {
+class Exif_Test extends Gallery_Unit_Test_Case {
   public function exif_extract_test() {
     $photo = test::random_photo_unsaved()
       ->set_data_file(MODPATH . "exif/tests/data/image.jpg")
diff --git a/modules/gallery/tests/Access_Helper_Test.php b/modules/gallery/tests/Access_Helper_Test.php
index da72f12f..7ddd2875 100644
--- a/modules/gallery/tests/Access_Helper_Test.php
+++ b/modules/gallery/tests/Access_Helper_Test.php
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class Access_Helper_Test extends Unit_Test_Case {
+class Access_Helper_Test extends Gallery_Unit_Test_Case {
   private $_group;
 
   public function teardown() {
diff --git a/modules/gallery/tests/Albums_Controller_Test.php b/modules/gallery/tests/Albums_Controller_Test.php
index 26dc2571..76c9a628 100644
--- a/modules/gallery/tests/Albums_Controller_Test.php
+++ b/modules/gallery/tests/Albums_Controller_Test.php
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class Albums_Controller_Test extends Unit_Test_Case {
+class Albums_Controller_Test extends Gallery_Unit_Test_Case {
   public function setup() {
     $this->_save = array($_POST, $_SERVER);
   }
diff --git a/modules/gallery/tests/Cache_Test.php b/modules/gallery/tests/Cache_Test.php
index d5bf37cc..1023568b 100644
--- a/modules/gallery/tests/Cache_Test.php
+++ b/modules/gallery/tests/Cache_Test.php
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class Cache_Test extends Unit_Test_Case {
+class Cache_Test extends Gallery_Unit_Test_Case {
   private $_driver;
   public function setup() {
     db::build()->delete("caches")->execute();
diff --git a/modules/gallery/tests/Controller_Auth_Test.php b/modules/gallery/tests/Controller_Auth_Test.php
index 124d8b4c..c27196da 100644
--- a/modules/gallery/tests/Controller_Auth_Test.php
+++ b/modules/gallery/tests/Controller_Auth_Test.php
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class Controller_Auth_Test extends Unit_Test_Case {
+class Controller_Auth_Test extends Gallery_Unit_Test_Case {
   public function find_missing_auth_test() {
     $found = array();
     $controllers = explode("\n", `git ls-files '*/*/controllers/*.php'`);
diff --git a/modules/gallery/tests/Database_Test.php b/modules/gallery/tests/Database_Test.php
index 6aa186e5..e58f73eb 100644
--- a/modules/gallery/tests/Database_Test.php
+++ b/modules/gallery/tests/Database_Test.php
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class Database_Test extends Unit_Test_Case {
+class Database_Test extends Gallery_Unit_Test_Case {
   function setup() {
     $config = Kohana_Config::instance();
     $config->set("database.mock.connection.type", "mock");
diff --git a/modules/gallery/tests/Dir_Helper_Test.php b/modules/gallery/tests/Dir_Helper_Test.php
index 46bb871c..69241447 100644
--- a/modules/gallery/tests/Dir_Helper_Test.php
+++ b/modules/gallery/tests/Dir_Helper_Test.php
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class Dir_Helper_Test extends Unit_Test_Case {
+class Dir_Helper_Test extends Gallery_Unit_Test_Case {
   public function remove_album_test() {
     $dirname = (VARPATH . "albums/testdir");
     mkdir($dirname, 0777, true);
diff --git a/modules/gallery/tests/DrawForm_Test.php b/modules/gallery/tests/DrawForm_Test.php
index da8a6b04..f7b727c0 100644
--- a/modules/gallery/tests/DrawForm_Test.php
+++ b/modules/gallery/tests/DrawForm_Test.php
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class DrawForm_Test extends Unit_Test_Case {
+class DrawForm_Test extends Gallery_Unit_Test_Case {
   function no_group_test() {
     $form = new Forge("test/controller", "", "post", array("id" => "g-test-group-form"));
     $form->input("title")->label(t("Title"));
diff --git a/modules/gallery/tests/File_Structure_Test.php b/modules/gallery/tests/File_Structure_Test.php
index b5026188..bffdf361 100644
--- a/modules/gallery/tests/File_Structure_Test.php
+++ b/modules/gallery/tests/File_Structure_Test.php
@@ -19,7 +19,7 @@
  */
 require_once(MODPATH . "gallery/tests/Gallery_Filters.php");
 
-class File_Structure_Test extends Unit_Test_Case {
+class File_Structure_Test extends Gallery_Unit_Test_Case {
   public function no_trailing_closing_php_tag_test() {
     $dir = new GalleryCodeFilterIterator(
       new RecursiveIteratorIterator(new RecursiveDirectoryIterator(DOCROOT)));
diff --git a/modules/gallery/tests/Gallery_I18n_Test.php b/modules/gallery/tests/Gallery_I18n_Test.php
index 5d2fd994..f6e50d71 100644
--- a/modules/gallery/tests/Gallery_I18n_Test.php
+++ b/modules/gallery/tests/Gallery_I18n_Test.php
@@ -18,7 +18,7 @@
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
 
-class Gallery_I18n_Test extends Unit_Test_Case {
+class Gallery_I18n_Test extends Gallery_Unit_Test_Case {
   private $i18n;
 
   public function setup() {
diff --git a/modules/gallery/tests/Gallery_Installer_Test.php b/modules/gallery/tests/Gallery_Installer_Test.php
index 74a07b1a..3db434bc 100644
--- a/modules/gallery/tests/Gallery_Installer_Test.php
+++ b/modules/gallery/tests/Gallery_Installer_Test.php
@@ -22,7 +22,7 @@
  * This test case operates under the assumption that gallery_installer::install() is called by the
  * test controller before it starts.
  */
-class Gallery_Installer_Test extends Unit_Test_Case {
+class Gallery_Installer_Test extends Gallery_Unit_Test_Case {
   public function install_creates_dirs_test() {
     $this->assert_true(file_exists(VARPATH . "albums"));
     $this->assert_true(file_exists(VARPATH . "resizes"));
diff --git a/modules/gallery/tests/Html_Helper_Test.php b/modules/gallery/tests/Html_Helper_Test.php
index 1662b866..be318632 100644
--- a/modules/gallery/tests/Html_Helper_Test.php
+++ b/modules/gallery/tests/Html_Helper_Test.php
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class Html_Helper_Test extends Unit_Test_Case {
+class Html_Helper_Test extends Gallery_Unit_Test_Case {
   public function clean_test() {
     $safe_string = html::clean("hello <p  >world</p>");
     $this->assert_equal("hello &lt;p  &gt;world&lt;/p&gt;",
diff --git a/modules/gallery/tests/Item_Helper_Test.php b/modules/gallery/tests/Item_Helper_Test.php
index b3896c7a..5fa8d6b1 100644
--- a/modules/gallery/tests/Item_Helper_Test.php
+++ b/modules/gallery/tests/Item_Helper_Test.php
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class Item_Helper_Test extends Unit_Test_Case {
+class Item_Helper_Test extends Gallery_Unit_Test_Case {
 
   public function viewable_test() {
     $album = test::random_album();
diff --git a/modules/gallery/tests/Item_Model_Test.php b/modules/gallery/tests/Item_Model_Test.php
index 284491a0..9ea74b16 100644
--- a/modules/gallery/tests/Item_Model_Test.php
+++ b/modules/gallery/tests/Item_Model_Test.php
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class Item_Model_Test extends Unit_Test_Case {
+class Item_Model_Test extends Gallery_Unit_Test_Case {
   public function saving_sets_created_and_updated_dates_test() {
     $item = test::random_photo();
     $this->assert_true(!empty($item->created));
diff --git a/modules/gallery/tests/Locales_Helper_Test.php b/modules/gallery/tests/Locales_Helper_Test.php
index 4c03d8d4..a2680928 100644
--- a/modules/gallery/tests/Locales_Helper_Test.php
+++ b/modules/gallery/tests/Locales_Helper_Test.php
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class Locales_Helper_Test extends Unit_Test_Case {
+class Locales_Helper_Test extends Gallery_Unit_Test_Case {
   static $installed_locales;
   static $default_locale;
 
diff --git a/modules/gallery/tests/Menu_Test.php b/modules/gallery/tests/Menu_Test.php
index c91aee0b..643aa727 100644
--- a/modules/gallery/tests/Menu_Test.php
+++ b/modules/gallery/tests/Menu_Test.php
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class Menu_Test extends Unit_Test_Case {
+class Menu_Test extends Gallery_Unit_Test_Case {
   public function find_menu_item_test() {
     $menu = new Menu(true);
     $menu
diff --git a/modules/gallery/tests/ORM_MPTT_Test.php b/modules/gallery/tests/ORM_MPTT_Test.php
index 30adf2a0..1ffe1c57 100644
--- a/modules/gallery/tests/ORM_MPTT_Test.php
+++ b/modules/gallery/tests/ORM_MPTT_Test.php
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class ORM_MPTT_Test extends Unit_Test_Case {
+class ORM_MPTT_Test extends Gallery_Unit_Test_Case {
 
   public function add_to_parent_test() {
     $album = test::random_album();
diff --git a/modules/gallery/tests/Photos_Controller_Test.php b/modules/gallery/tests/Photos_Controller_Test.php
index f548b40d..6012ed1c 100644
--- a/modules/gallery/tests/Photos_Controller_Test.php
+++ b/modules/gallery/tests/Photos_Controller_Test.php
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class Photos_Controller_Test extends Unit_Test_Case {
+class Photos_Controller_Test extends Gallery_Unit_Test_Case {
   public function setup() {
     $this->_save = array($_POST, $_SERVER);
     $_SERVER["HTTP_REFERER"] = "HTTP_REFERER";
diff --git a/modules/gallery/tests/SafeString_Test.php b/modules/gallery/tests/SafeString_Test.php
index 2c07d934..7002a874 100644
--- a/modules/gallery/tests/SafeString_Test.php
+++ b/modules/gallery/tests/SafeString_Test.php
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class SafeString_Test extends Unit_Test_Case {
+class SafeString_Test extends Gallery_Unit_Test_Case {
   public function toString_escapes_for_html_test() {
     $safe_string = new SafeString("hello <p>world</p>");
     $this->assert_equal("hello &lt;p&gt;world&lt;/p&gt;",
diff --git a/modules/gallery/tests/Sendmail_Test.php b/modules/gallery/tests/Sendmail_Test.php
index f3a8d897..bc57e434 100644
--- a/modules/gallery/tests/Sendmail_Test.php
+++ b/modules/gallery/tests/Sendmail_Test.php
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class Sendmail_Test extends Unit_Test_Case {
+class Sendmail_Test extends Gallery_Unit_Test_Case {
   public function setup() {
     Kohana_Config::instance()->set("sendmail.from", "from@gallery3.com");
   }
diff --git a/modules/gallery/tests/Url_Security_Test.php b/modules/gallery/tests/Url_Security_Test.php
index de25880f..255b3909 100644
--- a/modules/gallery/tests/Url_Security_Test.php
+++ b/modules/gallery/tests/Url_Security_Test.php
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class Url_Security_Test extends Unit_Test_Case {
+class Url_Security_Test extends Gallery_Unit_Test_Case {
   public function setup() {
     $this->save = array(Router::$current_uri, Router::$complete_uri, $_GET);
   }
diff --git a/modules/gallery/tests/Var_Test.php b/modules/gallery/tests/Var_Test.php
index 355d94a7..fb19da7a 100644
--- a/modules/gallery/tests/Var_Test.php
+++ b/modules/gallery/tests/Var_Test.php
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class Var_Test extends Unit_Test_Case {
+class Var_Test extends Gallery_Unit_Test_Case {
   public function add_parameter_test() {
     module::set_var("gallery", "Parameter", "original value");
     $this->assert_equal("original value", module::get_var("gallery", "Parameter"));
diff --git a/modules/gallery/tests/Xss_Security_Test.php b/modules/gallery/tests/Xss_Security_Test.php
index b296d97c..a39a069d 100644
--- a/modules/gallery/tests/Xss_Security_Test.php
+++ b/modules/gallery/tests/Xss_Security_Test.php
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class Xss_Security_Test extends Unit_Test_Case {
+class Xss_Security_Test extends Gallery_Unit_Test_Case {
   public function find_unescaped_variables_in_views_test() {
     $found = array();
     foreach (glob("*/*/views/*.php") as $view) {
diff --git a/modules/gallery_unit_test/helpers/test.php b/modules/gallery_unit_test/helpers/test.php
index 77948465..8e483c60 100644
--- a/modules/gallery_unit_test/helpers/test.php
+++ b/modules/gallery_unit_test/helpers/test.php
@@ -48,6 +48,11 @@ class test_Core {
     return test::random_photo_unsaved($parent)->save();
   }
 
+  static function random_user($password="password") {
+    $rand = "name_" . rand();
+    return identity::create_user($rand, $rand, $password, "$rand@rand.com");
+  }
+
   static function random_name($item=null) {
     $rand = "name_" . rand();
     if ($item && $item->is_photo()) {
@@ -59,4 +64,10 @@ class test_Core {
   static function starts_with($outer, $inner) {
     return strpos($outer, $inner) === 0;
   }
+
+  static function call_and_capture($callback) {
+    ob_start();
+    call_user_func($callback);
+    return ob_get_clean();
+  }
 }
diff --git a/modules/rest/tests/Rest_Controller_Test.php b/modules/rest/tests/Rest_Controller_Test.php
index c881583c..ae5e6d48 100644
--- a/modules/rest/tests/Rest_Controller_Test.php
+++ b/modules/rest/tests/Rest_Controller_Test.php
@@ -17,108 +17,43 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class Rest_Controller_Test extends Unit_Test_Case {
+class Rest_Controller_Test extends Gallery_Unit_Test_Case {
   public function setup() {
     $this->_save = array($_GET, $_POST, $_SERVER);
   }
 
-  private function _create_user() {
-    if (empty($this->_user)) {
-      $this->_user = identity::create_user("access_test" . rand(), "Access Test", "password");
-      $this->_key = ORM::factory("user_access_token");
-      $this->_key->access_key = md5($this->_user->name . rand());
-      $this->_key->user_id = $this->_user->id;
-      $this->_key->save();
-      identity::set_active_user($this->_user);
-    }
-    return array($this->_key->access_key, $this->_user);
-  }
-
   public function teardown() {
     list($_GET, $_POST, $_SERVER) = $this->_save;
-    if (!empty($this->_user)) {
-      try {
-        $this->_user->delete();
-      } catch (Exception $e) { }
-    }
-  }
-
-  private function _create_image($parent=null) {
-    $filename = MODPATH . "gallery/tests/test.jpg";
-    $image_name = "image_" . rand();
-    if (empty($parent)) {
-      $parent = ORM::factory("item", 1);
-    }
-    return photo::create($parent, $filename, "$image_name.jpg", $image_name);
-  }
-
-  public function rest_access_key_exists_test() {
-    list ($access_key, $user) = $this->_create_user();
-    $_SERVER["REQUEST_METHOD"] = "GET";
-    $_GET["user"] = $user->name;;
-    $_GET["password"] = "password";
-
-    $this->assert_equal(
-      json_encode(array("status" => "OK", "token" => $access_key)),
-      $this->_call_controller());
   }
 
-  public function rest_access_key_generated_test() {
-    list ($access_key, $user) = $this->_create_user();
-    ORM::factory("user_access_token")
-      ->where("access_key", $access_key)
-      ->delete();
-    $_SERVER["REQUEST_METHOD"] = "GET";
-    $_GET["user"] = $user->name;
-    $_GET["password"] = "password";
+  public function login_test() {
+    $user = test::random_user("password");
 
-    $results = json_decode($this->_call_controller());
-
-    $this->assert_equal("OK", $results->status);
-    $this->assert_false(empty($results->token));
-  }
+    // There's no access key at first
+    $this->assert_false(
+      ORM::factory("user_access_token")->where("user_id", "=", $user->id)->find()->loaded());
 
-  public function rest_access_key_no_parameters_test() {
-    $_SERVER["REQUEST_METHOD"] = "GET";
-
-    try {
-      $this->_call_controller();
-    } catch (Rest_Exception $e) {
-      $this->assert_equal(403, $e->getCode());
-      $this->assert_equal("Forbidden", $e->getMessage());
-    } catch (Exception $e) {
-      $this->assert_false(true, $e->__toString());
-    }
-  }
+    $_POST["user"] = $user->name;
+    $_POST["password"] = "password";
 
-  public function rest_access_key_user_not_found_test() {
-    $_SERVER["REQUEST_METHOD"] = "POST";
-    $_POST["request"] = json_encode(array("user" => "access_test2", "password" => "password"));
+    $response = test::call_and_capture(array(new Rest_Controller(), "index"));
+    $expected =
+      ORM::factory("user_access_token")->where("user_id", "=", $user->id)->find()->access_key;
 
-    try {
-      $this->_call_controller();
-    } catch (Rest_Exception $e) {
-      $this->assert_equal(403, $e->getCode());
-      $this->assert_equal("Forbidden", $e->getMessage());
-    } catch (Exception $e) {
-      $this->assert_false(true, $e->__toString());
-    }
+    // Now there is an access key, and it was returned
+    $this->assert_equal(json_encode($expected), $response);
   }
 
-  public function rest_access_key_invalid_password_test() {
-    $_SERVER["REQUEST_METHOD"] = "POST";
+  public function login_failed_test() {
+    $user = test::random_user("password");
+    $_POST["user"] = $user->name;
+    $_POST["password"] = "WRONG PASSWORD";
 
-    try {
-      $this->_call_controller();
-    } catch (Rest_Exception $e) {
-      $this->assert_equal(403, $e->getCode());
-      $this->assert_equal("Forbidden", $e->getMessage());
-    } catch (Exception $e) {
-      $this->assert_false(true, $e->__toString());
-    }
+    // @todo check the http response code
+    $this->assert_equal(null, test::call_and_capture(array(new Rest_Controller(), "index")));
   }
 
-  public function rest_get_resource_no_request_key_test() {
+  public function rest_get_resource_no_request_key_test_() {
     $_SERVER["REQUEST_METHOD"] = "GET";
     $photo = $this->_create_image();
 
@@ -132,7 +67,7 @@ class Rest_Controller_Test extends Unit_Test_Case {
       $this->_call_controller("rest", explode("/", $photo->relative_url())));
   }
 
-  public function rest_get_resource_invalid_key_test() {
+  public function rest_get_resource_invalid_key_test_() {
     list ($access_key, $user) = $this->_create_user();
     $_SERVER["HTTP_X_GALLERY_REQUEST_KEY"] = md5($access_key); // screw up the access key;
     $_SERVER["REQUEST_METHOD"] = "GET";
@@ -147,7 +82,7 @@ class Rest_Controller_Test extends Unit_Test_Case {
     }
   }
 
-  public function rest_get_resource_no_user_for_key_test() {
+  public function rest_get_resource_no_user_for_key_test_() {
     list ($access_key, $user) = $this->_create_user();
     $_SERVER["REQUEST_METHOD"] = "GET";
     $_SERVER["HTTP_X_GALLERY_REQUEST_KEY"] = $access_key;
@@ -166,7 +101,7 @@ class Rest_Controller_Test extends Unit_Test_Case {
     }
   }
 
-  public function rest_get_resource_no_handler_test() {
+  public function rest_get_resource_no_handler_test_() {
     list ($access_key, $user) = $this->_create_user();
     $_SERVER["REQUEST_METHOD"] = "GET";
     $_SERVER["HTTP_X_GALLERY_REQUEST_KEY"] = $access_key;
@@ -183,7 +118,7 @@ class Rest_Controller_Test extends Unit_Test_Case {
     }
   }
 
-  public function rest_get_resource_test() {
+  public function rest_get_resource_test_() {
     list ($access_key, $user) = $this->_create_user();
     $_SERVER["REQUEST_METHOD"] = "GET";
     $_SERVER["HTTP_X_GALLERY_REQUEST_KEY"] = $access_key;
@@ -198,33 +133,4 @@ class Rest_Controller_Test extends Unit_Test_Case {
                                         "internet_address" => $photo->slug))),
       $this->_call_controller("rest", explode("/", $photo->relative_url())));
   }
-
-  private function _call_controller($method="access_key", $arg=null) {
-    $controller = new Rest_Controller();
-
-    ob_start();
-    call_user_func_array(array($controller, $method), $arg);
-    $results = ob_get_contents();
-    ob_end_clean();
-
-    return $results;
-  }
-}
-
-class rest_rest {
-  static $request = null;
-
-  static function get($request) {
-    self::$request = $request;
-    $item = ORM::factory("item")
-      ->where("relative_url_cache", "=", implode("/", $request->arguments))
-      ->find();
-    $response["path"] = $item->relative_url();
-    $response["title"] = $item->title;
-    $response["thumb_url"] = $item->thumb_url();
-    $response["description"] = $item->description;
-    $response["internet_address"] = $item->slug;
-    return rest::reply(array($item->type => $response));
-  }
-
 }
diff --git a/modules/tag/tests/Tag_Rest_Helper_Test.php b/modules/tag/tests/Tag_Rest_Helper_Test.php
index 555539fd..c2d55ba4 100644
--- a/modules/tag/tests/Tag_Rest_Helper_Test.php
+++ b/modules/tag/tests/Tag_Rest_Helper_Test.php
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class Tag_Rest_Helper_Test extends Unit_Test_Case {
+class Tag_Rest_Helper_Test extends Gallery_Unit_Test_Case {
   public function setup() {
     try {
       Database::instance()->query("TRUNCATE {tags}");
diff --git a/modules/tag/tests/Tag_Test.php b/modules/tag/tests/Tag_Test.php
index c96e7f2b..c3243145 100644
--- a/modules/tag/tests/Tag_Test.php
+++ b/modules/tag/tests/Tag_Test.php
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class Tag_Test extends Unit_Test_Case {
+class Tag_Test extends Gallery_Unit_Test_Case {
   public function create_tag_test() {
     $rand = rand();
     $root = ORM::factory("item", 1);
diff --git a/modules/user/tests/No_Direct_ORM_Access_Test.php b/modules/user/tests/No_Direct_ORM_Access_Test.php
index 440321fa..c372258e 100644
--- a/modules/user/tests/No_Direct_ORM_Access_Test.php
+++ b/modules/user/tests/No_Direct_ORM_Access_Test.php
@@ -19,7 +19,7 @@
  */
 require_once(MODPATH . "gallery/tests/Gallery_Filters.php");
 
-class No_Direct_ORM_Access_Test extends Unit_Test_Case {
+class No_Direct_ORM_Access_Test extends Gallery_Unit_Test_Case {
   public function no_access_to_users_table_test() {
     $dir = new UserModuleFilterIterator(
       new PhpCodeFilterIterator(
diff --git a/modules/user/tests/User_Groups_Test.php b/modules/user/tests/User_Groups_Test.php
index 163b7d79..089ab9a6 100644
--- a/modules/user/tests/User_Groups_Test.php
+++ b/modules/user/tests/User_Groups_Test.php
@@ -18,7 +18,7 @@
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
 
-class User_Groups_Test extends Unit_Test_Case {
+class User_Groups_Test extends Gallery_Unit_Test_Case {
   public function teardown() {
     try {
       $group = ORM::factory("group")->where("name", "=", "user_groups_test")->find();
diff --git a/modules/user/tests/User_Installer_Test.php b/modules/user/tests/User_Installer_Test.php
index 12a10eda..b3c5960a 100644
--- a/modules/user/tests/User_Installer_Test.php
+++ b/modules/user/tests/User_Installer_Test.php
@@ -22,7 +22,7 @@
  * This test case operates under the assumption that user_installer::install() is called by the
  * test controller before it starts.
  */
-class User_Installer_Test extends Unit_Test_Case {
+class User_Installer_Test extends Gallery_Unit_Test_Case {
   public function install_creates_admin_user_test() {
     $user = ORM::factory("user", 1);
     $this->assert_equal("guest", $user->name);
-- 
cgit v1.2.3


From 92d96548e9b365cfa8e888a2103ab09e9f45914a Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 19 Jan 2010 23:28:18 -0800
Subject: Make Rest_Exception extend Kohana_Exception so that we can let it
 bubble to the top and then in sendHeaders have it send the right response
 code.

---
 modules/rest/libraries/Rest_Exception.php | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/modules/rest/libraries/Rest_Exception.php b/modules/rest/libraries/Rest_Exception.php
index 596b3712..c3548b7e 100644
--- a/modules/rest/libraries/Rest_Exception.php
+++ b/modules/rest/libraries/Rest_Exception.php
@@ -17,5 +17,14 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class Rest_Exception_Core extends Exception {
+class Rest_Exception_Core extends Kohana_Exception {
+  public function __construct($message, $code) {
+    parent::__construct($message, null, $code);
+  }
+
+  public function sendHeaders() {
+    if (!headers_sent()) {
+      header("HTTP/1.1 " . $this->getCode() . " " . $this->getMessage());
+    }
+  }
 }
\ No newline at end of file
-- 
cgit v1.2.3


From c65eca0607572b49ec59a7c387c4b93d15561adb Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 19 Jan 2010 23:30:09 -0800
Subject: Move rest::send_headers back into Rest_Exception.

---
 modules/rest/helpers/rest.php | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/modules/rest/helpers/rest.php b/modules/rest/helpers/rest.php
index 76ecef23..fccb365e 100644
--- a/modules/rest/helpers/rest.php
+++ b/modules/rest/helpers/rest.php
@@ -49,12 +49,6 @@ class rest_Core {
     identity::set_active_user($user);
   }
 
-  static function send_headers($exception) {
-    if (!headers_sent()) {
-      header("HTTP/1.1 " . $exception->getCode() . " " . $exception->getMessage());
-    }
-  }
-
   /**
    * Convert a REST url into an object.
    * Eg: "http://example.com/gallery3/index.php/rest/gallery/Family/Wedding" -> Item_Model
-- 
cgit v1.2.3


From b09450cf5d864338b5fbc246fd722f841b32e254 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 19 Jan 2010 23:30:22 -0800
Subject: Let the Rest_Controller functions throw a Rest_Exception since the
 Kohana framework will handle it properly.

---
 modules/rest/controllers/rest.php           | 62 +++++++++++++----------------
 modules/rest/tests/Rest_Controller_Test.php | 14 +++++--
 2 files changed, 37 insertions(+), 39 deletions(-)

diff --git a/modules/rest/controllers/rest.php b/modules/rest/controllers/rest.php
index a932a285..a6b618e8 100644
--- a/modules/rest/controllers/rest.php
+++ b/modules/rest/controllers/rest.php
@@ -19,28 +19,24 @@
  */
 class Rest_Controller extends Controller {
   public function index() {
-    try {
-      $username = Input::instance()->post("user");
-      $password = Input::instance()->post("password");
-
-      $user = identity::lookup_user_by_name($username);
-      if (empty($user) || !identity::is_correct_password($user, $password)) {
-        throw new Rest_Exception("Forbidden", 403);
-      }
+    $username = Input::instance()->post("user");
+    $password = Input::instance()->post("password");
 
-      $key = ORM::factory("user_access_token")
-        ->where("user_id", "=", $user->id)
-        ->find();
-      if (!$key->loaded()) {
-        $key->user_id = $user->id;
-        $key->access_key = md5($user->name . rand());
-        $key->save();
-      }
+    $user = identity::lookup_user_by_name($username);
+    if (empty($user) || !identity::is_correct_password($user, $password)) {
+      throw new Rest_Exception("Forbidden", 403);
+    }
 
-      rest::reply($key->access_key);
-    } catch (Exception $e) {
-      rest::send_headers($e);
+    $key = ORM::factory("user_access_token")
+      ->where("user_id", "=", $user->id)
+      ->find();
+    if (!$key->loaded()) {
+      $key->user_id = $user->id;
+      $key->access_key = md5($user->name . rand());
+      $key->save();
     }
+
+    rest::reply($key->access_key);
  }
 
   public function __call($function, $args) {
@@ -62,26 +58,22 @@ class Rest_Controller extends Controller {
     $request->access_token = $input->server("HTTP_X_GALLERY_REQUEST_KEY");
     $request->url = url::abs_current(true);
 
-    try {
-      rest::set_active_user($request->access_token);
+    rest::set_active_user($request->access_token);
 
-      $handler_class = "{$function}_rest";
-      $handler_method = $request->method;
+    $handler_class = "{$function}_rest";
+    $handler_method = $request->method;
 
-      if (!method_exists($handler_class, $handler_method)) {
-        throw new Rest_Exception("Forbidden", 403);
-      }
+    if (!method_exists($handler_class, $handler_method)) {
+      throw new Rest_Exception("Forbidden", 403);
+    }
 
-      try {
-        print rest::reply(call_user_func(array($handler_class, $handler_method), $request));
-      } catch (ORM_Validation_Exception $e) {
-        foreach ($e->validation->errors() as $key => $value) {
-          $msgs[] = "$key: $value";
-        }
-        throw new Rest_Exception("Bad Request: " . join(", ", $msgs), 400);
+    try {
+      print rest::reply(call_user_func(array($handler_class, $handler_method), $request));
+    } catch (ORM_Validation_Exception $e) {
+      foreach ($e->validation->errors() as $key => $value) {
+        $msgs[] = "$key: $value";
       }
-    } catch (Rest_Exception $e) {
-      rest::send_headers($e);
+      throw new Rest_Exception("Bad Request: " . join(", ", $msgs), 400);
     }
   }
 }
\ No newline at end of file
diff --git a/modules/rest/tests/Rest_Controller_Test.php b/modules/rest/tests/Rest_Controller_Test.php
index ae5e6d48..e0663252 100644
--- a/modules/rest/tests/Rest_Controller_Test.php
+++ b/modules/rest/tests/Rest_Controller_Test.php
@@ -46,11 +46,17 @@ class Rest_Controller_Test extends Gallery_Unit_Test_Case {
 
   public function login_failed_test() {
     $user = test::random_user("password");
-    $_POST["user"] = $user->name;
-    $_POST["password"] = "WRONG PASSWORD";
 
-    // @todo check the http response code
-    $this->assert_equal(null, test::call_and_capture(array(new Rest_Controller(), "index")));
+    try {
+      $_POST["user"] = $user->name;
+      $_POST["password"] = "WRONG PASSWORD";
+      test::call_and_capture(array(new Rest_Controller(), "index"));
+    } catch (Rest_Exception $e) {
+      $this->assert_equal(403, $e->getCode());
+      return;
+    }
+
+    $this->assert_true(false, "Shouldn't get here");
   }
 
   public function rest_get_resource_no_request_key_test_() {
-- 
cgit v1.2.3


From 66fbbab9071e73df01b316bb29842fdc3b29c39c Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 20 Jan 2010 00:06:36 -0800
Subject: Add assert_array_equal_to_json().

---
 modules/gallery_unit_test/libraries/Gallery_Unit_Test_Case.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/gallery_unit_test/libraries/Gallery_Unit_Test_Case.php b/modules/gallery_unit_test/libraries/Gallery_Unit_Test_Case.php
index 81bd3330..509b4125 100644
--- a/modules/gallery_unit_test/libraries/Gallery_Unit_Test_Case.php
+++ b/modules/gallery_unit_test/libraries/Gallery_Unit_Test_Case.php
@@ -29,4 +29,8 @@ class Gallery_Unit_Test_Case extends Unit_Test_Case {
     }
     return $this;
   }
+
+  public function assert_array_equal_to_json($expected_array, $actual_json, $debug=null) {
+    return $this->assert_equal_array($expected_array, json_decode($actual_json, true), $debug);
+  }
 }
-- 
cgit v1.2.3


From 5119d58e7ff06e1ba922d73bf47aefd242dc888f Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 20 Jan 2010 00:07:03 -0800
Subject: Move access key creation into a helper function.

---
 modules/rest/controllers/rest.php | 10 +---------
 modules/rest/helpers/rest.php     | 14 ++++++++++++++
 2 files changed, 15 insertions(+), 9 deletions(-)

diff --git a/modules/rest/controllers/rest.php b/modules/rest/controllers/rest.php
index a6b618e8..9f0bc5b3 100644
--- a/modules/rest/controllers/rest.php
+++ b/modules/rest/controllers/rest.php
@@ -27,15 +27,7 @@ class Rest_Controller extends Controller {
       throw new Rest_Exception("Forbidden", 403);
     }
 
-    $key = ORM::factory("user_access_token")
-      ->where("user_id", "=", $user->id)
-      ->find();
-    if (!$key->loaded()) {
-      $key->user_id = $user->id;
-      $key->access_key = md5($user->name . rand());
-      $key->save();
-    }
-
+    $key = rest::get_access_token($user->id);
     rest::reply($key->access_key);
  }
 
diff --git a/modules/rest/helpers/rest.php b/modules/rest/helpers/rest.php
index fccb365e..cd3de725 100644
--- a/modules/rest/helpers/rest.php
+++ b/modules/rest/helpers/rest.php
@@ -49,6 +49,20 @@ class rest_Core {
     identity::set_active_user($user);
   }
 
+  static function get_access_token($user_id) {
+    $key = ORM::factory("user_access_token")
+      ->where("user_id", "=", $user_id)
+      ->find();
+
+    if (!$key->loaded()) {
+      $key->user_id = $user_id;
+      $key->access_key = md5(rand());
+      $key->save();
+    }
+    return $key;
+  }
+
+
   /**
    * Convert a REST url into an object.
    * Eg: "http://example.com/gallery3/index.php/rest/gallery/Family/Wedding" -> Item_Model
-- 
cgit v1.2.3


From 5f83da41e405dd274634fa520c5c08bfd885164a Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 20 Jan 2010 00:08:13 -0800
Subject: Rewrite the tests to be simpler and more direct.

---
 modules/rest/tests/Rest_Controller_Test.php | 133 ++++++++++++++--------------
 1 file changed, 68 insertions(+), 65 deletions(-)

diff --git a/modules/rest/tests/Rest_Controller_Test.php b/modules/rest/tests/Rest_Controller_Test.php
index e0663252..377f5334 100644
--- a/modules/rest/tests/Rest_Controller_Test.php
+++ b/modules/rest/tests/Rest_Controller_Test.php
@@ -59,84 +59,87 @@ class Rest_Controller_Test extends Gallery_Unit_Test_Case {
     $this->assert_true(false, "Shouldn't get here");
   }
 
-  public function rest_get_resource_no_request_key_test_() {
+  public function get_test() {
     $_SERVER["REQUEST_METHOD"] = "GET";
-    $photo = $this->_create_image();
-
-    $this->assert_equal(
-      json_encode(array("status" => "OK", "message" => (string)t("Processed"),
-                        "photo" => array("path" => $photo->relative_url(),
-                                        "title" => $photo->title,
-                                        "thumb_url" => $photo->thumb_url(),
-                                        "description" => $photo->description,
-                                        "internet_address" => $photo->slug))),
-      $this->_call_controller("rest", explode("/", $photo->relative_url())));
+    $_GET["key"] = "value";
+
+    $this->assert_array_equal_to_json(
+      array("params" => array("key" => "value"),
+            "method" => "get",
+            "access_token" => null,
+            "url" => "http://./index.php/gallery_unit_test"),
+      test::call_and_capture(array(new Rest_Controller(), "mock")));
   }
 
-  public function rest_get_resource_invalid_key_test_() {
-    list ($access_key, $user) = $this->_create_user();
-    $_SERVER["HTTP_X_GALLERY_REQUEST_KEY"] = md5($access_key); // screw up the access key;
-    $_SERVER["REQUEST_METHOD"] = "GET";
+  public function get_with_access_key_test() {
+    $key = rest::get_access_token(1);  // admin user
 
-    try {
-      $this->_call_controller();
-    } catch (Rest_Exception $e) {
-      $this->assert_equal(403, $e->getCode());
-      $this->assert_equal("Forbidden", $e->getMessage());
-    } catch (Exception $e) {
-      $this->assert_false(true, $e->__toString());
-    }
-  }
-
-  public function rest_get_resource_no_user_for_key_test_() {
-    list ($access_key, $user) = $this->_create_user();
     $_SERVER["REQUEST_METHOD"] = "GET";
-    $_SERVER["HTTP_X_GALLERY_REQUEST_KEY"] = $access_key;
+    $_SERVER["HTTP_X_GALLERY_REQUEST_KEY"] = $key->access_key;
+    $_GET["key"] = "value";
+
+    $this->assert_array_equal_to_json(
+      array("params" => array("key" => "value"),
+            "method" => "get",
+            "access_token" => $key->access_key,
+            "url" => "http://./index.php/gallery_unit_test"),
+      test::call_and_capture(array(new Rest_Controller(), "mock")));
+  }
 
-    $user->delete();
+  public function post_test() {
+    $_SERVER["REQUEST_METHOD"] = "POST";
+    $_POST["key"] = "value";
 
-    $photo = $this->_create_image();
+    $this->assert_array_equal_to_json(
+      array("params" => array("key" => "value"),
+            "method" => "post",
+            "access_token" => null,
+            "url" => "http://./index.php/gallery_unit_test"),
+      test::call_and_capture(array(new Rest_Controller(), "mock")));
+  }
 
-    try {
-      $this->_call_controller("rest", explode("/", $photo->relative_url()));
-    } catch (Rest_Exception $e) {
-      $this->assert_equal(403, $e->getCode());
-      $this->assert_equal("Forbidden", $e->getMessage());
-    } catch (Exception $e) {
-      $this->assert_false(true, $e->__toString());
-    }
+  public function put_test() {
+    $_SERVER["REQUEST_METHOD"] = "POST";
+    $_SERVER["HTTP_X_GALLERY_REQUEST_METHOD"] = "put";
+    $_POST["key"] = "value";
+
+    $this->assert_array_equal_to_json(
+      array("params" => array("key" => "value"),
+            "method" => "put",
+            "access_token" => null,
+            "url" => "http://./index.php/gallery_unit_test"),
+      test::call_and_capture(array(new Rest_Controller(), "mock")));
   }
 
-  public function rest_get_resource_no_handler_test_() {
-    list ($access_key, $user) = $this->_create_user();
-    $_SERVER["REQUEST_METHOD"] = "GET";
-    $_SERVER["HTTP_X_GALLERY_REQUEST_KEY"] = $access_key;
-    $_SERVER["HTTP_X_GALLERY_REQUEST_METHOD"] = "PUT";
-    $photo = $this->_create_image();
+  public function delete_test() {
+    $_SERVER["REQUEST_METHOD"] = "POST";
+    $_SERVER["HTTP_X_GALLERY_REQUEST_METHOD"] = "delete";
+    $_POST["key"] = "value";
+
+    $this->assert_array_equal_to_json(
+      array("params" => array("key" => "value"),
+            "method" => "delete",
+            "access_token" => null,
+            "url" => "http://./index.php/gallery_unit_test"),
+      test::call_and_capture(array(new Rest_Controller(), "mock")));
+  }
 
+  public function bogus_method_test() {
+    $_SERVER["REQUEST_METHOD"] = "POST";
+    $_SERVER["HTTP_X_GALLERY_REQUEST_METHOD"] = "BOGUS";
     try {
-      $this->_call_controller("rest", explode("/", $photo->relative_url()));
-    } catch (Rest_Exception $e) {
-      $this->assert_equal(501, $e->getCode());
-      $this->assert_equal("Not Implemented", $e->getMessage());
+      test::call_and_capture(array(new Rest_Controller(), "mock"));
     } catch (Exception $e) {
-      $this->assert_false(true, $e->__toString());
+      $this->assert_equal(403, $e->getCode());
+      return;
     }
-  }
-
-  public function rest_get_resource_test_() {
-    list ($access_key, $user) = $this->_create_user();
-    $_SERVER["REQUEST_METHOD"] = "GET";
-    $_SERVER["HTTP_X_GALLERY_REQUEST_KEY"] = $access_key;
-
-    $photo = $this->_create_image();
-    $this->assert_equal(
-      json_encode(array("status" => "OK", "message" => (string)t("Processed"),
-                        "photo" => array("path" => $photo->relative_url(),
-                                        "title" => $photo->title,
-                                        "thumb_url" => $photo->thumb_url(),
-                                        "description" => $photo->description,
-                                        "internet_address" => $photo->slug))),
-      $this->_call_controller("rest", explode("/", $photo->relative_url())));
+    $this->assert_true(false, "Shouldn't get here");
   }
 }
+
+class mock_rest {
+  function get($request)    { return $request; }
+  function post($request)   { return $request; }
+  function put($request)    { return $request; }
+  function delete($request) { return $request; }
+}
\ No newline at end of file
-- 
cgit v1.2.3


From 276d7de5b6254222aee828de54f21af6ee4c0a15 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 20 Jan 2010 00:14:05 -0800
Subject: Simplify and update for model based validation.

---
 modules/tag/tests/Tag_Test.php | 21 +++++++--------------
 1 file changed, 7 insertions(+), 14 deletions(-)

diff --git a/modules/tag/tests/Tag_Test.php b/modules/tag/tests/Tag_Test.php
index c3243145..defc4e89 100644
--- a/modules/tag/tests/Tag_Test.php
+++ b/modules/tag/tests/Tag_Test.php
@@ -19,24 +19,17 @@
  */
 class Tag_Test extends Gallery_Unit_Test_Case {
   public function create_tag_test() {
-    $rand = rand();
-    $root = ORM::factory("item", 1);
-    $album = album::create($root, $rand, $rand, $rand);
-    $tag1 = "tag1";
+    $album = test::random_album();
 
-    tag::add($album, $tag1);
-    $tag = ORM::factory("tag")->where("name", "=", $tag1)->find();
+    tag::add($album, "tag1");
+    $tag = ORM::factory("tag")->where("name", "=", "tag1")->find();
     $this->assert_true(1, $tag->count);
 
     // Make sure adding the tag again doesn't increase the count
-    tag::add($album, $tag1);
-    $tag = ORM::factory("tag")->where("name", "=", $tag1)->find();
-    $this->assert_true(1, $tag->count);
+    tag::add($album, "tag1");
+    $this->assert_true(1, $tag->reload()->count);
 
-    $rand = rand();
-    $album = album::create($root, $rand, $rand, $rand);
-    tag::add($album, $tag1);
-    $tag = ORM::factory("tag")->where("name", "=", $tag1)->find();
-    $this->assert_true(2, $tag->count);
+    tag::add(test::random_album(), "tag1");
+    $this->assert_true(2, $tag->reload()->count);
   }
 }
\ No newline at end of file
-- 
cgit v1.2.3


From b5cf24456f4868a0e553af389e1b482984bc8a86 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 20 Jan 2010 00:51:34 -0800
Subject: Forbidden is a 403, not a 503.

---
 modules/gallery/helpers/access.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/gallery/helpers/access.php b/modules/gallery/helpers/access.php
index e0a0e979..2cfaa947 100644
--- a/modules/gallery/helpers/access.php
+++ b/modules/gallery/helpers/access.php
@@ -183,10 +183,10 @@ class access_Core {
   }
 
   /**
-   * Terminate immediately with an HTTP 503 Forbidden response.
+   * Terminate immediately with an HTTP 403 Forbidden response.
    */
   static function forbidden() {
-    throw new Exception("@todo FORBIDDEN", 503);
+    throw new Exception("@todo FORBIDDEN", 403);
   }
 
   /**
-- 
cgit v1.2.3


From 8bf73d4b4c5e609cd4bc9b6ea54d32faeefef19b Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 20 Jan 2010 00:52:32 -0800
Subject: New test for tags_rest.php

---
 modules/tag/tests/Tags_Rest_Helper_Test.php | 68 +++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)
 create mode 100644 modules/tag/tests/Tags_Rest_Helper_Test.php

diff --git a/modules/tag/tests/Tags_Rest_Helper_Test.php b/modules/tag/tests/Tags_Rest_Helper_Test.php
new file mode 100644
index 00000000..dd922013
--- /dev/null
+++ b/modules/tag/tests/Tags_Rest_Helper_Test.php
@@ -0,0 +1,68 @@
+<?php defined("SYSPATH") or die("No direct script access.");
+/**
+ * Gallery - a web based photo album viewer and editor
+ * Copyright (C) 2000-2009 Bharat Mediratta
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or (at
+ * your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+class Tags_Rest_Helper_Test extends Gallery_Unit_Test_Case {
+  public function setup() {
+    try {
+      Database::instance()->query("TRUNCATE {tags}");
+      Database::instance()->query("TRUNCATE {items_tags}");
+    } catch (Exception $e) { }
+    $this->_save = array($_GET, $_POST, $_SERVER);
+  }
+
+  public function teardown() {
+    list($_GET, $_POST, $_SERVER) = $this->_save;
+  }
+
+  public function get_test() {
+    tag::add(item::root(), "t1");
+    tag::add(item::root(), "t2");
+
+    $request = new stdClass();
+    $this->assert_equal_array(
+      array(
+        "members" => array(
+          "t1" => rest::url("tag", ORM::factory("tag")->where("name", "=", "t1")->find()),
+          "t2" => rest::url("tag", ORM::factory("tag")->where("name", "=", "t2")->find()))),
+      tags_rest::get($request));
+  }
+
+  public function post_test() {
+    access::allow(identity::everybody(), "edit", item::root());
+
+    $request->params->name = "test tag";
+    $this->assert_equal(
+      array("url" => url::site("rest/tag/test%20tag")),
+      tags_rest::post($request));
+  }
+
+  public function post_fails_without_permissions_test() {
+    access::deny(identity::everybody(), "edit", item::root());
+
+    try {
+      $request->params->name = "test tag";
+      tags_rest::post($request);
+    } catch (Exception $e) {
+      $this->assert_equal(403, $e->getCode());
+      return;
+    }
+    $this->assert_true(false, "Shouldnt get here");
+  }
+
+}
-- 
cgit v1.2.3


From 210e02f0001489cdfa22da2fb57d6db08954aef3 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 20 Jan 2010 21:13:58 -0800
Subject: Throw Rest exceptions, not regular exceptions.

---
 modules/gallery/helpers/gallery_rest.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/gallery/helpers/gallery_rest.php b/modules/gallery/helpers/gallery_rest.php
index 49096100..c5838ea5 100644
--- a/modules/gallery/helpers/gallery_rest.php
+++ b/modules/gallery/helpers/gallery_rest.php
@@ -52,7 +52,7 @@ class gallery_rest_Core {
     }
 
     if (!in_array($p->scope, array("direct", "all"))) {
-      throw new Exception("Bad Request", 400);
+      throw new Rest_Exception("Bad Request", 400);
     }
 
     if ($p->scope == "direct") {
-- 
cgit v1.2.3


From 3d4a6d6336a2eaa212878f8af788825256be9e9c Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 20 Jan 2010 21:14:40 -0800
Subject: Remove unused untagging code from put() Add access permissions to
 delete() Remove unnecessary return value from delete()

---
 modules/tag/helpers/tag_rest.php | 16 +---------------
 1 file changed, 1 insertion(+), 15 deletions(-)

diff --git a/modules/tag/helpers/tag_rest.php b/modules/tag/helpers/tag_rest.php
index e7be9afa..0226c6d3 100644
--- a/modules/tag/helpers/tag_rest.php
+++ b/modules/tag/helpers/tag_rest.php
@@ -43,19 +43,6 @@ class tag_rest_Core {
 
   static function put($request) {
     $tag = rest::resolve($request->url);
-
-    if (isset($request->params->remove)) {
-      if (!is_array($request->params->remove)) {
-        throw new Exception("Bad request", 400);
-      }
-
-      foreach ($request->params->remove as $item_url) {
-        $item = rest::resolve($item_url);
-        access::required("edit", $item);
-        $tag->remove($item);
-      }
-    }
-
     if (isset($request->params->name)) {
       $tag->name = $request->params->name;
     }
@@ -73,11 +60,10 @@ class tag_rest_Core {
     } else {
       // Remove an item from the tag
       $item = rest::resolve($request->params->url);
+      access::required("edit", $item);
       $tag->remove($item);
       $tag->save();
-
       tag::compact();
-      return array("url" => rest::url("tag", $tag));
     }
   }
 
-- 
cgit v1.2.3


From 697d84457f3013bff1f8e860a1cd27e2e1942642 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 20 Jan 2010 21:15:11 -0800
Subject: Rewrite and greatly simplify the tests for the new tag_rest
 implementation.

---
 modules/tag/tests/Tag_Rest_Helper_Test.php | 293 ++++++++---------------------
 1 file changed, 74 insertions(+), 219 deletions(-)

diff --git a/modules/tag/tests/Tag_Rest_Helper_Test.php b/modules/tag/tests/Tag_Rest_Helper_Test.php
index c2d55ba4..389a512a 100644
--- a/modules/tag/tests/Tag_Rest_Helper_Test.php
+++ b/modules/tag/tests/Tag_Rest_Helper_Test.php
@@ -23,270 +23,125 @@ class Tag_Rest_Helper_Test extends Gallery_Unit_Test_Case {
       Database::instance()->query("TRUNCATE {tags}");
       Database::instance()->query("TRUNCATE {items_tags}");
     } catch (Exception $e) { }
-    $this->_save = array($_GET, $_POST, $_SERVER, $_FILES);
-    $this->_saved_active_user = identity::active_user();
+    $this->_save = array($_GET, $_POST, $_SERVER);
   }
 
   public function teardown() {
-    list($_GET, $_POST, $_SERVER, $_FILES) = $this->_save;
-    identity::set_active_user($this->_saved_active_user);
-
-    try {
-      if (!empty($this->_user)) {
-        $this->_user->delete();
-      }
-    } catch (Exception $e) { }
+    list($_GET, $_POST, $_SERVER) = $this->_save;
   }
 
-  private function _create_user() {
-    if (empty($this->_user)) {
-      $this->_user = identity::create_user("access_test" . rand(), "Access Test", "password");
-      $key = ORM::factory("user_access_token");
-      $key->access_key = md5($this->_user->name . rand());
-      $key->user_id = $this->_user->id;
-      $key->save();
-      identity::set_active_user($this->_user);
-    }
-    return $this->_user;
-  }
+  public function get_test() {
+    $tag = tag::add(item::root(), "tag1")->reload();
 
-  private function _create_album($tags=array(), $parent=null) {
-    $album_name = "tag_album_" . rand();
-    if (empty($parent)) {
-      $parent = ORM::factory("item", 1);
-    }
-    $album = album::create($parent, $album_name, $album_name, $album_name);
-    foreach ($tags as $tag) {
-      tag::add($album, $tag);
-    }
-    return $album;
+    $request->url = rest::url("tag", $tag);
+    $this->assert_equal_array(
+      array("resource" => $tag->as_array(),
+            "members" => array(rest::url("gallery", item::root()))),
+      tag_rest::get($request));
   }
 
-  private function _create_image($tags=array(), $parent=null) {
-    $filename = MODPATH . "gallery/tests/test.jpg";
-    $image_name = "tag_image_" . rand();
-    if (empty($parent)) {
-      $parent = ORM::factory("item", 1);
-    }
-    $photo = photo::create($parent, $filename, "$image_name.jpg", $image_name);
-    foreach ($tags as $tag) {
-      tag::add($photo, $tag);
+  public function get_with_invalid_url_test() {
+    $request->url = "bogus";
+    try {
+      tag_rest::get($request);
+    } catch (Kohana_404_Exception $e) {
+      return;  // pass
     }
-    return $photo;
-  }
-
-  public function tag_rest_get_all_test() {
-    $album = $this->_create_album(array("albums", "A1", "T1"));
-    $child = $this->_create_album(array("albums", "C1", "T1"), $album);
-    $photo = $this->_create_image(array("photos", "P1", "T1"), $child);
-    $sibling = $this->_create_image(array("photos", "P3"), $album);
-
-    $request = (object)array("arguments" => array(), "limit" => 2, "offset" => 1);
-
-    $this->assert_equal(
-      json_encode(array("status" => "OK",
-                        "tags" => array(array("name" => "albums", "count" => "2"),
-                                        array("name" => "photos", "count" => "2")))),
-      tag_rest::get($request));
+    $this->assert_true(false, "Shouldn't get here");
   }
 
-  public function tag_rest_get_tags_for_item_test() {
-    $photo = $this->_create_image(array("photos", "P1", "T1"));
-
-    $request = (object)array("arguments" => explode("/", $photo->relative_url()));
+  public function get_with_no_members_test() {
+    $tag = test::random_tag();
 
-    $this->assert_equal(
-      json_encode(array("status" => "OK",
-                        "tags" => array("photos", "P1", "T1"))),
+    $request->url = rest::url("tag", $tag);
+    $this->assert_equal_array(
+      array("resource" => $tag->as_array(), "members" => array()),
       tag_rest::get($request));
   }
 
-  public function tag_rest_get_items_test() {
-    $album = $this->_create_album(array("albums", "A1", "T1"));
-    $child = $this->_create_album(array("albums", "A1", "T1"), $album);
-    $photo = $this->_create_image(array("photos", "P1", "T1"), $child);
-    $sibling = $this->_create_image(array("photos", "P3"), $album);
-    $child->reload();
-    $album->reload();
-
-    $request = (object)array("arguments" => array("albums"));
+  public function post_test() {
+    $tag = test::random_tag();
 
-    $resources = array();
-    foreach (array($album, $child) as $resource) {
-      $resources[] = array("type" => $resource->type,
-                           "has_children" => $resource->children_count() > 0,
-                           "path" => $resource->relative_url(),
-                           "thumb_url" => $resource->thumb_url(),
-                           "thumb_dimensions" => array("width" => $resource->thumb_width,
-                                                       "height" => $resource->thumb_height),
-                           "has_thumb" => $resource->has_thumb(),
-                           "title" => $resource->title);
+    // Create an editable item to be tagged
+    $album = test::random_album();
+    access::allow(identity::everybody(), "edit", $album);
 
-    }
-    $this->assert_equal(json_encode(array("status" => "OK", "resources" => $resources)),
-                        tag_rest::get($request));
+    // Add the album to the tag
+    $request->url = rest::url("tag", $tag);
+    $request->params->url = rest::url("gallery", $album);
+    $this->assert_equal_array(
+      array("url" => rest::url("tag", $tag)),
+      tag_rest::post($request));
   }
 
-  public function tag_rest_add_tags_for_item_no_path_test() {
-    $request = (object)array("arguments" => array("new,one"));
-
+  public function post_with_no_item_url_test() {
+    $request = new stdClass();
     try {
       tag_rest::post($request);
     } catch (Rest_Exception $e) {
       $this->assert_equal(400, $e->getCode());
-      $this->assert_equal("Bad request", $e->getMessage());
-    } catch (Exception $e) {
-      $this->assert_false(true, $e->__toString());
+      return;
     }
-  }
 
-  public function tag_rest_add_tags_for_item_not_found_test() {
-    $photo = $this->_create_image(array("photos", "P1", "T1"));
-    $request = (object)array("path" => $photo->relative_url() . "b",
-                             "arguments" => array("new,one"));
-    try {
-      tag_rest::post($request);
-    } catch (Kohana_404_Exception $k404) {
-    } catch (Exception $e) {
-      $this->assert_false(true, $e->__toString());
-    }
+    $this->assert_true(false, "Shouldn't get here");
   }
 
-  public function tag_rest_add_tags_for_item_no_access_test() {
-    $photo = $this->_create_image(array("photos", "P1", "T1"));
-    $this->_create_user();
-    $request = (object)array("path" => $photo->relative_url(),
-                             "arguments" => array("new,one"));
+  public function put_test() {
+    $tag = test::random_tag();
+    $request->url = rest::url("tag", $tag);
+    $request->params->name = "new name";
 
-    try {
-      tag_rest::post($request);
-    } catch (Kohana_404_Exception $k404) {
-    } catch (Exception $e) {
-      $this->assert_false(true, $e->__toString());
-    }
+    $this->assert_equal_array(
+      array("url" => str_replace($tag->name, "new%20name", rest::url("tag", $tag))),
+      tag_rest::put($request));
+    $this->assert_equal("new name", $tag->reload()->name);
   }
 
-  public function tag_rest_add_tags_for_item_test() {
-    $album = $this->_create_album(array("albums", "A1", "T1"));
-    $child = $this->_create_album(array("albums", "A1", "T1"), $album);
-    $photo = $this->_create_image(array("photos", "P1", "T1"), $child);
-    $sibling = $this->_create_image(array("photos", "P3"), $album);
-    access::allow(identity::registered_users(), "edit", $child);
-    $this->_create_user();
-    $request = (object)array("path" => $photo->relative_url(),
-                             "arguments" => array("new,one"));
+  public function delete_tag_test() {
+    $tag = test::random_tag();
+    $request->url = rest::url("tag", $tag);
+    tag_rest::delete($request);
 
-    $this->assert_equal(
-      json_encode(array("status" => "OK")),
-      tag_rest::post($request));
-    $request = (object)array("arguments" => explode("/", $photo->relative_url()));
-    $this->assert_equal(
-      json_encode(array("status" => "OK",
-                        "tags" => array("photos", "P1", "T1", "new", "one"))),
-      tag_rest::get($request));
+    $this->assert_false($tag->reload()->loaded());
   }
 
-  public function tag_rest_update_tag_no_arguments_test() {
-    $request = (object)array("arguments" => array());
+  public function delete_item_from_tag_test() {
+    $album = test::random_album();
+    access::allow(identity::everybody(), "edit", $album);
 
-    try {
-      tag_rest::put($request);
-    } catch (Rest_Exception $e) {
-      $this->assert_equal(400, $e->getCode());
-      $this->assert_equal("Bad request", $e->getMessage());
-    } catch (Exception $e) {
-      $this->assert_false(true, $e->__toString());
-    }
-  }
+    $tag = tag::add($album, "tag1");
+    $this->assert_equal(1, $tag->items()->count());
 
-  public function tag_rest_update_tag_one_arguments_test() {
-    $request = (object)array("arguments" => array("photos"));
-    try {
-      tag_rest::put($request);
-    } catch (Rest_Exception $e) {
-      $this->assert_equal(400, $e->getCode());
-      $this->assert_equal("Bad request", $e->getMessage());
-    } catch (Exception $e) {
-      $this->assert_false(true, $e->__toString());
-    }
+    $request->url = rest::url("tag", $tag);
+    $request->params->url = rest::url("gallery", $album);
+    tag_rest::delete($request);
 
-    $request = (object)array("arguments" => array(), "new_name" => "valid");
-    try {
-      tag_rest::put($request);
-    } catch (Rest_Exception $e) {
-      $this->assert_equal(400, $e->getCode());
-      $this->assert_equal("Bad request", $e->getMessage());
-    } catch (Exception $e) {
-      $this->assert_false(true, $e->__toString());
-    }
+    $this->assert_equal(0, $tag->items()->count());
   }
 
-  public function tag_rest_update_tags_not_found_test() {
-    $request = (object)array("arguments" => array("not"), "new_name" => "found");
+  public function delete_item_from_tag_fails_without_permissions_test() {
+    $album = test::random_album();
+    $tag = tag::add($album, "tag1");
+    $this->assert_equal(1, $tag->items()->count());
+
+    $request->url = rest::url("tag", $tag);
+    $request->params->url = rest::url("gallery", $album);
 
     try {
-      tag_rest::put($request);
-    } catch (Kohana_404_Exception $k404) {
+      tag_rest::delete($request);
     } catch (Exception $e) {
-      $this->assert_false(true, $e->__toString());
-    }
-  }
-
-  public function tag_rest_update_tags_test() {
-    $album = $this->_create_album(array("albums", "A1", "T1"));
-    $child = $this->_create_album(array("albums", "A1", "T1"), $album);
-    $photo = $this->_create_image(array("photos", "P1", "T1"), $child);
-    $child->reload();
-    $sibling = $this->_create_image(array("photos", "P3"), $album);
-    $child->reload();
-    $album->reload();
-
-    $request = (object)array("arguments" => array("albums"), "new_name" => "new name");
-
-    $this->assert_equal(json_encode(array("status" => "OK")), tag_rest::put($request));
-
-    $request = (object)array("arguments" => array("new name"));
-    $resources = array();
-    foreach (array($album, $child) as $resource) {
-      $resources[] = array("type" => $resource->type,
-                           "has_children" => $resource->children_count() > 0,
-                           "path" => $resource->relative_url(),
-                           "thumb_url" => $resource->thumb_url(),
-                           "thumb_dimensions" => array("width" => $resource->thumb_width,
-                                                       "height" => $resource->thumb_height),
-                           "has_thumb" => $resource->has_thumb(),
-                           "title" => $resource->title);
-
+      $this->assert_equal(403, $e->getCode());
+      return;
     }
-    $this->assert_equal(
-      json_encode(array("status" => "OK", "resources" => $resources)),
-      tag_rest::get($request));
-  }
 
-  public function tag_rest_delete_tag_test() {
-    $album = $this->_create_album(array("albums", "A1", "T1"));
-    $child = $this->_create_album(array("albums", "A1", "T1"), $album);
-    $photo = $this->_create_image(array("photos", "P1", "T1"), $child);
-
-    $request = (object)array("arguments" => array("T1,P1"));
-    $this->assert_equal(json_encode(array("status" => "OK")), tag_rest::delete($request));
-
-    $request = (object)array("arguments" => array("T1,P1"));
-    $this->assert_equal(json_encode(array("status" => "OK")),
-                        tag_rest::get($request));
+    $this->assert_true(false, "Shouldn't get here");
   }
 
-  public function tag_rest_delete_tagc_from_item_test() {
-    $album = $this->_create_album(array("albums", "A1", "T1"));
-    $child = $this->_create_album(array("albums", "A1", "T1"), $album);
-    $photo = $this->_create_image(array("photos", "P1", "T1"), $child);
-    $request = (object)array("arguments" => array("T1,P1"),
-                             $photo->relative_url());
+  public function resolve_test() {
+    $tag = test::random_tag();
 
-    $this->assert_equal(json_encode(array("status" => "OK")), tag_rest::delete($request));
-
-    $request = (object)array("arguments" => explode("/", $photo->relative_url()));
-    $this->assert_equal(json_encode(array("status" => "OK", "tags" => array("photos"))),
-                        tag_rest::get($request));
+    $this->assert_equal(
+      $tag->as_array(),
+      rest::resolve(rest::url("tag", $tag))->as_array());
   }
 }
-- 
cgit v1.2.3


From 3a26ace065476fbc9c2537e97bf7720d3648400f Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 20 Jan 2010 21:15:44 -0800
Subject: Improve robustness in resolve() against bad urls..

---
 modules/rest/helpers/rest.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/rest/helpers/rest.php b/modules/rest/helpers/rest.php
index cd3de725..324b7f98 100644
--- a/modules/rest/helpers/rest.php
+++ b/modules/rest/helpers/rest.php
@@ -75,6 +75,10 @@ class rest_Core {
     $path = parse_url($relative_url, PHP_URL_PATH);
     $components = explode("/", $path, 3);
 
+    if (count($components) != 3) {
+      throw new Kohana_404_Exception($url);
+    }
+
     $class = "$components[1]_rest";
     if (!method_exists($class, "resolve")) {
       throw new Kohana_404_Exception($url);
-- 
cgit v1.2.3


From 2a41e27d49bd9f5f341ee201ec3878767a9271ec Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 20 Jan 2010 21:15:57 -0800
Subject: Add random_tag().

---
 modules/gallery_unit_test/helpers/test.php | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/modules/gallery_unit_test/helpers/test.php b/modules/gallery_unit_test/helpers/test.php
index 8e483c60..2bb38b81 100644
--- a/modules/gallery_unit_test/helpers/test.php
+++ b/modules/gallery_unit_test/helpers/test.php
@@ -70,4 +70,12 @@ class test_Core {
     call_user_func($callback);
     return ob_get_clean();
   }
+
+  static function random_tag() {
+    $tag = ORM::factory("tag");
+    $tag->name = (string)rand();
+
+    // have to reload because ORM::load has string versions of values that we set as integers.
+    return $tag->save()->reload();
+  }
 }
-- 
cgit v1.2.3


From 995faaa27fc870589e346f7ef65e0bd7cabfe047 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 20 Jan 2010 22:45:19 -0800
Subject: Stop using MY_ORM::original().  It's got very odd semantics and we
 are not capturing all cases for setting and resetting $original, which leads
 to some weird and hard to reproduce behavior.

Instead, if we need the original just reload it from the database.
This may result in a somewhat excessive load in places, but we'll have
to fix that in a later optimization pass.
---
 modules/gallery/models/item.php           | 104 +++++++++++++++---------------
 modules/gallery/tests/Item_Model_Test.php |   1 +
 2 files changed, 54 insertions(+), 51 deletions(-)

diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php
index 58ff86ed..19c379ab 100644
--- a/modules/gallery/models/item.php
+++ b/modules/gallery/models/item.php
@@ -415,65 +415,58 @@ class Item_Model extends ORM_MPTT {
       } else {
         // Update an existing item
 
-        // The new values have to be valid before we do anything with them.  If we make any
-        // other changes before we call parent::save() below, we'll have to validate those changes
-        // again.  But, we can't take any action on these values until we know they're ok so this
-        // is unavoidable.
-        if (!$this->_valid) {
-          $this->validate();
-        }
-
-        $original = clone $this->original();
-
-        if ($original->name != $this->name || $original->parent_id != $this->parent_id) {
-          // Get the old relative path for when we rename or move below
-          if (!isset($this->relative_path_cache)) {
-            $this->_build_relative_caches();  // but don't call save()
-          }
-          $before_save = clone $this;
+        // If any significant fields have changed, load up a copy of the original item and
+        // keep it around.
+        if (array_intersect($this->changed, array("parent_id", "name", "slug"))) {
+          $original = ORM::factory("item")->where("id", "=", $this->id)->find();
+          $original->_build_relative_caches();
           $this->relative_path_cache = null;
-        }
-
-        if ($original->slug != $this->slug) {
           $this->relative_url_cache = null;
         }
 
         parent::save();
 
-        if ($original->parent_id != $this->parent_id || $original->name != $this->name) {
+        // Now update the filesystem and any database caches if there were significant value
+        // changes.  If anything past this point fails, then we'll have an inconsistent database
+        // so this code should be as robust as we can make it.
+        if (isset($original)) {
+          // Update the MPTT pointers, if necessary.  We have to do this before we generate any
+          // cached paths!
           if ($original->parent_id != $this->parent_id) {
-            // Move the ORM pointers around
             parent::move_to($this->parent());
           }
 
-          // Move all of the items associated data files
-          @rename($before_save->file_path(), $this->file_path());
-          if ($this->is_album()) {
-            @rename(dirname($before_save->resize_path()), dirname($this->resize_path()));
-            @rename(dirname($before_save->thumb_path()), dirname($this->thumb_path()));
-          } else {
-            @rename($before_save->resize_path(), $this->resize_path());
-            @rename($before_save->thumb_path(), $this->thumb_path());
-          }
+          if ($original->parent_id != $this->parent_id || $original->name != $this->name) {
+            // Move all of the items associated data files
+            @rename($original->file_path(), $this->file_path());
+            if ($this->is_album()) {
+              @rename(dirname($original->resize_path()), dirname($this->resize_path()));
+              @rename(dirname($original->thumb_path()), dirname($this->thumb_path()));
+            } else {
+              @rename($original->resize_path(), $this->resize_path());
+              @rename($original->thumb_path(), $this->thumb_path());
+            }
 
-          if ($original->parent_id != $this->parent_id) {
-            // This will result in 2 events since we'll still fire the item_updated event below
-            module::event("item_moved", $this, $original->parent());
+
+            if ($original->parent_id != $this->parent_id) {
+              // This will result in 2 events since we'll still fire the item_updated event below
+              module::event("item_moved", $this, $original->parent());
+            }
           }
-        }
 
-        // Changing the name, slug or parent ripples downwards
-        if ($this->is_album() &&
-            ($original->name != $this->name ||
-             $original->slug != $this->slug ||
-             $original->parent_id != $this->parent_id)) {
-          db::build()
-            ->update("items")
-            ->set("relative_url_cache", null)
-            ->set("relative_path_cache", null)
-            ->where("left_ptr", ">", $this->left_ptr)
-            ->where("right_ptr", "<", $this->right_ptr)
-            ->execute();
+          // Changing the name, slug or parent ripples downwards
+          if ($this->is_album() &&
+              ($original->name != $this->name ||
+               $original->slug != $this->slug ||
+               $original->parent_id != $this->parent_id)) {
+            db::build()
+              ->update("items")
+              ->set("relative_url_cache", null)
+              ->set("relative_path_cache", null)
+              ->where("left_ptr", ">", $this->left_ptr)
+              ->where("right_ptr", "<", $this->right_ptr)
+              ->execute();
+          }
         }
 
         module::event("item_updated", $original, $this);
@@ -784,27 +777,36 @@ class Item_Model extends ORM_MPTT {
       return;
     } else if (rtrim($this->name, ".") !== $this->name) {
       $v->add_error("name", "no_trailing_period");
-    } else if ($this->is_movie() || $this->is_photo()) {
-      if ($this->original()->loaded()) {
+      return;
+    }
+
+    if ($this->is_movie() || $this->is_photo()) {
+      if ($this->loaded()) {
         // Existing items can't change their extension
+        $original = ORM::factory("item")->where("id", "=", $this->id)->find();
         $new_ext = pathinfo($this->name, PATHINFO_EXTENSION);
-        $old_ext = pathinfo($this->original()->name, PATHINFO_EXTENSION);
+        $old_ext = pathinfo($original->name, PATHINFO_EXTENSION);
         if (strcasecmp($new_ext, $old_ext)) {
           $v->add_error("name", "illegal_data_file_extension");
+          return;
         }
       } else {
         // New items must have an extension
         if (!pathinfo($this->name, PATHINFO_EXTENSION)) {
           $v->add_error("name", "illegal_data_file_extension");
+          return;
         }
       }
-    } else if (db::build()
+    }
+
+    if (db::build()
         ->from("items")
         ->where("parent_id", "=", $this->parent_id)
         ->where("name", "=", $this->name)
         ->merge_where($this->id ? array(array("id", "<>", $this->id)) : null)
         ->count_records()) {
       $v->add_error("name", "conflict");
+      return;
     }
   }
 
@@ -900,7 +902,7 @@ class Item_Model extends ORM_MPTT {
    * This field cannot be changed after it's been set.
    */
   public function read_only(Validation $v, $field) {
-    if ($this->original()->loaded() && $this->original()->$field != $this->$field) {
+    if ($this->loaded() && isset($this->changed[$field])) {
       $v->add_error($field, "read_only");
     }
   }
diff --git a/modules/gallery/tests/Item_Model_Test.php b/modules/gallery/tests/Item_Model_Test.php
index 9ea74b16..efad660e 100644
--- a/modules/gallery/tests/Item_Model_Test.php
+++ b/modules/gallery/tests/Item_Model_Test.php
@@ -139,6 +139,7 @@ class Item_Model_Test extends Gallery_Unit_Test_Case {
 
     try {
       $item->name = $item2->name;
+      print "SAVE\n";
       $item->save();
     } catch (ORM_Validation_Exception $e) {
       $this->assert_true(in_array("conflict", $e->validation->errors()));
-- 
cgit v1.2.3


From 00957f79bab42b2323b9fe52425b1e0ed51137ac Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 20 Jan 2010 22:46:46 -0800
Subject: Throw Kohana_Exception instead of Exception on access denied, since
 that may bubble all the way up

---
 modules/gallery/helpers/access.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/gallery/helpers/access.php b/modules/gallery/helpers/access.php
index 2cfaa947..10fa8666 100644
--- a/modules/gallery/helpers/access.php
+++ b/modules/gallery/helpers/access.php
@@ -186,7 +186,7 @@ class access_Core {
    * Terminate immediately with an HTTP 403 Forbidden response.
    */
   static function forbidden() {
-    throw new Exception("@todo FORBIDDEN", 403);
+    throw new Kohana_Exception("@todo FORBIDDEN", null, 403);
   }
 
   /**
-- 
cgit v1.2.3


From 6dc88be6b6828a968409167e9f3c57a1bb9ec79c Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 20 Jan 2010 22:50:20 -0800
Subject: Stop using MY_ORM::original().

---
 modules/comment/models/comment.php | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/modules/comment/models/comment.php b/modules/comment/models/comment.php
index 69b8505e..43c4148f 100644
--- a/modules/comment/models/comment.php
+++ b/modules/comment/models/comment.php
@@ -102,13 +102,14 @@ class Comment_Model extends ORM {
         $this->server_remote_host = substr($input->server("REMOTE_HOST"), 0, 64);
         $this->server_remote_port = substr($input->server("REMOTE_PORT"), 0, 16);
       }
-      $visible_change = $this->original()->state == "published" || $this->state == "published";
+
+      $visible_change = $this->state == "published";
       parent::save();
       module::event("comment_created", $this);
     } else {
       // Updated comment
-      $visible_change = $this->original()->state == "published" || $this->state == "published";
-      $original = clone $this->original();
+      $original = ORM::factory("comment")->where("id", "=", $this->id)->find();
+      $visible_change = $original->state == "published" || $this->state == "published";
       parent::save();
       module::event("comment_updated", $original, $this);
     }
-- 
cgit v1.2.3


From feefdfd533dd4e82a2edd5c0b342322889877b79 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 20 Jan 2010 22:51:18 -0800
Subject: Stop using MY_ORM::original().

---
 modules/gallery/tests/Item_Model_Test.php | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/modules/gallery/tests/Item_Model_Test.php b/modules/gallery/tests/Item_Model_Test.php
index efad660e..035ecb51 100644
--- a/modules/gallery/tests/Item_Model_Test.php
+++ b/modules/gallery/tests/Item_Model_Test.php
@@ -149,16 +149,6 @@ class Item_Model_Test extends Gallery_Unit_Test_Case {
     $this->assert_false(true, "rename should conflict");
   }
 
-  public function save_original_values_test() {
-    $item = test::random_photo_unsaved();
-    $item->title = "ORIGINAL_VALUE";
-    $item->save();
-    $item->title = "NEW_VALUE";
-
-    $this->assert_same("ORIGINAL_VALUE", $item->original()->title);
-    $this->assert_same("NEW_VALUE", $item->title);
-  }
-
   public function move_album_test() {
     $album2 = test::random_album();
     $album1 = test::random_album($album2);
-- 
cgit v1.2.3


From b23f62259d76a1edb656ede0f02d08c2372a2494 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 20 Jan 2010 22:52:11 -0800
Subject: Stop using MY_ORM::original().

---
 modules/user/controllers/users.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/user/controllers/users.php b/modules/user/controllers/users.php
index b3f39b47..b1c05efa 100644
--- a/modules/user/controllers/users.php
+++ b/modules/user/controllers/users.php
@@ -43,7 +43,7 @@ class Users_Controller extends Controller {
     }
 
     if ($valid) {
-      if ($user->original()->locale != $user->locale) {
+      if (isset($user->changed["locale"])) {
         // Delete the session based locale preference
         setcookie("g_locale", "", time() - 24 * 3600, "/");
       }
-- 
cgit v1.2.3


From f0780486eebba9d1f77241e979cedab4df94135a Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 20 Jan 2010 22:53:51 -0800
Subject: Fix typo: edit_user -> add_user.

---
 modules/user/controllers/admin_users.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/user/controllers/admin_users.php b/modules/user/controllers/admin_users.php
index bc68d154..1b0e48a4 100644
--- a/modules/user/controllers/admin_users.php
+++ b/modules/user/controllers/admin_users.php
@@ -37,9 +37,9 @@ class Admin_Users_Controller extends Admin_Controller {
       $user->full_name = $form->add_user->full_name->value;
       $user->password = $form->add_user->password->value;
       $user->email = $form->add_user->email->value;
-      $user->url = $form->edit_user->url->value;
+      $user->url = $form->add_user->url->value;
       $user->locale = $form->add_user->locale->value;
-      $user->admin = $form->edit_user->admin->checked;
+      $user->admin = $form->add_user->admin->checked;
       $user->validate();
     } catch (ORM_Validation_Exception $e) {
       // Translate ORM validation errors into form error messages
-- 
cgit v1.2.3


From b0ff4418d2d56be5eb6ac5b26255dc8a40404806 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 20 Jan 2010 22:55:22 -0800
Subject: Stop using MY_ORM::original()

---
 modules/user/models/group.php | 2 +-
 modules/user/models/user.php  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/user/models/group.php b/modules/user/models/group.php
index c00bf5c9..85114ede 100644
--- a/modules/user/models/group.php
+++ b/modules/user/models/group.php
@@ -55,7 +55,7 @@ class Group_Model extends ORM implements Group_Definition {
       module::event("group_created", $this);
     } else {
       // Updated group
-      $original = clone $this->original();
+      $original = ORM::factory("group")->where("id", "=", $this->id)->find();
       parent::save();
       module::event("group_updated", $original, $this);
     }
diff --git a/modules/user/models/user.php b/modules/user/models/user.php
index 451b5ffb..c43ee9a1 100644
--- a/modules/user/models/user.php
+++ b/modules/user/models/user.php
@@ -96,7 +96,7 @@ class User_Model extends ORM implements User_Definition {
       module::event("user_created", $this);
     } else {
       // Updated user
-      $original = clone $this->original();
+      $original = ORM::factory("user")->where("id", "=", $this->id)->find();
       parent::save();
       module::event("user_updated", $original, $this);
     }
-- 
cgit v1.2.3


From f6c48d757c8f95249e58280e93c99aa4a6f217b1 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 20 Jan 2010 22:56:37 -0800
Subject: Delete MY_ORM::original().  We did not have proper containment to
 generate $original when we needed it, resulting in inconsistent behavior.

---
 modules/gallery/libraries/MY_ORM.php | 33 ---------------------------------
 1 file changed, 33 deletions(-)

diff --git a/modules/gallery/libraries/MY_ORM.php b/modules/gallery/libraries/MY_ORM.php
index 8c0f084f..102b21f0 100644
--- a/modules/gallery/libraries/MY_ORM.php
+++ b/modules/gallery/libraries/MY_ORM.php
@@ -18,42 +18,9 @@
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
 class ORM extends ORM_Core {
-  // Track the original value of this ORM so that we can look it up in ORM::original()
-  protected $original = null;
-
   public function save() {
     model_cache::clear();
     $result = parent::save();
-    $this->original = clone $this;
-    return $result;
-  }
-
-  public function __set($column, $value) {
-    if (!isset($this->original)) {
-      $this->original = clone $this;
-    }
-
-    if ($value instanceof SafeString) {
-      $value = $value->unescaped();
-    }
-
-    return parent::__set($column, $value);
-  }
-
-  public function __unset($column) {
-    if (!isset($this->original)) {
-      $this->original = clone $this;
-    }
-
-    return parent::__unset($column);
-  }
-
-  public function original() {
-    if (!isset($this->original)) {
-      $this->original = clone $this;
-    }
-
-    return $this->original;
   }
 }
 
-- 
cgit v1.2.3


From 382214f3c13cc2ae4b927e37de7bc6e798fe900a Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 20 Jan 2010 23:00:39 -0800
Subject: Move the error page to the expected location for K24.

---
 modules/gallery_unit_test/views/kohana/error.php      | 18 ++++++++++++++++++
 modules/gallery_unit_test/views/kohana_error_page.php | 18 ------------------
 2 files changed, 18 insertions(+), 18 deletions(-)
 create mode 100644 modules/gallery_unit_test/views/kohana/error.php
 delete mode 100644 modules/gallery_unit_test/views/kohana_error_page.php

diff --git a/modules/gallery_unit_test/views/kohana/error.php b/modules/gallery_unit_test/views/kohana/error.php
new file mode 100644
index 00000000..c0ae7173
--- /dev/null
+++ b/modules/gallery_unit_test/views/kohana/error.php
@@ -0,0 +1,18 @@
+<?php defined("SYSPATH") or die("No direct script access.") ?>
+<?
+echo $error, "\n\n";
+echo wordwrap($description, 80), "\n\n";
+if (!empty($line) && !empty($file)) {
+  echo $file, "[", $line, "]:\n";
+}
+echo $message, "\n\n";
+
+if (!empty($trace)) {
+  $trace = preg_replace(
+    array('/<li>/', '/<(.*?)>/', '/&gt;/'),
+    array("  ",     '',          '>'),
+    $trace);
+  echo "Stack Trace:\n";
+  echo $trace, "\n";
+}
+
diff --git a/modules/gallery_unit_test/views/kohana_error_page.php b/modules/gallery_unit_test/views/kohana_error_page.php
deleted file mode 100644
index c0ae7173..00000000
--- a/modules/gallery_unit_test/views/kohana_error_page.php
+++ /dev/null
@@ -1,18 +0,0 @@
-<?php defined("SYSPATH") or die("No direct script access.") ?>
-<?
-echo $error, "\n\n";
-echo wordwrap($description, 80), "\n\n";
-if (!empty($line) && !empty($file)) {
-  echo $file, "[", $line, "]:\n";
-}
-echo $message, "\n\n";
-
-if (!empty($trace)) {
-  $trace = preg_replace(
-    array('/<li>/', '/<(.*?)>/', '/&gt;/'),
-    array("  ",     '',          '>'),
-    $trace);
-  echo "Stack Trace:\n";
-  echo $trace, "\n";
-}
-
-- 
cgit v1.2.3


From 3f3159d25caaea0c46583a6505c5dcc03b4fafe2 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 20 Jan 2010 23:05:51 -0800
Subject: Guard against missing/empty $description.

---
 modules/gallery_unit_test/views/kohana/error.php | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/modules/gallery_unit_test/views/kohana/error.php b/modules/gallery_unit_test/views/kohana/error.php
index c0ae7173..34053317 100644
--- a/modules/gallery_unit_test/views/kohana/error.php
+++ b/modules/gallery_unit_test/views/kohana/error.php
@@ -1,7 +1,9 @@
 <?php defined("SYSPATH") or die("No direct script access.") ?>
 <?
 echo $error, "\n\n";
-echo wordwrap($description, 80), "\n\n";
+if (!empty($description)) {
+  echo wordwrap($description, 80), "\n\n";
+}
 if (!empty($line) && !empty($file)) {
   echo $file, "[", $line, "]:\n";
 }
-- 
cgit v1.2.3


From 8a1c17d869575c9a19dc59e5470d664692f8e910 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 20 Jan 2010 23:14:51 -0800
Subject: Use the exception itself to print out a nice text message.

---
 modules/gallery_unit_test/views/kohana/error.php | 20 +++-----------------
 1 file changed, 3 insertions(+), 17 deletions(-)

diff --git a/modules/gallery_unit_test/views/kohana/error.php b/modules/gallery_unit_test/views/kohana/error.php
index 34053317..079a279b 100644
--- a/modules/gallery_unit_test/views/kohana/error.php
+++ b/modules/gallery_unit_test/views/kohana/error.php
@@ -1,20 +1,6 @@
 <?php defined("SYSPATH") or die("No direct script access.") ?>
 <?
-echo $error, "\n\n";
-if (!empty($description)) {
-  echo wordwrap($description, 80), "\n\n";
-}
-if (!empty($line) && !empty($file)) {
-  echo $file, "[", $line, "]:\n";
-}
-echo $message, "\n\n";
-
-if (!empty($trace)) {
-  $trace = preg_replace(
-    array('/<li>/', '/<(.*?)>/', '/&gt;/'),
-    array("  ",     '',          '>'),
-    $trace);
-  echo "Stack Trace:\n";
-  echo $trace, "\n";
-}
+echo $e->getMessage(), "\n";
+echo $e->getFile(), ":", $e->getLine(), "\n";
+echo $e->getTraceAsString(), "\n";
 
-- 
cgit v1.2.3


From d3e3bbd713e9391893bc2561f15b6f2348412faa Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 20 Jan 2010 23:27:52 -0800
Subject: improve comment.

---
 modules/gallery_unit_test/helpers/test.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/gallery_unit_test/helpers/test.php b/modules/gallery_unit_test/helpers/test.php
index 2bb38b81..aa8dda88 100644
--- a/modules/gallery_unit_test/helpers/test.php
+++ b/modules/gallery_unit_test/helpers/test.php
@@ -75,7 +75,7 @@ class test_Core {
     $tag = ORM::factory("tag");
     $tag->name = (string)rand();
 
-    // have to reload because ORM::load has string versions of values that we set as integers.
+    // Reload so that ORM coerces all fields into strings.
     return $tag->save()->reload();
   }
 }
-- 
cgit v1.2.3


From 949586c254f3b70a4b44828d1dee600cc6276a50 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 20 Jan 2010 23:28:29 -0800
Subject: Oops, bug in save() -- we weren't returning the saved value!

---
 modules/gallery/libraries/MY_ORM.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/gallery/libraries/MY_ORM.php b/modules/gallery/libraries/MY_ORM.php
index 102b21f0..a158d853 100644
--- a/modules/gallery/libraries/MY_ORM.php
+++ b/modules/gallery/libraries/MY_ORM.php
@@ -20,7 +20,7 @@
 class ORM extends ORM_Core {
   public function save() {
     model_cache::clear();
-    $result = parent::save();
+    return parent::save();
   }
 }
 
-- 
cgit v1.2.3


From 46d4d778ad9febf175380cd82e0a10da33293d36 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 20 Jan 2010 23:33:09 -0800
Subject: Remove debug code.

---
 modules/gallery/tests/Item_Model_Test.php | 1 -
 1 file changed, 1 deletion(-)

diff --git a/modules/gallery/tests/Item_Model_Test.php b/modules/gallery/tests/Item_Model_Test.php
index 035ecb51..1e77076a 100644
--- a/modules/gallery/tests/Item_Model_Test.php
+++ b/modules/gallery/tests/Item_Model_Test.php
@@ -139,7 +139,6 @@ class Item_Model_Test extends Gallery_Unit_Test_Case {
 
     try {
       $item->name = $item2->name;
-      print "SAVE\n";
       $item->save();
     } catch (ORM_Validation_Exception $e) {
       $this->assert_true(in_array("conflict", $e->validation->errors()));
-- 
cgit v1.2.3


From e2b6cfc2d9a0c0a5c6cf3c530b2a22d763b76970 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 20 Jan 2010 23:47:48 -0800
Subject: Make move_to protected since we don't want folks calling it on
 Item_Model.  If there's a need to make this public, we should override it in
 Item_Model and throw an exception there.

---
 modules/gallery/libraries/ORM_MPTT.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/gallery/libraries/ORM_MPTT.php b/modules/gallery/libraries/ORM_MPTT.php
index ba61131a..a7bb24ea 100644
--- a/modules/gallery/libraries/ORM_MPTT.php
+++ b/modules/gallery/libraries/ORM_MPTT.php
@@ -227,7 +227,7 @@ class ORM_MPTT_Core extends ORM {
    * @param   Item_Model $target Target node
    * @return  ORM_MTPP
    */
-  function move_to($target) {
+  protected function move_to($target) {
     if ($this->contains($target)) {
       throw new Exception("@todo INVALID_TARGET can't move item inside itself");
     }
-- 
cgit v1.2.3


From 16ccda0f3d63b5db43c5eaee551ecc62c42becf5 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 20 Jan 2010 23:49:10 -0800
Subject: Two fixes: 1) Don't call ORM_MPTT::move_to() directly.  Use the new  
  model-based-validation approach of changing the parent_id and saving.

2) Item_Model::parent() can return null; check for it.
---
 modules/gallery/helpers/item.php | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/modules/gallery/helpers/item.php b/modules/gallery/helpers/item.php
index 7821e628..41d49ce9 100644
--- a/modules/gallery/helpers/item.php
+++ b/modules/gallery/helpers/item.php
@@ -39,7 +39,8 @@ class item_Core {
       }
     }
 
-    $source->move_to($target);
+    $source->parent_id = $target->id;
+    $source->save();
 
     // If the target has no cover item, make this it.
     if ($target->album_cover_item_id == null)  {
@@ -59,7 +60,8 @@ class item_Core {
     $parent->save();
     graphics::generate($parent);
     $grand_parent = $parent->parent();
-    if (access::can("edit", $grand_parent) && $grand_parent->album_cover_item_id == null)  {
+    if ($grand_parent && access::can("edit", $grand_parent) &&
+        $grand_parent->album_cover_item_id == null)  {
       item::make_album_cover($parent);
     }
   }
-- 
cgit v1.2.3


From dde429f71e536d66565eb6aa78bf58c39a243abb Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 20 Jan 2010 23:49:20 -0800
Subject: Whitespace.

---
 modules/gallery/models/item.php | 1 -
 1 file changed, 1 deletion(-)

diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php
index 19c379ab..51857440 100644
--- a/modules/gallery/models/item.php
+++ b/modules/gallery/models/item.php
@@ -447,7 +447,6 @@ class Item_Model extends ORM_MPTT {
               @rename($original->thumb_path(), $this->thumb_path());
             }
 
-
             if ($original->parent_id != $this->parent_id) {
               // This will result in 2 events since we'll still fire the item_updated event below
               module::event("item_moved", $this, $original->parent());
-- 
cgit v1.2.3


From 1e35cf28eef8d88e8e5c611db108667526a0767b Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Thu, 21 Jan 2010 08:29:30 -0800
Subject: Reload the album after adding the photo so that MPTT pointers are
 correct.

---
 modules/gallery/tests/Item_Helper_Test.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/gallery/tests/Item_Helper_Test.php b/modules/gallery/tests/Item_Helper_Test.php
index 5fa8d6b1..cdbdd324 100644
--- a/modules/gallery/tests/Item_Helper_Test.php
+++ b/modules/gallery/tests/Item_Helper_Test.php
@@ -22,6 +22,7 @@ class Item_Helper_Test extends Gallery_Unit_Test_Case {
   public function viewable_test() {
     $album = test::random_album();
     $item = test::random_photo($album);
+    $album->reload();
     identity::set_active_user(identity::guest());
 
     // We can see the item when permissions are granted
-- 
cgit v1.2.3


From b278f9680c7afd7de6e7e9a64a724d87b6e04c93 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Thu, 21 Jan 2010 19:05:53 -0800
Subject: Can't call ORM_MPTT::move_to() externally, so call Item_Model::save()
 instead.

---
 modules/gallery/tests/ORM_MPTT_Test.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/gallery/tests/ORM_MPTT_Test.php b/modules/gallery/tests/ORM_MPTT_Test.php
index 1ffe1c57..8c850a86 100644
--- a/modules/gallery/tests/ORM_MPTT_Test.php
+++ b/modules/gallery/tests/ORM_MPTT_Test.php
@@ -66,7 +66,8 @@ class ORM_MPTT_Test extends Gallery_Unit_Test_Case {
     $album1_2->reload();
     $album1_1_1->reload();
 
-    $album1_1_1->move_to($album1_2);
+    $album1_1_1->parent_id = $album1_2->id;
+    $album1_1_1->save();
 
     $album1_1->reload();
     $album1_2->reload();
-- 
cgit v1.2.3


From 313f816818c6ee0db9354992005c9b3ad6da15d4 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Thu, 21 Jan 2010 19:06:32 -0800
Subject: Fix a minor bad expectation.

---
 modules/gallery/tests/Photos_Controller_Test.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/gallery/tests/Photos_Controller_Test.php b/modules/gallery/tests/Photos_Controller_Test.php
index 6012ed1c..50d49fcc 100644
--- a/modules/gallery/tests/Photos_Controller_Test.php
+++ b/modules/gallery/tests/Photos_Controller_Test.php
@@ -48,7 +48,7 @@ class Photos_Controller_Test extends Gallery_Unit_Test_Case {
     $this->assert_equal("new-slug", $photo->slug);
     $this->assert_equal("new title", $photo->title);
     $this->assert_equal("new description", $photo->description);
-    $this->assert_equal("new name.jpeg", $photo->name);
+    $this->assert_equal("new name.jpg", $photo->name);
   }
 
   public function change_photo_no_csrf_fails_test() {
-- 
cgit v1.2.3


From 40b17474bbadbaa48f37f8de776e8cbe35efc8e3 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Thu, 21 Jan 2010 19:08:29 -0800
Subject: Add random_group().

---
 modules/gallery_unit_test/helpers/test.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/gallery_unit_test/helpers/test.php b/modules/gallery_unit_test/helpers/test.php
index aa8dda88..94dac22e 100644
--- a/modules/gallery_unit_test/helpers/test.php
+++ b/modules/gallery_unit_test/helpers/test.php
@@ -53,6 +53,10 @@ class test_Core {
     return identity::create_user($rand, $rand, $password, "$rand@rand.com");
   }
 
+  static function random_group() {
+    return identity::create_group((string)rand());
+  }
+
   static function random_name($item=null) {
     $rand = "name_" . rand();
     if ($item && $item->is_photo()) {
-- 
cgit v1.2.3


From 2f9077e26a0d36ac5805db87069827979d965c5f Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Thu, 21 Jan 2010 19:08:40 -0800
Subject: Simplify the test using the test helper.

---
 modules/user/tests/User_Groups_Test.php | 27 ++-------------------------
 1 file changed, 2 insertions(+), 25 deletions(-)

diff --git a/modules/user/tests/User_Groups_Test.php b/modules/user/tests/User_Groups_Test.php
index 089ab9a6..d0026d89 100644
--- a/modules/user/tests/User_Groups_Test.php
+++ b/modules/user/tests/User_Groups_Test.php
@@ -19,32 +19,9 @@
  */
 
 class User_Groups_Test extends Gallery_Unit_Test_Case {
-  public function teardown() {
-    try {
-      $group = ORM::factory("group")->where("name", "=", "user_groups_test")->find();
-      if ($group->loaded()) {
-        $group->delete();
-      }
-    } catch (Exception $e) { }
-
-    try {
-      $user = ORM::factory("user")->where("name", "=", "user_groups_test")->find();
-      if ($user->loaded()) {
-        $user->delete();
-      }
-    } catch (Exception $e) { }
-  }
-
   public function add_user_to_group_test() {
-    $user = ORM::factory("user");
-    $user->name = "user_groups_test";
-    $user->full_name = "user groups test";
-    $user->password = "test password";
-    $user->save();
-
-    $group = ORM::factory("group");
-    $group->name = "user_groups_test";
-    $group->save();
+    $user = test::random_user();
+    $group = test::random_group();
 
     $group->add($user);
     $group->save();
-- 
cgit v1.2.3


From f7f4df64b9abe726fae30cc44b8e640f68ef1415 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Thu, 21 Jan 2010 20:04:46 -0800
Subject: Exclude modules/gallery_unit_test/views/kohana/error.php

---
 modules/gallery/tests/File_Structure_Test.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/gallery/tests/File_Structure_Test.php b/modules/gallery/tests/File_Structure_Test.php
index bffdf361..4590e95d 100644
--- a/modules/gallery/tests/File_Structure_Test.php
+++ b/modules/gallery/tests/File_Structure_Test.php
@@ -36,7 +36,7 @@ class File_Structure_Test extends Gallery_Unit_Test_Case {
     $dir = new GalleryCodeFilterIterator(
       new RecursiveIteratorIterator(new RecursiveDirectoryIterator(DOCROOT)));
     foreach ($dir as $file) {
-      if (strpos($file, "modules/gallery/views/kohana/error.php")) {
+      if (strpos($file, "views/kohana/error.php")) {
         continue;
       }
 
-- 
cgit v1.2.3


From 709d797408b2821fd8ec97c83fa982519a028bf8 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Thu, 21 Jan 2010 20:10:45 -0800
Subject: Make sure that we actually don't have permissions, to avoid
 contamination w/ other tests.

---
 modules/gallery/tests/Gallery_Rest_Helper_Test.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/gallery/tests/Gallery_Rest_Helper_Test.php b/modules/gallery/tests/Gallery_Rest_Helper_Test.php
index dcd9a9db..7586e010 100644
--- a/modules/gallery/tests/Gallery_Rest_Helper_Test.php
+++ b/modules/gallery/tests/Gallery_Rest_Helper_Test.php
@@ -194,6 +194,7 @@ class Gallery_Rest_Helper_Test extends Gallery_Unit_Test_Case {
 
   public function delete_album_fails_without_permission_test() {
     $album1 = test::random_album();
+    access::deny(identity::everybody(), "edit", $album1);
 
     $request->url = rest::url("gallery", $album1);
     try {
-- 
cgit v1.2.3


From a0c99794185bbfe227556a4b006b2a6e770b3a78 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Thu, 21 Jan 2010 20:12:28 -0800
Subject: whitespace.

---
 modules/rest/helpers/rest.php | 1 -
 1 file changed, 1 deletion(-)

diff --git a/modules/rest/helpers/rest.php b/modules/rest/helpers/rest.php
index 324b7f98..85987ca1 100644
--- a/modules/rest/helpers/rest.php
+++ b/modules/rest/helpers/rest.php
@@ -62,7 +62,6 @@ class rest_Core {
     return $key;
   }
 
-
   /**
    * Convert a REST url into an object.
    * Eg: "http://example.com/gallery3/index.php/rest/gallery/Family/Wedding" -> Item_Model
-- 
cgit v1.2.3


From 6be5a71cc25614f669034f4f0fa86b5f109aaac6 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Thu, 21 Jan 2010 20:16:57 -0800
Subject: Actually deny permissions in
 delete_item_from_tag_fails_without_permissions_test()..

---
 modules/tag/tests/Tag_Rest_Helper_Test.php | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/tag/tests/Tag_Rest_Helper_Test.php b/modules/tag/tests/Tag_Rest_Helper_Test.php
index 389a512a..427d1a71 100644
--- a/modules/tag/tests/Tag_Rest_Helper_Test.php
+++ b/modules/tag/tests/Tag_Rest_Helper_Test.php
@@ -124,6 +124,8 @@ class Tag_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $tag = tag::add($album, "tag1");
     $this->assert_equal(1, $tag->items()->count());
 
+    access::deny(identity::everybody(), "edit", $album);
+
     $request->url = rest::url("tag", $tag);
     $request->params->url = rest::url("gallery", $album);
 
-- 
cgit v1.2.3


From 8788880065ca199216df552f66fd065c3f35a0aa Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Thu, 21 Jan 2010 20:18:19 -0800
Subject: We don't need CSRF in Rest_Controller::__call() because we use access
 tokens.

---
 modules/gallery/tests/controller_auth_data.txt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/gallery/tests/controller_auth_data.txt b/modules/gallery/tests/controller_auth_data.txt
index beabee49..71ae5a0c 100644
--- a/modules/gallery/tests/controller_auth_data.txt
+++ b/modules/gallery/tests/controller_auth_data.txt
@@ -20,8 +20,8 @@ modules/gallery/controllers/simple_uploader.php              start
 modules/gallery/controllers/simple_uploader.php              finish               DIRTY_AUTH
 modules/gallery/controllers/upgrader.php                     index                DIRTY_AUTH
 modules/gallery/controllers/welcome_message.php              index                DIRTY_AUTH
-modules/rest/controllers/rest.php                            access_key           DIRTY_CSRF|DIRTY_AUTH
-modules/rest/controllers/rest.php                            __call               DIRTY_AUTH
+modules/rest/controllers/rest.php                            index                DIRTY_CSRF|DIRTY_AUTH
+modules/rest/controllers/rest.php                            __call               DIRTY_CSRF|DIRTY_AUTH
 modules/rss/controllers/rss.php                              feed                 DIRTY_CSRF|DIRTY_AUTH
 modules/search/controllers/search.php                        index                DIRTY_CSRF|DIRTY_AUTH
 modules/server_add/controllers/admin_server_add.php          autocomplete         DIRTY_CSRF
-- 
cgit v1.2.3


From 3665391f8bbf40aa27acc816dc546237461e1cba Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Thu, 21 Jan 2010 21:29:42 -0800
Subject: Guard against division by zero.

---
 modules/tag/helpers/tag.php | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/modules/tag/helpers/tag.php b/modules/tag/helpers/tag.php
index d895e08f..c49a2d0f 100644
--- a/modules/tag/helpers/tag.php
+++ b/modules/tag/helpers/tag.php
@@ -73,6 +73,9 @@ class tag_Core {
     if ($tags) {
       $cloud = new View("tag_cloud.html");
       $cloud->max_count = $tags[0]->count;
+      if (!$cloud->max_count) {
+        return;
+      }
       usort($tags, array("tag", "sort_by_name"));
       $cloud->tags = $tags;
       return $cloud;
-- 
cgit v1.2.3


From bcf1caad1459a458a7923335a4a6bc521816de40 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 22 Jan 2010 00:27:00 -0800
Subject: Reshape the rest code to be more consistent with regards to
 relationships.  Now when you view a resource, it has 4 top level elements:

url: the url of this resource
resource: array of key value pairs describing the resource
members: array of urls to members of this collection
relationships: array of array of members.

Relationships are a special type of collection that links two
different resources together.  To remove a relationship, just
DELETE its url.  To create a relationship, POST to its
collection.

Individual modules can add their own relationships to any
resource via a callback mechanism.

Example:
  Array(
    [url] => http://g3.com/rest/item/1
    [resource] => Array (
      [id] => 1
      [album_cover_item_id] => 4
      [captured] =>
      [created] => 1264056417
      [description] =>
      [height] =>
      ...
    )
    [members] => Array(
      [0] => http://g3.com/rest/item/2
      [1] => http://g3.com/rest/item/3
      [2] => http://g3.com/rest/item/4
      [3] => http://g3.com/rest/item/5
      ...
    )
    [relationships] => Array(
      [tags] => Array (
      [0] => http://g3.com/rest/tag_item/2,1
      [1] => http://g3.com/rest/tag_item/23,1
      )
    )
  )
---
 modules/gallery/helpers/gallery_rest.php | 152 -----------------------------
 modules/gallery/helpers/item_rest.php    | 158 +++++++++++++++++++++++++++++++
 modules/rest/controllers/rest.php        |   2 +-
 modules/rest/helpers/rest.php            |  50 ++++++++--
 modules/tag/helpers/tag.php              |  14 +--
 modules/tag/helpers/tag_event.php        |  12 ++-
 modules/tag/helpers/tag_item_rest.php    |  50 ++++++++++
 modules/tag/helpers/tag_rest.php         |  43 +++++----
 modules/tag/helpers/tags_rest.php        |   4 +-
 9 files changed, 289 insertions(+), 196 deletions(-)
 delete mode 100644 modules/gallery/helpers/gallery_rest.php
 create mode 100644 modules/gallery/helpers/item_rest.php
 create mode 100644 modules/tag/helpers/tag_item_rest.php

diff --git a/modules/gallery/helpers/gallery_rest.php b/modules/gallery/helpers/gallery_rest.php
deleted file mode 100644
index c5838ea5..00000000
--- a/modules/gallery/helpers/gallery_rest.php
+++ /dev/null
@@ -1,152 +0,0 @@
-<?php defined("SYSPATH") or die("No direct script access.");
-/**
- * Gallery - a web based photo album viewer and editor
- * Copyright (C) 2000-2009 Bharat Mediratta
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or (at
- * your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
- */
-class gallery_rest_Core {
-  /**
-   * For items that are collections, you can specify the following additional query parameters to
-   * query the collection.  You can specify them in any combination.
-   *
-   *   scope=direct
-   *     only return items that are immediately under this one
-   *   scope=all
-   *     return items anywhere under this one
-   *
-   *   name=<substring>
-   *     only return items where the name contains this substring
-   *
-   *   random=true
-   *     return a single random item
-   *
-   *   type=<comma separate list of photo, movie or album>
-   *     limit the type to types in this list.  eg, "type=photo,movie"
-   */
-  static function get($request) {
-    $item = rest::resolve($request->url);
-    access::required("view", $item);
-
-    $p = $request->params;
-    if (isset($p->random)) {
-      $orm = item::random_query()->offset(0)->limit(1);
-    } else {
-      $orm = ORM::factory("item")->viewable();
-    }
-
-    if (empty($p->scope)) {
-      $p->scope = "direct";
-    }
-
-    if (!in_array($p->scope, array("direct", "all"))) {
-      throw new Rest_Exception("Bad Request", 400);
-    }
-
-    if ($p->scope == "direct") {
-      $orm->where("parent_id", "=", $item->id);
-    } else {
-      $orm->where("left_ptr", ">", $item->left_ptr);
-      $orm->where("right_ptr", "<", $item->right_ptr);
-    }
-
-    if (isset($p->name)) {
-      $orm->where("name", "LIKE", "%{$p->name}%");
-    }
-
-    if (isset($p->type)) {
-      $orm->where("type", "IN", explode(",", $p->type));
-    }
-
-    $members = array();
-    foreach ($orm->find_all() as $child) {
-      $members[] = rest::url("gallery", $child);
-    }
-
-    return array("resource" => $item->as_array(), "members" => $members);
-  }
-
-  static function put($request) {
-    $item = rest::resolve($request->url);
-    access::required("edit", $item);
-
-    $params = $request->params;
-
-    // Only change fields from a whitelist.
-    foreach (array("album_cover_item_id", "captured", "description",
-                   "height", "mime_type", "name", "parent_id", "rand_key", "resize_dirty",
-                   "resize_height", "resize_width", "slug", "sort_column", "sort_order",
-                   "thumb_dirty", "thumb_height", "thumb_width", "title", "view_count",
-                   "weight", "width") as $key) {
-      if (property_exists($request->params, $key)) {
-        $item->$key = $request->params->$key;
-      }
-    }
-    $item->save();
-
-    return array("url" => rest::url("gallery", $item));
-  }
-
-  static function post($request) {
-    $parent = rest::resolve($request->url);
-    access::required("edit", $parent);
-
-    $params = $request->params;
-    $item = ORM::factory("item");
-    switch ($params->type) {
-    case "album":
-      $item->type = "album";
-      $item->parent_id = $parent->id;
-      $item->name = $params->name;
-      $item->title = isset($params->title) ? $params->title : $name;
-      $item->description = isset($params->description) ? $params->description : null;
-      $item->slug = isset($params->slug) ? $params->slug : null;
-      $item->save();
-      break;
-
-    case "photo":
-    case "movie":
-      $item->type = $params->type;
-      $item->parent_id = $parent->id;
-      $item->set_data_file($request->file);
-      $item->name = $params->name;
-      $item->title = isset($params->title) ? $params->title : $params->name;
-      $item->description = isset($params->description) ? $params->description : null;
-      $item->slug = isset($params->slug) ? $params->slug : null;
-      $item->save();
-      break;
-
-    default:
-      throw new Rest_Exception("Invalid type: $params->type", 400);
-    }
-
-    return array("url" => rest::url("gallery", $item));
-  }
-
-  static function delete($request) {
-    $item = rest::resolve($request->url);
-    access::required("edit", $item);
-
-    $item->delete();
-  }
-
-  static function resolve($path) {
-    return url::get_item_from_uri($path);
-  }
-
-  static function url($item) {
-    return url::abs_site("rest/gallery/" . $item->relative_url());
-  }
-}
diff --git a/modules/gallery/helpers/item_rest.php b/modules/gallery/helpers/item_rest.php
new file mode 100644
index 00000000..edc44c45
--- /dev/null
+++ b/modules/gallery/helpers/item_rest.php
@@ -0,0 +1,158 @@
+<?php defined("SYSPATH") or die("No direct script access.");
+/**
+ * Gallery - a web based photo album viewer and editor
+ * Copyright (C) 2000-2009 Bharat Mediratta
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or (at
+ * your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+class item_rest_Core {
+  /**
+   * For items that are collections, you can specify the following additional query parameters to
+   * query the collection.  You can specify them in any combination.
+   *
+   *   scope=direct
+   *     only return items that are immediately under this one
+   *   scope=all
+   *     return items anywhere under this one
+   *
+   *   name=<substring>
+   *     only return items where the name contains this substring
+   *
+   *   random=true
+   *     return a single random item
+   *
+   *   type=<comma separate list of photo, movie or album>
+   *     limit the type to types in this list.  eg, "type=photo,movie"
+   */
+  static function get($request) {
+    $item = rest::resolve($request->url);
+    access::required("view", $item);
+
+    $p = $request->params;
+    if (isset($p->random)) {
+      $orm = item::random_query()->offset(0)->limit(1);
+    } else {
+      $orm = ORM::factory("item")->viewable();
+    }
+
+    if (empty($p->scope)) {
+      $p->scope = "direct";
+    }
+
+    if (!in_array($p->scope, array("direct", "all"))) {
+      throw new Rest_Exception("Bad Request", 400);
+    }
+
+    if ($p->scope == "direct") {
+      $orm->where("parent_id", "=", $item->id);
+    } else {
+      $orm->where("left_ptr", ">", $item->left_ptr);
+      $orm->where("right_ptr", "<", $item->right_ptr);
+    }
+
+    if (isset($p->name)) {
+      $orm->where("name", "LIKE", "%{$p->name}%");
+    }
+
+    if (isset($p->type)) {
+      $orm->where("type", "IN", explode(",", $p->type));
+    }
+
+    $members = array();
+    foreach ($orm->find_all() as $child) {
+      $members[] = rest::url("item", $child);
+    }
+
+    return array(
+      "url" => $request->url,
+      "resource" => $item->as_array(),
+      "members" => $members,
+      "relationships" => rest::relationships("item", $item));
+  }
+
+  static function put($request) {
+    $item = rest::resolve($request->url);
+    access::required("edit", $item);
+
+    $params = $request->params;
+
+    // Only change fields from a whitelist.
+    foreach (array("album_cover_item_id", "captured", "description",
+                   "height", "mime_type", "name", "parent_id", "rand_key", "resize_dirty",
+                   "resize_height", "resize_width", "slug", "sort_column", "sort_order",
+                   "thumb_dirty", "thumb_height", "thumb_width", "title", "view_count",
+                   "weight", "width") as $key) {
+      if (property_exists($request->params, $key)) {
+        $item->$key = $request->params->$key;
+      }
+    }
+    if ($item->changed) {
+      $item->save();
+    }
+  }
+
+  static function post($request) {
+    $parent = rest::resolve($request->url);
+    access::required("edit", $parent);
+
+    $params = $request->params;
+    $item = ORM::factory("item");
+    switch ($params->type) {
+    case "album":
+      $item->type = "album";
+      $item->parent_id = $parent->id;
+      $item->name = $params->name;
+      $item->title = isset($params->title) ? $params->title : $name;
+      $item->description = isset($params->description) ? $params->description : null;
+      $item->slug = isset($params->slug) ? $params->slug : null;
+      $item->save();
+      break;
+
+    case "photo":
+    case "movie":
+      $item->type = $params->type;
+      $item->parent_id = $parent->id;
+      $item->set_data_file($request->file);
+      $item->name = $params->name;
+      $item->title = isset($params->title) ? $params->title : $params->name;
+      $item->description = isset($params->description) ? $params->description : null;
+      $item->slug = isset($params->slug) ? $params->slug : null;
+      $item->save();
+      break;
+
+    default:
+      throw new Rest_Exception("Invalid type: $params->type", 400);
+    }
+  }
+
+  static function delete($request) {
+    $item = rest::resolve($request->url);
+    access::required("edit", $item);
+
+    $item->delete();
+  }
+
+  static function resolve($id) {
+    $item = ORM::factory("item")->where("id", "=", $id)->find();
+    if (!access::can("view", $item)) {
+      throw new Kohana_404_Exception();
+    }
+    return $item;
+  }
+
+  static function url($item) {
+    return url::abs_site("rest/item/{$item->id}");
+  }
+}
diff --git a/modules/rest/controllers/rest.php b/modules/rest/controllers/rest.php
index 9f0bc5b3..ba996b84 100644
--- a/modules/rest/controllers/rest.php
+++ b/modules/rest/controllers/rest.php
@@ -56,7 +56,7 @@ class Rest_Controller extends Controller {
     $handler_method = $request->method;
 
     if (!method_exists($handler_class, $handler_method)) {
-      throw new Rest_Exception("Forbidden", 403);
+      throw new Rest_Exception("Bad Request", 400);
     }
 
     try {
diff --git a/modules/rest/helpers/rest.php b/modules/rest/helpers/rest.php
index 85987ca1..fe704a9e 100644
--- a/modules/rest/helpers/rest.php
+++ b/modules/rest/helpers/rest.php
@@ -22,8 +22,16 @@ class rest_Core {
     Session::abort_save();
 
     if ($data) {
-      header("Content-type: application/json");
-      print json_encode($data);
+      if (Input::instance()->get("output_type") == "html") {
+        header("Content-type: text/html");
+        $html = preg_replace(
+          "#(^|[\n ])([\w]+?://[\w]+[^ \"\n\r\t<]*)#ise", "'\\1<a href=\"\\2\" >\\2</a>'",
+          print_r($data, 1));
+        print "<pre>$html</pre>";
+      } else {
+        header("Content-type: application/json");
+        print json_encode($data);
+      }
     }
   }
 
@@ -64,7 +72,10 @@ class rest_Core {
 
   /**
    * Convert a REST url into an object.
-   * Eg: "http://example.com/gallery3/index.php/rest/gallery/Family/Wedding" -> Item_Model
+   * Eg:
+   *   http://example.com/gallery3/index.php/rest/item/35          -> Item_Model
+   *   http://example.com/gallery3/index.php/rest/tag/16           -> Tag_Model
+   *   http://example.com/gallery3/index.php/rest/tagged_item/1,16 -> [Tag_Model, Item_Model]
    *
    * @param string  the fully qualified REST url
    * @return mixed  the corresponding object (usually a model of some kind)
@@ -88,15 +99,38 @@ class rest_Core {
 
   /**
    * Return an absolute url used for REST resource location.
-   * @param  string  module name (eg, "gallery", "tags")
+   * @param  string  resource type (eg, "item", "tag")
    * @param  object  resource
    */
-  static function url($module, $resource) {
-    $class = "{$module}_rest";
+  static function url() {
+    $args = func_get_args();
+    $resource_type = array_shift($args);
+
+    $class = "{$resource_type}_rest";
     if (!method_exists($class, "url")) {
-      throw new Exception("@todo MISSING REST CLASS: $class");
+      throw new Rest_Exception("Bad Request", 400);
+    }
+
+    $url = call_user_func_array(array($class, "url"), $args);
+    if (Input::instance()->get("output_type") == "html") {
+      $url .= "?output_type=html";
+    }
+    return $url;
+  }
+
+  static function relationships($resource_type, $resource) {
+    $results = array();
+    foreach (module::active() as $module) {
+      foreach (glob(MODPATH . "{$module->name}/helpers/*_rest.php") as $filename) {
+        $class = str_replace(".php", "", basename($filename));
+        if (method_exists($class, "relationships")) {
+          $results = array_merge(
+            $results,
+            call_user_func(array($class, "relationships"), $resource_type, $resource));
+        }
+      }
     }
 
-    return call_user_func(array($class, "url"), $resource);
+    return $results;
   }
 }
diff --git a/modules/tag/helpers/tag.php b/modules/tag/helpers/tag.php
index c49a2d0f..9e59b527 100644
--- a/modules/tag/helpers/tag.php
+++ b/modules/tag/helpers/tag.php
@@ -91,16 +91,10 @@ class tag_Core {
    * @return array
    */
   static function item_tags($item) {
-    $tags = array();
-    foreach (db::build()
-             ->select("name")
-             ->from("tags")
-             ->join("items_tags", "tags.id", "items_tags.tag_id", "left")
-             ->where("items_tags.item_id", "=", $item->id)
-             ->execute() as $row) {
-      $tags[] = $row->name;
-    }
-    return $tags;
+    return ORM::factory("tag")
+      ->join("items_tags", "tags.id", "items_tags.tag_id", "left")
+      ->where("items_tags.item_id", "=", $item->id)
+      ->find_all();
   }
 
   static function get_add_form($item) {
diff --git a/modules/tag/helpers/tag_event.php b/modules/tag/helpers/tag_event.php
index 6ee8e708..403ccd52 100644
--- a/modules/tag/helpers/tag_event.php
+++ b/modules/tag/helpers/tag_event.php
@@ -71,9 +71,13 @@ class tag_event_Core {
                 $('form input[id=tags]').autocomplete(
                   '$url', {max: 30, multiple: true, multipleSeparator: ',', cacheLength: 1});
               });");
-    $tag_value = implode(", ", tag::item_tags($item));
+
+    $tag_names = array();
+    foreach (tag::item_tags($item) as $tag) {
+      $tag_names[] = $tag->name;
+    }
     $form->edit_item->input("tags")->label(t("Tags (comma separated)"))
-      ->value($tag_value);
+      ->value(implode(", ", $tag_names));
   }
 
   static function item_edit_form_completed($item, $form) {
@@ -95,7 +99,9 @@ class tag_event_Core {
   }
 
   static function item_index_data($item, $data) {
-    $data[] = join(" ", tag::item_tags($item));
+    foreach (tag::item_tags($item) as $tag) {
+      $data[] = $tag->name;
+    }
   }
 
   static function add_photos_form($album, $form) {
diff --git a/modules/tag/helpers/tag_item_rest.php b/modules/tag/helpers/tag_item_rest.php
new file mode 100644
index 00000000..cd9bb6fe
--- /dev/null
+++ b/modules/tag/helpers/tag_item_rest.php
@@ -0,0 +1,50 @@
+<?php defined("SYSPATH") or die("No direct script access.");
+/**
+ * Gallery - a web based photo album viewer and editor
+ * Copyright (C) 2000-2009 Bharat Mediratta
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or (at
+ * your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+class tag_item_rest_Core {
+  static function get($request) {
+    list ($tag, $item) = rest::resolve($request->url);
+    return array(
+      "url" => $request->url,
+      "members" => array(
+        rest::url("tag", $tag),
+        rest::url("item", $item)));
+  }
+
+  static function delete($request) {
+    list ($tag, $item) = rest::resolve($request->url);
+    $tag->remove($item);
+    $tag->save();
+  }
+
+  static function resolve($tuple) {
+    list ($tag_id, $item_id) = split(",", $tuple);
+    $tag = ORM::factory("tag")->where("id", "=", $tag_id)->find();
+    $item = ORM::factory("item")->where("id", "=", $item_id)->find();
+    if (!$tag->loaded() || !$item->loaded() || !$tag->has($item)) {
+      throw new Kohana_404_Exception();
+    }
+
+    return array($tag, $item);
+  }
+
+  static function url($tag, $item) {
+    return url::abs_site("rest/tag_item/{$tag->id},{$item->id}");
+  }
+}
diff --git a/modules/tag/helpers/tag_rest.php b/modules/tag/helpers/tag_rest.php
index 0226c6d3..d68cb73d 100644
--- a/modules/tag/helpers/tag_rest.php
+++ b/modules/tag/helpers/tag_rest.php
@@ -20,12 +20,18 @@
 class tag_rest_Core {
   static function get($request) {
     $tag = rest::resolve($request->url);
-    $items = array();
+    $tag_items = array();
     foreach ($tag->items() as $item) {
-      $items[] = rest::url("gallery", $item);
+      if (access::can("view", $item)) {
+        $tag_items[] = rest::url("tag_item", $tag, $item);
+      }
     }
 
-    return array("resource" => $tag->as_array(), "members" => $items);
+    return array(
+      "url" => $request->url,
+      "resource" => $tag->as_array(),
+      "relationships" => array(
+        "items" => $tag_items));
   }
 
   static function post($request) {
@@ -38,37 +44,34 @@ class tag_rest_Core {
     access::required("edit", $item);
 
     tag::add($item, $tag->name);
-    return array("url" => rest::url("tag", $tag));
   }
 
   static function put($request) {
     $tag = rest::resolve($request->url);
     if (isset($request->params->name)) {
       $tag->name = $request->params->name;
+      $tag->save();
     }
-
-    $tag->save();
-    return array("url" => rest::url("tag", $tag));
   }
 
   static function delete($request) {
     $tag = rest::resolve($request->url);
+    $tag->delete();
+  }
 
-    if (empty($request->params->url)) {
-      // Delete the tag
-      $tag->delete();
-    } else {
-      // Remove an item from the tag
-      $item = rest::resolve($request->params->url);
-      access::required("edit", $item);
-      $tag->remove($item);
-      $tag->save();
-      tag::compact();
+  static function relationships($resource_type, $resource) {
+    switch ($resource_type) {
+    case "item":
+      $tags = array();
+      foreach (tag::item_tags($resource) as $tag) {
+        $tags[] = rest::url("tag_item", $tag, $resource);
+      }
+      return array("tags" => $tags);
     }
   }
 
-  static function resolve($tag_name) {
-    $tag = ORM::factory("tag")->where("name", "=", $tag_name)->find();
+  static function resolve($id) {
+    $tag = ORM::factory("tag")->where("id", "=", $id)->find();
     if (!$tag->loaded()) {
       throw new Kohana_404_Exception();
     }
@@ -77,6 +80,6 @@ class tag_rest_Core {
   }
 
   static function url($tag) {
-    return url::abs_site("rest/tag/" . rawurlencode($tag->name));
+    return url::abs_site("rest/tag/{$tag->id}");
   }
 }
diff --git a/modules/tag/helpers/tags_rest.php b/modules/tag/helpers/tags_rest.php
index 41317ecd..57461125 100644
--- a/modules/tag/helpers/tags_rest.php
+++ b/modules/tag/helpers/tags_rest.php
@@ -21,7 +21,7 @@ class tags_rest_Core {
   static function get($request) {
     $tags = array();
     foreach (ORM::factory("tag")->find_all() as $tag) {
-      $tags[$tag->name] = rest::url("tag", $tag);
+      $tags[] = rest::url("tag", $tag);
     }
     return array("members" => $tags);
   }
@@ -33,7 +33,7 @@ class tags_rest_Core {
     access::required("edit", item::root());
 
     if (empty($request->params->name)) {
-      throw new Rest_Exception("Bad Request: missing name", 400);
+      throw new Rest_Exception("Bad Request", 400);
     }
 
     $tag = ORM::factory("tag")->where("name", "=", $request->params->name)->find();
-- 
cgit v1.2.3


From cb8b31d70ccd4872b122c204095ca8a439487c5d Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 22 Jan 2010 00:49:05 -0800
Subject: Updated tests to pass after recent refactor of gallery_rest ->
 item_rest.

---
 modules/gallery/tests/Item_Rest_Helper_Test.php | 213 ++++++++++++++++++++++++
 1 file changed, 213 insertions(+)
 create mode 100644 modules/gallery/tests/Item_Rest_Helper_Test.php

diff --git a/modules/gallery/tests/Item_Rest_Helper_Test.php b/modules/gallery/tests/Item_Rest_Helper_Test.php
new file mode 100644
index 00000000..115d3b1b
--- /dev/null
+++ b/modules/gallery/tests/Item_Rest_Helper_Test.php
@@ -0,0 +1,213 @@
+<?php defined("SYSPATH") or die("No direct script access.");
+/**
+ * Gallery - a web based photo album viewer and editor
+ * Copyright (C) 2000-2009 Bharat Mediratta
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or (at
+ * your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+class Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
+  public function resolve_test() {
+    $album = test::random_album();
+    $resolved = rest::resolve(rest::url("item", $album));
+    $this->assert_equal($album->id, $resolved->id);
+  }
+
+  public function get_scope_test() {
+    $album1 = test::random_album();
+    $photo1 = test::random_photo($album1);
+    $album2 = test::random_album($album1);
+    $photo2 = test::random_photo($album2);
+    $album1->reload();
+
+    // No scope is the same as "direct"
+    $request->url = rest::url("item", $album1);
+    $request->params = new stdClass();
+    $this->assert_equal_array(
+      array("url" => rest::url("item", $album1),
+            "resource" => $album1->as_array(),
+            "members" => array(
+              rest::url("item", $photo1),
+              rest::url("item", $album2)),
+            "relationships" => array(
+              "tags" => array())),
+      item_rest::get($request));
+
+    $request->url = rest::url("item", $album1);
+    $request->params->scope = "direct";
+    $this->assert_equal_array(
+      array("url" => rest::url("item", $album1),
+            "resource" => $album1->as_array(),
+            "members" => array(
+              rest::url("item", $photo1),
+              rest::url("item", $album2)),
+            "relationships" => array(
+              "tags" => array())),
+      item_rest::get($request));
+
+    $request->url = rest::url("item", $album1);
+    $request->params->scope = "all";
+    $this->assert_equal_array(
+      array("url" => rest::url("item", $album1),
+            "resource" => $album1->as_array(),
+            "members" => array(
+              rest::url("item", $photo1),
+              rest::url("item", $album2),
+              rest::url("item", $photo2)),
+            "relationships" => array(
+              "tags" => array())),
+      item_rest::get($request));
+  }
+
+  public function get_children_like_test() {
+    $album1 = test::random_album();
+    $photo1 = test::random_photo($album1);
+    $photo2 = test::random_photo_unsaved($album1);
+    $photo2->name = "foo.jpg";
+    $photo2->save();
+    $album1->reload();
+
+    $request->url = rest::url("item", $album1);
+    $request->params->name = "foo";
+    $this->assert_equal_array(
+      array("url" => rest::url("item", $album1),
+            "resource" => $album1->as_array(),
+            "members" => array(
+              rest::url("item", $photo2)),
+            "relationships" => array(
+              "tags" => array())),
+      item_rest::get($request));
+  }
+
+  public function get_children_type_test() {
+    $album1 = test::random_album();
+    $photo1 = test::random_photo($album1);
+    $album2 = test::random_album($album1);
+    $album1->reload();
+
+    $request->url = rest::url("item", $album1);
+    $request->params->type = "album";
+    $this->assert_equal_array(
+      array("url" => rest::url("item", $album1),
+            "resource" => $album1->as_array(),
+            "members" => array(
+              rest::url("item", $album2)),
+            "relationships" => array(
+              "tags" => array())),
+      item_rest::get($request));
+  }
+
+  public function update_album_test() {
+    $album1 = test::random_album();
+    access::allow(identity::everybody(), "edit", $album1);
+
+    $request->url = rest::url("item", $album1);
+    $request->params->title = "my new title";
+
+    item_rest::put($request);
+    $this->assert_equal("my new title", $album1->reload()->title);
+  }
+
+  public function update_album_illegal_value_fails_test() {
+    $album1 = test::random_album();
+    access::allow(identity::everybody(), "edit", $album1);
+
+    $request->url = rest::url("item", $album1);
+    $request->params->title = "my new title";
+    $request->params->slug = "not url safe";
+
+    try {
+      item_rest::put($request);
+    } catch (ORM_Validation_Exception $e) {
+      $this->assert_equal(array("slug" => "not_url_safe"), $e->validation->errors());
+      return;
+    }
+    $this->assert_true(false, "Shouldn't get here");
+  }
+
+  public function add_album_test() {
+    $album1 = test::random_album();
+    access::allow(identity::everybody(), "edit", $album1);
+
+    $request->url = rest::url("item", $album1);
+    $request->params->type = "album";
+    $request->params->name = "my album";
+    $request->params->title = "my album";
+    $response = item_rest::post($request);
+    $new_album = rest::resolve($response["url"]);
+
+    $this->assert_true($new_album->is_album());
+    $this->assert_equal($album1->id, $new_album->parent_id);
+  }
+
+  public function add_album_illegal_value_fails_test() {
+    $album1 = test::random_album();
+    access::allow(identity::everybody(), "edit", $album1);
+
+    $request->url = rest::url("item", $album1);
+    $request->params->type = "album";
+    $request->params->name = "my album";
+    $request->params->title = "my album";
+    $request->params->slug = "not url safe";
+
+    try {
+      item_rest::post($request);
+    } catch (ORM_Validation_Exception $e) {
+      $this->assert_equal(array("slug" => "not_url_safe"), $e->validation->errors());
+      return;
+    }
+    $this->assert_true(false, "Shouldn't get here");
+  }
+
+
+  public function add_photo_test() {
+    $album1 = test::random_album();
+    access::allow(identity::everybody(), "edit", $album1);
+
+    $request->url = rest::url("item", $album1);
+    $request->params->type = "photo";
+    $request->params->name = "my photo.jpg";
+    $request->file = MODPATH . "gallery/tests/test.jpg";
+    $response = item_rest::post($request);
+    $new_photo = rest::resolve($response["url"]);
+
+    $this->assert_true($new_photo->is_photo());
+    $this->assert_equal($album1->id, $new_photo->parent_id);
+  }
+
+  public function delete_album_test() {
+    $album1 = test::random_album();
+    access::allow(identity::everybody(), "edit", $album1);
+
+    $request->url = rest::url("item", $album1);
+    item_rest::delete($request);
+
+    $album1->reload();
+    $this->assert_false($album1->loaded());
+  }
+
+  public function delete_album_fails_without_permission_test() {
+    $album1 = test::random_album();
+    access::deny(identity::everybody(), "edit", $album1);
+
+    $request->url = rest::url("item", $album1);
+    try {
+      item_rest::delete($request);
+    } catch (Exception $e) {
+      $this->assert_equal("@todo FORBIDDEN", $e->getMessage());
+      return;
+    }
+    $this->assert_true(false, "Shouldn't get here");
+  }
+}
-- 
cgit v1.2.3


From 27acb156bcd123e8a6dd751d6c80737e65a40f3a Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 22 Jan 2010 00:51:23 -0800
Subject: Updated tests to pass after recent refactor of tags_rest.

---
 modules/tag/tests/Tags_Rest_Helper_Test.php | 18 +++++++-----------
 1 file changed, 7 insertions(+), 11 deletions(-)

diff --git a/modules/tag/tests/Tags_Rest_Helper_Test.php b/modules/tag/tests/Tags_Rest_Helper_Test.php
index dd922013..33220b3b 100644
--- a/modules/tag/tests/Tags_Rest_Helper_Test.php
+++ b/modules/tag/tests/Tags_Rest_Helper_Test.php
@@ -22,24 +22,20 @@ class Tags_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     try {
       Database::instance()->query("TRUNCATE {tags}");
       Database::instance()->query("TRUNCATE {items_tags}");
-    } catch (Exception $e) { }
-    $this->_save = array($_GET, $_POST, $_SERVER);
-  }
-
-  public function teardown() {
-    list($_GET, $_POST, $_SERVER) = $this->_save;
+    } catch (Exception $e) {
+    }
   }
 
   public function get_test() {
-    tag::add(item::root(), "t1");
-    tag::add(item::root(), "t2");
+    $t1 = tag::add(item::root(), "t1");
+    $t2 = tag::add(item::root(), "t2");
 
     $request = new stdClass();
     $this->assert_equal_array(
       array(
         "members" => array(
-          "t1" => rest::url("tag", ORM::factory("tag")->where("name", "=", "t1")->find()),
-          "t2" => rest::url("tag", ORM::factory("tag")->where("name", "=", "t2")->find()))),
+          rest::url("tag", $t1),
+          rest::url("tag", $t2))),
       tags_rest::get($request));
   }
 
@@ -48,7 +44,7 @@ class Tags_Rest_Helper_Test extends Gallery_Unit_Test_Case {
 
     $request->params->name = "test tag";
     $this->assert_equal(
-      array("url" => url::site("rest/tag/test%20tag")),
+      array("url" => url::site("rest/tag/1")),
       tags_rest::post($request));
   }
 
-- 
cgit v1.2.3


From a0c6d055d1b7259667bebb1b5bf9e2a99c0f8260 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 22 Jan 2010 00:53:44 -0800
Subject: output_type --> output

---
 modules/rest/helpers/rest.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/rest/helpers/rest.php b/modules/rest/helpers/rest.php
index fe704a9e..0d2ec9d4 100644
--- a/modules/rest/helpers/rest.php
+++ b/modules/rest/helpers/rest.php
@@ -22,7 +22,7 @@ class rest_Core {
     Session::abort_save();
 
     if ($data) {
-      if (Input::instance()->get("output_type") == "html") {
+      if (Input::instance()->get("output") == "html") {
         header("Content-type: text/html");
         $html = preg_replace(
           "#(^|[\n ])([\w]+?://[\w]+[^ \"\n\r\t<]*)#ise", "'\\1<a href=\"\\2\" >\\2</a>'",
@@ -112,8 +112,8 @@ class rest_Core {
     }
 
     $url = call_user_func_array(array($class, "url"), $args);
-    if (Input::instance()->get("output_type") == "html") {
-      $url .= "?output_type=html";
+    if (Input::instance()->get("output") == "html") {
+      $url .= "?output=html";
     }
     return $url;
   }
-- 
cgit v1.2.3


From 10dfe9767d596b1c0e90462cd9d8887b3381851a Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 22 Jan 2010 00:59:37 -0800
Subject: Updated tests to pass after recent refactor of tag_rest.

---
 modules/tag/tests/Tag_Rest_Helper_Test.php | 61 +++++++-----------------------
 1 file changed, 13 insertions(+), 48 deletions(-)

diff --git a/modules/tag/tests/Tag_Rest_Helper_Test.php b/modules/tag/tests/Tag_Rest_Helper_Test.php
index 427d1a71..cbd7b6cd 100644
--- a/modules/tag/tests/Tag_Rest_Helper_Test.php
+++ b/modules/tag/tests/Tag_Rest_Helper_Test.php
@@ -23,11 +23,6 @@ class Tag_Rest_Helper_Test extends Gallery_Unit_Test_Case {
       Database::instance()->query("TRUNCATE {tags}");
       Database::instance()->query("TRUNCATE {items_tags}");
     } catch (Exception $e) { }
-    $this->_save = array($_GET, $_POST, $_SERVER);
-  }
-
-  public function teardown() {
-    list($_GET, $_POST, $_SERVER) = $this->_save;
   }
 
   public function get_test() {
@@ -35,8 +30,11 @@ class Tag_Rest_Helper_Test extends Gallery_Unit_Test_Case {
 
     $request->url = rest::url("tag", $tag);
     $this->assert_equal_array(
-      array("resource" => $tag->as_array(),
-            "members" => array(rest::url("gallery", item::root()))),
+      array("url" => rest::url("tag", $tag),
+            "resource" => $tag->as_array(),
+            "relationships" => array(
+              "items" => array(
+                rest::url("tag_item", $tag, item::root())))),
       tag_rest::get($request));
   }
 
@@ -50,12 +48,15 @@ class Tag_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $this->assert_true(false, "Shouldn't get here");
   }
 
-  public function get_with_no_members_test() {
+  public function get_with_no_relationships_test() {
     $tag = test::random_tag();
 
     $request->url = rest::url("tag", $tag);
     $this->assert_equal_array(
-      array("resource" => $tag->as_array(), "members" => array()),
+      array("url" => rest::url("tag", $tag),
+            "resource" => $tag->as_array(),
+            "relationships" => array(
+              "items" => array())),
       tag_rest::get($request));
   }
 
@@ -68,9 +69,9 @@ class Tag_Rest_Helper_Test extends Gallery_Unit_Test_Case {
 
     // Add the album to the tag
     $request->url = rest::url("tag", $tag);
-    $request->params->url = rest::url("gallery", $album);
+    $request->params->url = rest::url("item", $album);
     $this->assert_equal_array(
-      array("url" => rest::url("tag", $tag)),
+      array("url" => rest::url("tag_item", $tag, $album)),
       tag_rest::post($request));
   }
 
@@ -91,9 +92,7 @@ class Tag_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $request->url = rest::url("tag", $tag);
     $request->params->name = "new name";
 
-    $this->assert_equal_array(
-      array("url" => str_replace($tag->name, "new%20name", rest::url("tag", $tag))),
-      tag_rest::put($request));
+    tag_rest::put($request);
     $this->assert_equal("new name", $tag->reload()->name);
   }
 
@@ -105,40 +104,6 @@ class Tag_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $this->assert_false($tag->reload()->loaded());
   }
 
-  public function delete_item_from_tag_test() {
-    $album = test::random_album();
-    access::allow(identity::everybody(), "edit", $album);
-
-    $tag = tag::add($album, "tag1");
-    $this->assert_equal(1, $tag->items()->count());
-
-    $request->url = rest::url("tag", $tag);
-    $request->params->url = rest::url("gallery", $album);
-    tag_rest::delete($request);
-
-    $this->assert_equal(0, $tag->items()->count());
-  }
-
-  public function delete_item_from_tag_fails_without_permissions_test() {
-    $album = test::random_album();
-    $tag = tag::add($album, "tag1");
-    $this->assert_equal(1, $tag->items()->count());
-
-    access::deny(identity::everybody(), "edit", $album);
-
-    $request->url = rest::url("tag", $tag);
-    $request->params->url = rest::url("gallery", $album);
-
-    try {
-      tag_rest::delete($request);
-    } catch (Exception $e) {
-      $this->assert_equal(403, $e->getCode());
-      return;
-    }
-
-    $this->assert_true(false, "Shouldn't get here");
-  }
-
   public function resolve_test() {
     $tag = test::random_tag();
 
-- 
cgit v1.2.3


From ca909a49ae16dc1d5a0d8448f84c32c7900ba06e Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 22 Jan 2010 01:09:38 -0800
Subject: New tests for tag_item_rest

---
 modules/tag/tests/Tag_Item_Rest_Helper_Test.php | 68 +++++++++++++++++++++++++
 1 file changed, 68 insertions(+)
 create mode 100644 modules/tag/tests/Tag_Item_Rest_Helper_Test.php

diff --git a/modules/tag/tests/Tag_Item_Rest_Helper_Test.php b/modules/tag/tests/Tag_Item_Rest_Helper_Test.php
new file mode 100644
index 00000000..6c49ad67
--- /dev/null
+++ b/modules/tag/tests/Tag_Item_Rest_Helper_Test.php
@@ -0,0 +1,68 @@
+<?php defined("SYSPATH") or die("No direct script access.");
+/**
+ * Gallery - a web based photo album viewer and editor
+ * Copyright (C) 2000-2009 Bharat Mediratta
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or (at
+ * your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+class Tag_Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
+  public function setup() {
+    try {
+      Database::instance()->query("TRUNCATE {tags}");
+      Database::instance()->query("TRUNCATE {items_tags}");
+    } catch (Exception $e) { }
+  }
+
+  public function get_test() {
+    $tag = tag::add(item::root(), "tag1")->reload();
+
+    $request->url = rest::url("tag_item", $tag, item::root());
+    $this->assert_equal_array(
+      array("url" => rest::url("tag_item", $tag, item::root()),
+            "members" => array(
+              rest::url("tag", $tag),
+              rest::url("item", item::root()))),
+      tag_item_rest::get($request));
+  }
+
+  public function get_with_invalid_url_test() {
+    $request->url = "bogus";
+    try {
+      tag_item_rest::get($request);
+    } catch (Kohana_404_Exception $e) {
+      return;  // pass
+    }
+    $this->assert_true(false, "Shouldn't get here");
+  }
+
+  public function delete_test() {
+    $tag = tag::add(item::root(), "tag1")->reload();
+
+    $request->url = rest::url("tag_item", $tag, item::root());
+    tag_item_rest::delete($request);
+
+    $this->assert_false($tag->reload()->has(item::root()));
+  }
+
+  public function resolve_test() {
+    $album = test::random_album();
+    $tag = tag::add($album, "tag1")->reload();
+
+
+    $tuple = rest::resolve(rest::url("tag_item", $tag, $album));
+    $this->assert_equal_array($tag->as_array(), $tuple[0]->as_array());
+    $this->assert_equal_array($album->as_array(), $tuple[1]->as_array());
+  }
+}
-- 
cgit v1.2.3


From a445a64bcbfc5df45f255e02d3295156e199832d Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 22 Jan 2010 01:10:00 -0800
Subject: Return the url of the newly created item from post().

---
 modules/tag/helpers/tag_rest.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/tag/helpers/tag_rest.php b/modules/tag/helpers/tag_rest.php
index d68cb73d..5feeb756 100644
--- a/modules/tag/helpers/tag_rest.php
+++ b/modules/tag/helpers/tag_rest.php
@@ -44,6 +44,7 @@ class tag_rest_Core {
     access::required("edit", $item);
 
     tag::add($item, $tag->name);
+    return array("url" => rest::url("tag_item", $tag, $item));
   }
 
   static function put($request) {
-- 
cgit v1.2.3


From 0efbfcbe61e26cb53cb0719ced3c5c436f128386 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 22 Jan 2010 01:10:31 -0800
Subject: Return the url of the newly created item from post().

Don't try to access ORM::$changed -- it's protected.
---
 modules/gallery/helpers/item_rest.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/gallery/helpers/item_rest.php b/modules/gallery/helpers/item_rest.php
index edc44c45..9598b191 100644
--- a/modules/gallery/helpers/item_rest.php
+++ b/modules/gallery/helpers/item_rest.php
@@ -98,9 +98,7 @@ class item_rest_Core {
         $item->$key = $request->params->$key;
       }
     }
-    if ($item->changed) {
-      $item->save();
-    }
+    $item->save();
   }
 
   static function post($request) {
@@ -135,6 +133,8 @@ class item_rest_Core {
     default:
       throw new Rest_Exception("Invalid type: $params->type", 400);
     }
+
+    return array("url" => rest::url("item", $item));
   }
 
   static function delete($request) {
-- 
cgit v1.2.3


From 61198c22aaae8bdeff8dfbe3bfaedc1320dfdab1 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 22 Jan 2010 01:10:52 -0800
Subject: Reload items after saving so that we convert their members to
 strings.

---
 modules/gallery_unit_test/helpers/test.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/gallery_unit_test/helpers/test.php b/modules/gallery_unit_test/helpers/test.php
index 94dac22e..3e116808 100644
--- a/modules/gallery_unit_test/helpers/test.php
+++ b/modules/gallery_unit_test/helpers/test.php
@@ -30,7 +30,7 @@ class test_Core {
   }
 
   static function random_album($parent=null) {
-    return test::random_album_unsaved($parent)->save();
+    return test::random_album_unsaved($parent)->save()->reload();
   }
 
   static function random_photo_unsaved($parent=null) {
@@ -45,7 +45,7 @@ class test_Core {
   }
 
   static function random_photo($parent=null) {
-    return test::random_photo_unsaved($parent)->save();
+    return test::random_photo_unsaved($parent)->save()->reload();
   }
 
   static function random_user($password="password") {
-- 
cgit v1.2.3


From 25dc3e1a7bc7736363ca642a6e67ac1644266f68 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 22 Jan 2010 01:11:03 -0800
Subject: Moved to Item_Rest_Helper_Test.php

---
 modules/gallery/tests/Gallery_Rest_Helper_Test.php | 208 ---------------------
 1 file changed, 208 deletions(-)
 delete mode 100644 modules/gallery/tests/Gallery_Rest_Helper_Test.php

diff --git a/modules/gallery/tests/Gallery_Rest_Helper_Test.php b/modules/gallery/tests/Gallery_Rest_Helper_Test.php
deleted file mode 100644
index 7586e010..00000000
--- a/modules/gallery/tests/Gallery_Rest_Helper_Test.php
+++ /dev/null
@@ -1,208 +0,0 @@
-<?php defined("SYSPATH") or die("No direct script access.");
-/**
- * Gallery - a web based photo album viewer and editor
- * Copyright (C) 2000-2009 Bharat Mediratta
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or (at
- * your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
- */
-class Gallery_Rest_Helper_Test extends Gallery_Unit_Test_Case {
-  public function setup() {
-    $this->_save = array($_GET, $_POST, $_SERVER, $_FILES);
-  }
-
-  public function teardown() {
-    list($_GET, $_POST, $_SERVER, $_FILES) = $this->_save;
-  }
-
-  public function resolve_test() {
-    $album = test::random_album();
-    $resolved = rest::resolve(rest::url("gallery", $album));
-    $this->assert_equal($album->id, $resolved->id);
-  }
-
-  public function get_scope_test() {
-    $album1 = test::random_album();
-    $photo1 = test::random_photo($album1);
-    $album2 = test::random_album($album1);
-    $photo2 = test::random_photo($album2);
-    $album1->reload();
-
-    // No scope is the same as "direct"
-    $request->url = rest::url("gallery", $album1);
-    $request->params = new stdClass();
-    $this->assert_equal_array(
-      array("resource" => $album1->as_array(),
-            "members" => array(
-              rest::url("gallery", $photo1),
-              rest::url("gallery", $album2))),
-      gallery_rest::get($request));
-
-    $request->url = rest::url("gallery", $album1);
-    $request->params->scope = "direct";
-    $this->assert_equal_array(
-      array("resource" => $album1->as_array(),
-            "members" => array(
-              rest::url("gallery", $photo1),
-              rest::url("gallery", $album2))),
-      gallery_rest::get($request));
-
-    $request->url = rest::url("gallery", $album1);
-    $request->params->scope = "all";
-    $this->assert_equal_array(
-      array("resource" => $album1->as_array(),
-            "members" => array(
-              rest::url("gallery", $photo1),
-              rest::url("gallery", $album2),
-              rest::url("gallery", $photo2))),
-      gallery_rest::get($request));
-  }
-
-  public function get_children_like_test() {
-    $album1 = test::random_album();
-    $photo1 = test::random_photo($album1);
-    $photo2 = test::random_photo_unsaved($album1);
-    $photo2->name = "foo.jpg";
-    $photo2->save();
-    $album1->reload();
-
-    $request->url = rest::url("gallery", $album1);
-    $request->params->name = "foo";
-    $this->assert_equal_array(
-      array("resource" => $album1->as_array(),
-            "members" => array(
-              rest::url("gallery", $photo2))),
-      gallery_rest::get($request));
-  }
-
-  public function get_children_type_test() {
-    $album1 = test::random_album();
-    $photo1 = test::random_photo($album1);
-    $album2 = test::random_album($album1);
-    $album1->reload();
-
-    $request->url = rest::url("gallery", $album1);
-    $request->params->type = "album";
-    $this->assert_equal_array(
-      array("resource" => $album1->as_array(),
-            "members" => array(
-              rest::url("gallery", $album2))),
-      gallery_rest::get($request));
-  }
-
-  public function update_album_test() {
-    $album1 = test::random_album();
-    access::allow(identity::everybody(), "edit", $album1);
-
-    $request->url = rest::url("gallery", $album1);
-    $request->params->title = "my new title";
-
-    $this->assert_equal_array(
-      array("url" => rest::url("gallery", $album1)),
-      gallery_rest::put($request));
-    $this->assert_equal("my new title", $album1->reload()->title);
-  }
-
-  public function update_album_illegal_value_fails_test() {
-    $album1 = test::random_album();
-    access::allow(identity::everybody(), "edit", $album1);
-
-    $request->url = rest::url("gallery", $album1);
-    $request->params->title = "my new title";
-    $request->params->slug = "not url safe";
-
-    try {
-      gallery_rest::put($request);
-    } catch (ORM_Validation_Exception $e) {
-      $this->assert_equal(array("slug" => "not_url_safe"), $e->validation->errors());
-      return;
-    }
-    $this->assert_true(false, "Shouldn't get here");
-  }
-
-  public function add_album_test() {
-    $album1 = test::random_album();
-    access::allow(identity::everybody(), "edit", $album1);
-
-    $request->url = rest::url("gallery", $album1);
-    $request->params->type = "album";
-    $request->params->name = "my album";
-    $request->params->title = "my album";
-    $response = gallery_rest::post($request);
-    $new_album = rest::resolve($response["url"]);
-
-    $this->assert_true($new_album->is_album());
-    $this->assert_equal($album1->id, $new_album->parent_id);
-  }
-
-  public function add_album_illegal_value_fails_test() {
-    $album1 = test::random_album();
-    access::allow(identity::everybody(), "edit", $album1);
-
-    $request->url = rest::url("gallery", $album1);
-    $request->params->type = "album";
-    $request->params->name = "my album";
-    $request->params->title = "my album";
-    $request->params->slug = "not url safe";
-
-    try {
-      gallery_rest::post($request);
-    } catch (ORM_Validation_Exception $e) {
-      $this->assert_equal(array("slug" => "not_url_safe"), $e->validation->errors());
-      return;
-    }
-    $this->assert_true(false, "Shouldn't get here");
-  }
-
-
-  public function add_photo_test() {
-    $album1 = test::random_album();
-    access::allow(identity::everybody(), "edit", $album1);
-
-    $request->url = rest::url("gallery", $album1);
-    $request->params->type = "photo";
-    $request->params->name = "my photo.jpg";
-    $request->file = MODPATH . "gallery/tests/test.jpg";
-    $response = gallery_rest::post($request);
-    $new_photo = rest::resolve($response["url"]);
-
-    $this->assert_true($new_photo->is_photo());
-    $this->assert_equal($album1->id, $new_photo->parent_id);
-  }
-
-  public function delete_album_test() {
-    $album1 = test::random_album();
-    access::allow(identity::everybody(), "edit", $album1);
-
-    $request->url = rest::url("gallery", $album1);
-    gallery_rest::delete($request);
-
-    $album1->reload();
-    $this->assert_false($album1->loaded());
-  }
-
-  public function delete_album_fails_without_permission_test() {
-    $album1 = test::random_album();
-    access::deny(identity::everybody(), "edit", $album1);
-
-    $request->url = rest::url("gallery", $album1);
-    try {
-      gallery_rest::delete($request);
-    } catch (Exception $e) {
-      $this->assert_equal("@todo FORBIDDEN", $e->getMessage());
-      return;
-    }
-    $this->assert_true(false, "Shouldn't get here");
-  }
-}
-- 
cgit v1.2.3


From e56318d07fe3cabcace5c4597c660260f80a0e00 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 22 Jan 2010 01:48:03 -0800
Subject: Don't try to access ORM::$changed externally; it's protected.

---
 modules/user/controllers/users.php | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/modules/user/controllers/users.php b/modules/user/controllers/users.php
index b1c05efa..b1ac1944 100644
--- a/modules/user/controllers/users.php
+++ b/modules/user/controllers/users.php
@@ -32,7 +32,12 @@ class Users_Controller extends Controller {
       $user->password = $form->edit_user->password->value;
       $user->email = $form->edit_user->email->value;
       $user->url = $form->edit_user->url->value;
-      $user->locale = $form->edit_user->locale->value;
+
+      if ($user->locale !=  $form->edit_user->locale->value) {
+        $user->locale = $form->edit_user->locale->value;
+        $flush_locale_cookie = true;
+      }
+
       $user->validate();
     } catch (ORM_Validation_Exception $e) {
       // Translate ORM validation errors into form error messages
@@ -43,7 +48,7 @@ class Users_Controller extends Controller {
     }
 
     if ($valid) {
-      if (isset($user->changed["locale"])) {
+      if (isset($flush_locale_cookie)) {
         // Delete the session based locale preference
         setcookie("g_locale", "", time() - 24 * 3600, "/");
       }
-- 
cgit v1.2.3


From eea27c39f1cc7edb9ad0f9682bedfb2770661a7f Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 22 Jan 2010 09:43:02 -0800
Subject: Create symmetrical relationship collections: item_tags and tag_items
 Now when we represent a relationship collection we can refer to it in proper
 semantic terms.

---
 modules/tag/helpers/item_tags_rest.php | 51 ++++++++++++++++++++++++++++++++++
 modules/tag/helpers/tag_items_rest.php | 48 ++++++++++++++++++++++++++++++++
 modules/tag/helpers/tag_rest.php       |  6 +++-
 3 files changed, 104 insertions(+), 1 deletion(-)
 create mode 100644 modules/tag/helpers/item_tags_rest.php
 create mode 100644 modules/tag/helpers/tag_items_rest.php

diff --git a/modules/tag/helpers/item_tags_rest.php b/modules/tag/helpers/item_tags_rest.php
new file mode 100644
index 00000000..385d06e8
--- /dev/null
+++ b/modules/tag/helpers/item_tags_rest.php
@@ -0,0 +1,51 @@
+<?php defined("SYSPATH") or die("No direct script access.");
+/**
+ * Gallery - a web based photo album viewer and editor
+ * Copyright (C) 2000-2009 Bharat Mediratta
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or (at
+ * your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+class item_tags_rest_Core {
+  static function get($request) {
+    $item = rest::resolve($request->url);
+    $tags = array();
+    foreach (tag::item_tags($item) as $tag) {
+      $tags[] = rest::url("tag_item", $tag, $item);
+    }
+
+    return array(
+      "url" => $request->url,
+      "members" => $tags);
+  }
+
+  static function delete($request) {
+    list ($tag, $item) = rest::resolve($request->url);
+    $tag->remove($item);
+    $tag->save();
+  }
+
+  static function resolve($id) {
+    $item = ORM::factory("item")->where("id", "=", $id)->find();
+    if (!access::can("view", $item)) {
+      throw new Kohana_404_Exception();
+    }
+
+    return $item;
+  }
+
+  static function url($item) {
+    return url::abs_site("rest/item_tags/{$item->id}");
+  }
+}
diff --git a/modules/tag/helpers/tag_items_rest.php b/modules/tag/helpers/tag_items_rest.php
new file mode 100644
index 00000000..2a00c565
--- /dev/null
+++ b/modules/tag/helpers/tag_items_rest.php
@@ -0,0 +1,48 @@
+<?php defined("SYSPATH") or die("No direct script access.");
+/**
+ * Gallery - a web based photo album viewer and editor
+ * Copyright (C) 2000-2009 Bharat Mediratta
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or (at
+ * your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+class tag_items_rest_Core {
+  static function get($request) {
+    $tag = rest::resolve($request->url);
+    $items = array();
+    foreach ($tag->items() as $item) {
+      if (access::can("view", $item)) {
+        $items[] = rest::url("tag_item", $tag, $item);
+      }
+    }
+
+    return array(
+      "url" => $request->url,
+      "members" => $items);
+  }
+
+  static function delete($request) {
+    list ($tag, $item) = rest::resolve($request->url);
+    $tag->remove($item);
+    $tag->save();
+  }
+
+  static function resolve($id) {
+    return ORM::factory("tag")->where("id", "=", $id)->find();
+  }
+
+  static function url($tag) {
+    return url::abs_site("rest/tag_items/{$tag->id}");
+  }
+}
diff --git a/modules/tag/helpers/tag_rest.php b/modules/tag/helpers/tag_rest.php
index 5feeb756..4fe9bef9 100644
--- a/modules/tag/helpers/tag_rest.php
+++ b/modules/tag/helpers/tag_rest.php
@@ -31,6 +31,7 @@ class tag_rest_Core {
       "url" => $request->url,
       "resource" => $tag->as_array(),
       "relationships" => array(
+        "url" => rest::url("tag_items", $tag),
         "items" => $tag_items));
   }
 
@@ -67,7 +68,10 @@ class tag_rest_Core {
       foreach (tag::item_tags($resource) as $tag) {
         $tags[] = rest::url("tag_item", $tag, $resource);
       }
-      return array("tags" => $tags);
+      return array(
+        "tags" => array(
+          "url" => rest::url("item_tags", $resource),
+          "members" => $tags));
     }
   }
 
-- 
cgit v1.2.3


From 4960061b562a0d5adafd767af7856d1a80a549a6 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 23 Jan 2010 11:35:26 -0800
Subject: Don't use ORM_MPTT::move_to directly, it's protected.

---
 modules/gallery/tests/ORM_MPTT_Test.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/gallery/tests/ORM_MPTT_Test.php b/modules/gallery/tests/ORM_MPTT_Test.php
index 8c850a86..5e741537 100644
--- a/modules/gallery/tests/ORM_MPTT_Test.php
+++ b/modules/gallery/tests/ORM_MPTT_Test.php
@@ -90,7 +90,8 @@ class ORM_MPTT_Test extends Gallery_Unit_Test_Case {
     $album3 = test::random_album($album2);
 
     try {
-      $album1->move_to($album3);
+      $album1->parent_id = $album3->id;
+      $album1->save();
       $this->assert_true(false, "We should be unable to move an item inside its own hierarchy");
     } catch (Exception $e) {
       // pass
-- 
cgit v1.2.3


From a60969401852ddda878bd2a3444d6378899d4dcc Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 23 Jan 2010 12:13:14 -0800
Subject: Update tests for recent REST changes.

---
 modules/gallery/tests/Item_Rest_Helper_Test.php | 20 +++++++++++++++-----
 modules/rest/tests/Rest_Controller_Test.php     |  2 +-
 modules/tag/helpers/tag_rest.php                |  5 +++--
 modules/tag/tests/Tag_Rest_Helper_Test.php      |  8 ++++++--
 4 files changed, 25 insertions(+), 10 deletions(-)

diff --git a/modules/gallery/tests/Item_Rest_Helper_Test.php b/modules/gallery/tests/Item_Rest_Helper_Test.php
index 115d3b1b..8ce6bc43 100644
--- a/modules/gallery/tests/Item_Rest_Helper_Test.php
+++ b/modules/gallery/tests/Item_Rest_Helper_Test.php
@@ -41,7 +41,9 @@ class Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
               rest::url("item", $photo1),
               rest::url("item", $album2)),
             "relationships" => array(
-              "tags" => array())),
+              "tags" => array(
+                "url" => rest::url("item_tags", $album1),
+                "members" => array()))),
       item_rest::get($request));
 
     $request->url = rest::url("item", $album1);
@@ -53,7 +55,9 @@ class Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
               rest::url("item", $photo1),
               rest::url("item", $album2)),
             "relationships" => array(
-              "tags" => array())),
+              "tags" => array(
+                "url" => rest::url("item_tags", $album1),
+                "members" => array()))),
       item_rest::get($request));
 
     $request->url = rest::url("item", $album1);
@@ -66,7 +70,9 @@ class Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
               rest::url("item", $album2),
               rest::url("item", $photo2)),
             "relationships" => array(
-              "tags" => array())),
+              "tags" => array(
+                "url" => rest::url("item_tags", $album1),
+                "members" => array()))),
       item_rest::get($request));
   }
 
@@ -86,7 +92,9 @@ class Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
             "members" => array(
               rest::url("item", $photo2)),
             "relationships" => array(
-              "tags" => array())),
+              "tags" => array(
+                "url" => rest::url("item_tags", $album1),
+                "members" => array()))),
       item_rest::get($request));
   }
 
@@ -104,7 +112,9 @@ class Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
             "members" => array(
               rest::url("item", $album2)),
             "relationships" => array(
-              "tags" => array())),
+              "tags" => array(
+                "url" => rest::url("item_tags", $album1),
+                "members" => array() ))),
       item_rest::get($request));
   }
 
diff --git a/modules/rest/tests/Rest_Controller_Test.php b/modules/rest/tests/Rest_Controller_Test.php
index 377f5334..5e624112 100644
--- a/modules/rest/tests/Rest_Controller_Test.php
+++ b/modules/rest/tests/Rest_Controller_Test.php
@@ -130,7 +130,7 @@ class Rest_Controller_Test extends Gallery_Unit_Test_Case {
     try {
       test::call_and_capture(array(new Rest_Controller(), "mock"));
     } catch (Exception $e) {
-      $this->assert_equal(403, $e->getCode());
+      $this->assert_equal(400, $e->getCode());
       return;
     }
     $this->assert_true(false, "Shouldn't get here");
diff --git a/modules/tag/helpers/tag_rest.php b/modules/tag/helpers/tag_rest.php
index 4fe9bef9..4b2a4b46 100644
--- a/modules/tag/helpers/tag_rest.php
+++ b/modules/tag/helpers/tag_rest.php
@@ -31,8 +31,9 @@ class tag_rest_Core {
       "url" => $request->url,
       "resource" => $tag->as_array(),
       "relationships" => array(
-        "url" => rest::url("tag_items", $tag),
-        "items" => $tag_items));
+        "items" => array(
+          "url" => rest::url("tag_items", $tag),
+          "members" => $tag_items)));
   }
 
   static function post($request) {
diff --git a/modules/tag/tests/Tag_Rest_Helper_Test.php b/modules/tag/tests/Tag_Rest_Helper_Test.php
index cbd7b6cd..eacf91b3 100644
--- a/modules/tag/tests/Tag_Rest_Helper_Test.php
+++ b/modules/tag/tests/Tag_Rest_Helper_Test.php
@@ -34,7 +34,9 @@ class Tag_Rest_Helper_Test extends Gallery_Unit_Test_Case {
             "resource" => $tag->as_array(),
             "relationships" => array(
               "items" => array(
-                rest::url("tag_item", $tag, item::root())))),
+                "url" => rest::url("tag_items", $tag),
+                "members" => array(
+                  rest::url("tag_item", $tag, item::root()))))),
       tag_rest::get($request));
   }
 
@@ -56,7 +58,9 @@ class Tag_Rest_Helper_Test extends Gallery_Unit_Test_Case {
       array("url" => rest::url("tag", $tag),
             "resource" => $tag->as_array(),
             "relationships" => array(
-              "items" => array())),
+              "items" => array(
+                "url" => rest::url("tag_items", $tag),
+                "members" => array()))),
       tag_rest::get($request));
   }
 
-- 
cgit v1.2.3


From d4308e4d35a585a1ce17e4340894e520268260b7 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 23 Jan 2010 12:16:04 -0800
Subject: Updated

---
 modules/gallery/tests/xss_data.txt | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/modules/gallery/tests/xss_data.txt b/modules/gallery/tests/xss_data.txt
index 1530c73e..5f6e8520 100644
--- a/modules/gallery/tests/xss_data.txt
+++ b/modules/gallery/tests/xss_data.txt
@@ -98,10 +98,14 @@ modules/gallery/views/admin_maintenance.html.php             158 DIRTY    $task-
 modules/gallery/views/admin_maintenance_show_log.html.php    8   DIRTY_JS url::site("admin/maintenance/save_log/$task->id?csrf=$csrf")
 modules/gallery/views/admin_maintenance_show_log.html.php    13  DIRTY    $task->name
 modules/gallery/views/admin_maintenance_task.html.php        55  DIRTY    $task->name
-modules/gallery/views/admin_modules.html.php                 10  DIRTY    access::csrf_form_field()
-modules/gallery/views/admin_modules.html.php                 19  DIRTY_ATTR text::alternate("g-odd","g-even")
-modules/gallery/views/admin_modules.html.php                 22  DIRTY    form::checkbox($data,'1',module::is_active($module_name))
-modules/gallery/views/admin_modules.html.php                 24  DIRTY    $module_info->version
+modules/gallery/views/admin_modules.html.php                 48  DIRTY    access::csrf_form_field()
+modules/gallery/views/admin_modules.html.php                 57  DIRTY_ATTR text::alternate("g-odd","g-even")
+modules/gallery/views/admin_modules.html.php                 60  DIRTY    form::checkbox($data,'1',module::is_active($module_name))
+modules/gallery/views/admin_modules.html.php                 62  DIRTY    $module_info->version
+modules/gallery/views/admin_modules_confirm.html.php         11  DIRTY_ATTR $class
+modules/gallery/views/admin_modules_confirm.html.php         11  DIRTY    $message
+modules/gallery/views/admin_modules_confirm.html.php         16  DIRTY    access::csrf_form_field()
+modules/gallery/views/admin_modules_confirm.html.php         18  DIRTY    form::hidden($module,1)
 modules/gallery/views/admin_sidebar.html.php                 50  DIRTY    $available
 modules/gallery/views/admin_sidebar.html.php                 58  DIRTY    $active
 modules/gallery/views/admin_sidebar_blocks.html.php          4   DIRTY_ATTR $ref
-- 
cgit v1.2.3


From eb32e1052df4da268f01a84b809d756d9c9b85b7 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 23 Jan 2010 16:44:30 -0800
Subject: Fix typo: change $entryr to $entry->user

---
 modules/gallery/views/admin_block_log_entries.html.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/gallery/views/admin_block_log_entries.html.php b/modules/gallery/views/admin_block_log_entries.html.php
index 90ce88a7..453724cb 100644
--- a/modules/gallery/views/admin_block_log_entries.html.php
+++ b/modules/gallery/views/admin_block_log_entries.html.php
@@ -2,7 +2,7 @@
 <ul>
   <? foreach ($entries as $entry): ?>
   <li class="<?= log::severity_class($entry->severity) ?>" style="direction: ltr">
-    <a href="<?= user_profile::url($entryr->id) ?>"><?= html::clean($entry->user->name) ?></a>
+    <a href="<?= user_profile::url($entry->user->id) ?>"><?= html::clean($entry->user->name) ?></a>
     <?= gallery::date_time($entry->timestamp) ?>
     <?= $entry->message ?>
     <?= $entry->html ?>
-- 
cgit v1.2.3


From 7096c2912460d2a92e71f2df0effe29ac37faf12 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 23 Jan 2010 17:07:09 -0800
Subject: Switch to model based validation.

---
 modules/server_add/controllers/server_add.php | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/modules/server_add/controllers/server_add.php b/modules/server_add/controllers/server_add.php
index d93b63a3..4d6d5dfe 100644
--- a/modules/server_add/controllers/server_add.php
+++ b/modules/server_add/controllers/server_add.php
@@ -24,7 +24,7 @@ class Server_Add_Controller extends Admin_Controller {
       $files[] = $path;
     }
 
-    $item = ORM::factory("item", $id);
+    $item = ORM::factory("item")->where("id", "=", $id)->find();
     $view = new View("server_add_tree_dialog.html");
     $view->item = $item;
     $view->tree = new View("server_add_tree.html");
@@ -78,7 +78,7 @@ class Server_Add_Controller extends Admin_Controller {
    */
   public function start() {
     access::verify_csrf();
-    $item = ORM::factory("item", Input::instance()->get("item_id"));
+    $item = ORM::factory("item")->where("id", "=", Input::instance()->get("item_id"))->find();
 
     foreach (Input::instance()->post("paths") as $path) {
       if (server_add::is_valid_path($path)) {
@@ -104,7 +104,7 @@ class Server_Add_Controller extends Admin_Controller {
   function run($task_id) {
     access::verify_csrf();
 
-    $task = ORM::factory("task", $task_id);
+    $task = ORM::factory("task")->where("id", "=", $task_id)->find();
     if (!$task->loaded() || $task->owner_id != identity::active_user()->id) {
       access::forbidden();
     }
@@ -216,11 +216,12 @@ class Server_Add_Controller extends Admin_Controller {
 
         // Look up the parent item for this entry.  By now it should exist, but if none was
         // specified, then this belongs as a child of the current item.
-        $parent_entry = ORM::factory("server_add_file", $entry->parent_id);
+        $parent_entry =
+          ORM::factory("server_add_file")->where("id", "=", $entry->parent_id)->find();
         if (!$parent_entry->loaded()) {
-          $parent = ORM::factory("item", $task->get("item_id"));
+          $parent = ORM::factory("item")->where("id", "=", $task->get("item_id"))->find();
         } else {
-          $parent = ORM::factory("item", $parent_entry->item_id);
+          $parent = ORM::factory("item")->where("id", "=", $parent_entry->item_id)->find();
         }
 
         $name = basename($entry->file);
@@ -228,6 +229,7 @@ class Server_Add_Controller extends Admin_Controller {
         if (is_dir($entry->file)) {
           $album = ORM::factory("item");
           $album->type = "album";
+          $album->parent_id = $parent->id;
           $album->name = $name;
           $album->title = $title;
           $album->owner_id = $owner_id;
@@ -239,6 +241,7 @@ class Server_Add_Controller extends Admin_Controller {
             if (in_array($extension, array("gif", "png", "jpg", "jpeg"))) {
               $photo = ORM::factory("item");
               $photo->type = "photo";
+              $photo->parent_id = $parent->id;
               $photo->set_data_file($entry->file);
               $photo->name = $name;
               $photo->title = $title;
@@ -248,6 +251,7 @@ class Server_Add_Controller extends Admin_Controller {
             } else if (in_array($extension, array("flv", "mp4"))) {
               $movie = ORM::factory("item");
               $movie->type = "movie";
+              $movie->parent_id = $parent->id;
               $movie->set_data_file($entry->file);
               $movie->name = $name;
               $movie->title = $title;
-- 
cgit v1.2.3


From ca5f625a5e3dc2fc26136b5dea8f27251f92c7c4 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 24 Jan 2010 11:40:01 -0800
Subject: Log validation errors.

---
 modules/gallery/helpers/task.php | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/modules/gallery/helpers/task.php b/modules/gallery/helpers/task.php
index 4aa95f33..ad756ecd 100644
--- a/modules/gallery/helpers/task.php
+++ b/modules/gallery/helpers/task.php
@@ -85,6 +85,13 @@ class task_Core {
       $task->save();
     } catch (Exception $e) {
       Kohana_Log::add("error", $e->__toString());
+
+      // Ugh.  I hate to use instanceof, But this beats catching the exception separately since
+      // we mostly want to treat it the same way as all other exceptions
+      if ($e instanceof ORM_Validation_Exception) {
+        Kohana_Log::add("error", "Validation errors: " . print_r($e->validation->errors(), 1));
+      }
+
       $task->log($e->__toString());
       $task->state = "error";
       $task->done = true;
-- 
cgit v1.2.3


From cc79abd0af83fdde471031b0629e8c7b0318790d Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 24 Jan 2010 14:00:07 -0800
Subject: Simplify tag::add().

---
 modules/tag/helpers/tag.php | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

diff --git a/modules/tag/helpers/tag.php b/modules/tag/helpers/tag.php
index 9e59b527..a500be58 100644
--- a/modules/tag/helpers/tag.php
+++ b/modules/tag/helpers/tag.php
@@ -37,17 +37,11 @@ class tag_Core {
     if (!$tag->loaded()) {
       $tag->name = $tag_name;
       $tag->count = 0;
-      $tag->save();
     }
 
-    if (!$tag->has($item)) {
-      if (!$tag->add($item)) {
-        throw new Exception("@todo {$tag->name} WAS_NOT_ADDED_TO {$item->id}");
-      }
-      $tag->count++;
-      $tag->save();
-    }
-    return $tag;
+    $tag->add($item);
+    $tag->count++;
+    return $tag->save();
   }
 
   /**
-- 
cgit v1.2.3


From a4519c6dce542c533d370c790074e6cc5e81170b Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 24 Jan 2010 14:03:36 -0800
Subject: Updated for model based validation.

---
 modules/g2_import/helpers/g2_import.php | 83 +++++++++++++++++----------------
 1 file changed, 44 insertions(+), 39 deletions(-)

diff --git a/modules/g2_import/helpers/g2_import.php b/modules/g2_import/helpers/g2_import.php
index 8724ae50..6f019aa8 100644
--- a/modules/g2_import/helpers/g2_import.php
+++ b/modules/g2_import/helpers/g2_import.php
@@ -299,17 +299,16 @@ class g2_import_Core {
     }
     $g2_groups = g2(GalleryCoreApi::fetchGroupsForUser($g2_user->getId()));
 
-    try {
+    $user = identity::lookup_user_by_name($g2_user->getUsername());
+    if ($user) {
+      $message = t("Loaded existing user: '%name'.", array("name" => $user->name));
+    } else {
       $user = identity::create_user($g2_user->getUsername(), $g2_user->getfullname(), "");
       $message = t("Created user: '%name'.", array("name" => $user->name));
-    } catch (Exception $e) {
-      // @todo For now we assume this is a "duplicate user" exception
-      $user = identity::lookup_user_by_name($g2_user->getUsername());
-      $message = t("Loaded existing user: '%name'.", array("name" => $user->name));
     }
 
     $user->hashed_password = $g2_user->getHashedPassword();
-    $user->email = $g2_user->getEmail();
+    $user->email = $g2_user->getEmail() ? $g2_user->getEmail() : "unknown@unknown.com";
     $user->locale = $g2_user->getLanguage();
     foreach ($g2_groups as $g2_group_id => $g2_group_name) {
       if ($g2_group_id == $g2_admin_group_id) {
@@ -353,21 +352,22 @@ class g2_import_Core {
       $g2_album = g2(GalleryCoreApi::loadEntitiesById($g2_album_id));
     } catch (Exception $e) {
       return t("Failed to import Gallery 2 album with id: %id\n%exception",
-               array("id" => $g2_album_id, "exception" => $e->__toString()));
+               array("id" => $g2_album_id, "exception" => (string)$e));
     }
 
     if ($g2_album->getParentId() == null) {
       return t("Skipping Gallery 2 root album");
     }
-    $parent_album = ORM::factory("item", self::map($g2_album->getParentId()));
-
-    $album = album::create(
-      $parent_album,
-      $g2_album->getPathComponent(),
-      self::_decode_html_special_chars($g2_album->getTitle()),
-      self::_decode_html_special_chars(self::extract_description($g2_album)),
-      self::map($g2_album->getOwnerId()));
+    $parent_album =
+      ORM::factory("item")->where("id", "=", self::map($g2_album->getParentId()))->find();
 
+    $album = ORM::factory("item");
+    $album->type = "album";
+    $album->parent_id = self::map($g2_album->getParentId());
+    $album->name = $g2_album->getPathComponent();
+    $album->title = self::_decode_html_special_chars($g2_album->getTitle());
+    $album->description = self::_decode_html_special_chars(self::extract_description($g2_album));
+    $album->owner_id = self::map($g2_album->getOwnerId());
     $album->view_count = g2(GalleryCoreApi::fetchItemViewCount($g2_album_id));
     $album->created = $g2_album->getCreationTimestamp();
 
@@ -423,8 +423,8 @@ class g2_import_Core {
       }
       $item_id = self::map($g2_source->getId());
       if ($item_id) {
-        $item = ORM::factory("item", $item_id);
-        $g2_album = ORM::factory("item", $g3_album_id);
+        $item = ORM::factory("item")->where("id", "=", $item_id)->find();
+        $g2_album = ORM::factory("item")->where("id", "=", $g3_album_id)->find();
         $g2_album->album_cover_item_id = $item->id;
         $g2_album->thumb_dirty = 1;
         $g2_album->view_count = g2(GalleryCoreApi::fetchItemViewCount($g2_album_id));
@@ -452,7 +452,7 @@ class g2_import_Core {
                array("id" => $g2_item_id, "exception" => $e->__toString()));
     }
 
-    $parent = ORM::factory("item", self::map($g2_item->getParentId()));
+    $parent = ORM::factory("item")->where("id", "=", self::map($g2_item->getParentId()))->find();
 
     $g2_type = $g2_item->getEntityType();
     $corrupt = 0;
@@ -482,19 +482,21 @@ class g2_import_Core {
         $corrupt = 1;
       }
       try {
-        $item = photo::create(
-          $parent,
-          $g2_path,
-          $g2_item->getPathComponent(),
-          self::_decode_html_special_chars($g2_item->getTitle()),
-          self::_decode_html_special_chars(self::extract_description($g2_item)),
-          self::map($g2_item->getOwnerId()));
+        $item = ORM::factory("item");
+        $item->type = "photo";
+        $item->parent_id = $parent->id;
+        $item->set_data_file($g2_path);
+        $item->name = $g2_item->getPathComponent();
+        $item->title = self::_decode_html_special_chars($g2_item->getTitle());
+        $item->description = self::_decode_html_special_chars(self::extract_description($g2_item));
+        $item->owner_id = self::map($g2_item->getOwnerId());
+        $item->save();
       } catch (Exception $e) {
-        Kohana_Log::add(
-          "alert", "Corrupt image $g2_path\n" . $e->__toString());
+        Kohana_Log::add("alert", "Corrupt image $g2_path\n" . (string)$e);
         $message[] = t("Corrupt image '%path'", array("path" => $g2_path));
-        $message[] = $e->__toString();
+        $message[] = (string)$e;
         $corrupt = 1;
+        $item = null;
       }
       break;
 
@@ -502,18 +504,19 @@ class g2_import_Core {
       // @todo we should transcode other types into FLV
       if (in_array($g2_item->getMimeType(), array("video/mp4", "video/x-flv"))) {
         try {
-          $item = movie::create(
-            $parent,
-            $g2_path,
-            $g2_item->getPathComponent(),
-            self::_decode_html_special_chars($g2_item->getTitle()),
-            self::_decode_html_special_chars(self::extract_description($g2_item)),
-            self::map($g2_item->getOwnerId()));
+          $item = ORM::factory("item");
+          $item->parent_id = $parent->id;
+          $item->set_data_file($g2_path);
+          $item->name = $g2_item->getPathComponent();
+          $item->title = self::_decode_html_special_chars($g2_item->getTitle());
+          $item->description = self::_decode_html_special_chars(self::extract_description($g2_item));
+          $item->owner_id = self::map($g2_item->getOwnerId());
         } catch (Exception $e) {
-          Kohana_Log::add("alert", "Corrupt movie $g2_path\n" . $e->__toString());
+          Kohana_Log::add("alert", "Corrupt movie $g2_path\n" . (string)$e);
           $message[] = t("Corrupt movie '%path'", array("path" => $g2_path));
-          $message[] = $e->__toString();
+          $message[] = (string)$e;
           $corrupt = 1;
+          $item = null;
         }
       } else {
         Kohana_Log::add("alert", "$g2_path is an unsupported movie type");
@@ -630,7 +633,10 @@ class g2_import_Core {
 
     GalleryCoreApi::requireOnce("modules/tags/classes/TagsHelper.class");
     $g2_item_id = array_shift($queue);
-    $g3_item = ORM::factory("item", self::map($g2_item_id));
+    $g3_item = ORM::factory("item")->where("id", "=", self::map($g2_item_id))->find();
+    if (!$g3_item->loaded()) {
+      return;
+    }
 
     try {
       $tag_names = array_values(g2(TagsHelper::getTagsByItemId($g2_item_id)));
@@ -639,7 +645,6 @@ class g2_import_Core {
                array("id" => $g2_item_id, "exception" => $e->__toString()));
     }
 
-    // Multiword tags have the space changed to dots.s
     foreach ($tag_names as $tag_name) {
       tag::add($g3_item, $tag_name);
     }
-- 
cgit v1.2.3


From 5b84919d6e55a8c43f60cf8b695c3696340d001b Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 24 Jan 2010 14:21:57 -0800
Subject: First pass at converting server add to model based validation.

---
 modules/server_add/controllers/server_add.php | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/modules/server_add/controllers/server_add.php b/modules/server_add/controllers/server_add.php
index d7572b52..d93b63a3 100644
--- a/modules/server_add/controllers/server_add.php
+++ b/modules/server_add/controllers/server_add.php
@@ -226,16 +226,33 @@ class Server_Add_Controller extends Admin_Controller {
         $name = basename($entry->file);
         $title = item::convert_filename_to_title($name);
         if (is_dir($entry->file)) {
-          $album = album::create($parent, $name, $title, null, $owner_id);
+          $album = ORM::factory("item");
+          $album->type = "album";
+          $album->name = $name;
+          $album->title = $title;
+          $album->owner_id = $owner_id;
+          $album->save();
           $entry->item_id = $album->id;
         } else {
           try {
             $extension = strtolower(pathinfo($name, PATHINFO_EXTENSION));
             if (in_array($extension, array("gif", "png", "jpg", "jpeg"))) {
-              $photo = photo::create($parent, $entry->file, $name, $title, null, $owner_id);
+              $photo = ORM::factory("item");
+              $photo->type = "photo";
+              $photo->set_data_file($entry->file);
+              $photo->name = $name;
+              $photo->title = $title;
+              $photo->owner_id = $owner_id;
+              $photo->save();
               $entry->item_id = $photo->id;
             } else if (in_array($extension, array("flv", "mp4"))) {
-              $movie = movie::create($parent, $entry->file, $name, $title, null, $owner_id);
+              $movie = ORM::factory("item");
+              $movie->type = "movie";
+              $movie->set_data_file($entry->file);
+              $movie->name = $name;
+              $movie->title = $title;
+              $movie->owner_id = $owner_id;
+              $movie->save();
               $entry->item_id = $movie->id;
             } else {
               // This should never happen, because we don't add stuff to the list that we can't
-- 
cgit v1.2.3


From 804614711ab79a739539fa0052e527d8c2152a90 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Mon, 25 Jan 2010 19:49:52 -0800
Subject: Make only one attempt to restore the old identity provider in case of
 failure.  Else, we can get into an infinite recursion.

---
 modules/gallery/libraries/IdentityProvider.php | 34 +++++++++++++++++---------
 1 file changed, 22 insertions(+), 12 deletions(-)

diff --git a/modules/gallery/libraries/IdentityProvider.php b/modules/gallery/libraries/IdentityProvider.php
index 79151154..c6b393ec 100644
--- a/modules/gallery/libraries/IdentityProvider.php
+++ b/modules/gallery/libraries/IdentityProvider.php
@@ -86,18 +86,28 @@ class IdentityProvider_Core {
       auth::login($provider->admin_user());
       Session::instance()->regenerate();
     } catch (Exception $e) {
-      // Make sure new provider is not in the database
-      module::uninstall($new_provider);
-
-      // Lets reset to the current provider so that the gallery installation is still
-      // working.
-      module::set_var("gallery", "identity_provider", null);
-      IdentityProvider::change_provider($current_provider);
-      module::activate($current_provider);
-      message::error(
-        t("Error attempting to enable \"%new_provider\" identity provider, " .
-          "reverted to \"%old_provider\" identity provider",
-          array("new_provider" => $new_provider, "old_provider" => $current_provider)));
+      static $restore_already_running;
+
+      // In case of error, make an attempt to restore the old provider.  Since that's calling into
+      // this function again and can fail, we should be sure not to get into an infinite recursion.
+      if (!$restore_already_running) {
+        $restore_already_running = true;
+
+        // Make sure new provider is not in the database
+        module::uninstall($new_provider);
+
+        // Lets reset to the current provider so that the gallery installation is still
+        // working.
+        module::set_var("gallery", "identity_provider", null);
+        IdentityProvider::change_provider($current_provider);
+        module::activate($current_provider);
+        message::error(
+          t("Error attempting to enable \"%new_provider\" identity provider, " .
+            "reverted to \"%old_provider\" identity provider",
+            array("new_provider" => $new_provider, "old_provider" => $current_provider)));
+
+        $restore_already_running = false;
+      }
       throw $e;
     }
   }
-- 
cgit v1.2.3


From 01dfa2988856043a71974bc509d05c8c267f0d6e Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Mon, 25 Jan 2010 20:40:44 -0800
Subject: Make some exceptions for guests: 1) They don't require email 2) Guest
 users aren't in the everybody group.

---
 modules/user/models/user.php | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/modules/user/models/user.php b/modules/user/models/user.php
index c43ee9a1..7c97bae7 100644
--- a/modules/user/models/user.php
+++ b/modules/user/models/user.php
@@ -67,7 +67,8 @@ class User_Model extends ORM implements User_Definition {
     if (!$array) {
       $this->rules = array(
         "admin"     => array("callbacks" => array(array($this, "valid_admin"))),
-        "email"     => array("rules"     => array("length[1,255]", "required", "valid::email")),
+        "email"     => array("rules"     => array("length[1,255]", "valid::email"),
+                             "callbacks" => array(array($this, "valid_email"))),
         "full_name" => array("rules"     => array("length[0,255]")),
         "locale"    => array("rules"     => array("length[2,10]")),
         "name"      => array("rules"     => array("length[1,32]", "required"),
@@ -90,7 +91,9 @@ class User_Model extends ORM implements User_Definition {
     if (!$this->loaded()) {
       // New user
       $this->add(group::everybody());
-      $this->add(group::registered_users());
+      if (!$this->guest) {
+        $this->add(group::registered_users());
+      }
 
       parent::save();
       module::event("user_created", $this);
@@ -129,6 +132,10 @@ class User_Model extends ORM implements User_Definition {
    * Validate the password.
    */
   public function valid_password(Validation $v, $field) {
+    if ($this->guest) {
+      return;
+    }
+
     if (!$this->loaded() || $this->password_length) {
       $minimum_length = module::get_var("user", "mininum_password_length", 5);
       if ($this->password_length < $minimum_length) {
@@ -145,4 +152,17 @@ class User_Model extends ORM implements User_Definition {
       $v->add_error("admin", "locked");
     }
   }
+
+  /**
+   * Validate the email field.
+   */
+  public function valid_email(Validation $v, $field) {
+    if ($this->guest) {  // guests don't require an email address
+      return;
+    }
+
+    if (empty($this->email)) {
+      $v->add_error("email", "required");
+    }
+  }
 }
-- 
cgit v1.2.3


From b6dab323ac478339b03f98430c2591562e747f43 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Mon, 25 Jan 2010 20:42:48 -0800
Subject: Use ORM to create the users since now our validation can handle doing
 it the right way.  Set a default email address for admins.

---
 modules/user/helpers/user_installer.php | 33 +++++++++++----------------------
 1 file changed, 11 insertions(+), 22 deletions(-)

diff --git a/modules/user/helpers/user_installer.php b/modules/user/helpers/user_installer.php
index f2d131ae..1d49998d 100644
--- a/modules/user/helpers/user_installer.php
+++ b/modules/user/helpers/user_installer.php
@@ -95,30 +95,19 @@ class user_installer {
     $registered->special = true;
     $registered->save();
 
-    // Avoid ORM to sidestep validation.
-    db::build()->insert(
-      "users",
-      array("name" => "guest",
-            "full_name" => "Guest User",
-            "password" => "",
-            "guest" => true))
-      ->execute();
-
-    $guest = ORM::factory("user")->where("id", "=", 1)->find();
-    $guest->add($everybody);
+    $guest = ORM::factory("user");
+    $guest->name = "guest";
+    $guest->full_name = "Guest User";
+    $guest->password = "";
+    $guest->guest = true;
     $guest->save();
 
-    db::build()->insert(
-      "users",
-      array("name" => "admin",
-            "full_name" => "Gallery Administrator",
-            "password" => "admin",
-            "admin" => true))
-      ->execute();
-
-    $admin = ORM::factory("user")->where("id", "=", 2)->find();
-    $admin->add($everybody);
-    $admin->add($registered);
+    $admin = ORM::factory("user");
+    $admin->name = "admin";
+    $admin->full_name = "Gallery Administrator";
+    $admin->password = "admin";
+    $admin->email = "unknown@unknown.com";
+    $admin->admin = true;
     $admin->save();
 
     $root = ORM::factory("item", 1);
-- 
cgit v1.2.3


From 953c9283ad039adde0d131f2a0e563642d3dcbd1 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Mon, 25 Jan 2010 23:39:24 -0800
Subject: Always keep the original around when updating existing items, because
 we need it for the item_updated event.

---
 modules/gallery/models/item.php | 65 ++++++++++++++++++++---------------------
 1 file changed, 32 insertions(+), 33 deletions(-)

diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php
index 51857440..4f5105b1 100644
--- a/modules/gallery/models/item.php
+++ b/modules/gallery/models/item.php
@@ -417,8 +417,8 @@ class Item_Model extends ORM_MPTT {
 
         // If any significant fields have changed, load up a copy of the original item and
         // keep it around.
+        $original = ORM::factory("item")->where("id", "=", $this->id)->find();
         if (array_intersect($this->changed, array("parent_id", "name", "slug"))) {
-          $original = ORM::factory("item")->where("id", "=", $this->id)->find();
           $original->_build_relative_caches();
           $this->relative_path_cache = null;
           $this->relative_url_cache = null;
@@ -429,45 +429,44 @@ class Item_Model extends ORM_MPTT {
         // Now update the filesystem and any database caches if there were significant value
         // changes.  If anything past this point fails, then we'll have an inconsistent database
         // so this code should be as robust as we can make it.
-        if (isset($original)) {
-          // Update the MPTT pointers, if necessary.  We have to do this before we generate any
-          // cached paths!
-          if ($original->parent_id != $this->parent_id) {
-            parent::move_to($this->parent());
-          }
 
-          if ($original->parent_id != $this->parent_id || $original->name != $this->name) {
-            // Move all of the items associated data files
-            @rename($original->file_path(), $this->file_path());
-            if ($this->is_album()) {
-              @rename(dirname($original->resize_path()), dirname($this->resize_path()));
-              @rename(dirname($original->thumb_path()), dirname($this->thumb_path()));
-            } else {
-              @rename($original->resize_path(), $this->resize_path());
-              @rename($original->thumb_path(), $this->thumb_path());
-            }
+        // Update the MPTT pointers, if necessary.  We have to do this before we generate any
+        // cached paths!
+        if ($original->parent_id != $this->parent_id) {
+          parent::move_to($this->parent());
+        }
 
-            if ($original->parent_id != $this->parent_id) {
-              // This will result in 2 events since we'll still fire the item_updated event below
-              module::event("item_moved", $this, $original->parent());
-            }
+        if ($original->parent_id != $this->parent_id || $original->name != $this->name) {
+          // Move all of the items associated data files
+          @rename($original->file_path(), $this->file_path());
+          if ($this->is_album()) {
+            @rename(dirname($original->resize_path()), dirname($this->resize_path()));
+            @rename(dirname($original->thumb_path()), dirname($this->thumb_path()));
+          } else {
+            @rename($original->resize_path(), $this->resize_path());
+            @rename($original->thumb_path(), $this->thumb_path());
           }
 
-          // Changing the name, slug or parent ripples downwards
-          if ($this->is_album() &&
-              ($original->name != $this->name ||
-               $original->slug != $this->slug ||
-               $original->parent_id != $this->parent_id)) {
-            db::build()
-              ->update("items")
-              ->set("relative_url_cache", null)
-              ->set("relative_path_cache", null)
-              ->where("left_ptr", ">", $this->left_ptr)
-              ->where("right_ptr", "<", $this->right_ptr)
-              ->execute();
+          if ($original->parent_id != $this->parent_id) {
+            // This will result in 2 events since we'll still fire the item_updated event below
+            module::event("item_moved", $this, $original->parent());
           }
         }
 
+        // Changing the name, slug or parent ripples downwards
+        if ($this->is_album() &&
+            ($original->name != $this->name ||
+             $original->slug != $this->slug ||
+             $original->parent_id != $this->parent_id)) {
+          db::build()
+            ->update("items")
+            ->set("relative_url_cache", null)
+            ->set("relative_path_cache", null)
+            ->where("left_ptr", ">", $this->left_ptr)
+            ->where("right_ptr", "<", $this->right_ptr)
+            ->execute();
+        }
+
         module::event("item_updated", $original, $this);
       }
     } else if (!empty($this->changed)) {
-- 
cgit v1.2.3


From 5c68519d9233eabe98fce34fc00cdd4595f03ded Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 26 Jan 2010 00:23:45 -0800
Subject: Specialize the album cover id check to allow the root album to have
 no album cover.

---
 modules/gallery/models/item.php | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php
index 4f5105b1..e4ff0bfb 100644
--- a/modules/gallery/models/item.php
+++ b/modules/gallery/models/item.php
@@ -717,7 +717,7 @@ class Item_Model extends ORM_MPTT {
   public function validate($array=null) {
     if (!$array) {
       $this->rules = array(
-        "album_cover_item_id" => array("callbacks" => array(array($this, "valid_item"))),
+        "album_cover_item_id" => array("callbacks" => array(array($this, "valid_album_cover"))),
         "description"         => array("rules"     => array("length[0,65535]")),
         "mime_type"           => array("callbacks" => array(array($this, "valid_field"))),
         "name"                => array("rules"     => array("length[0,255]", "required"),
@@ -848,14 +848,18 @@ class Item_Model extends ORM_MPTT {
   }
 
   /**
-   * Make sure the field refers to a valid item by id, or is null.
+   * Make sure the album cover item id refers to a valid item, or is null.
    */
-  public function valid_item(Validation $v, $field) {
-    if ($this->$field && db::build()
+  public function valid_album_cover(Validation $v, $field) {
+    if ($this->id == 1) {
+      return;
+    }
+
+    if ($this->album_cover_item_id && db::build()
         ->from("items")
-        ->where("id", "=", $this->$field)
+        ->where("id", "=", $this->album_cover_item_id)
         ->count_records() != 1) {
-      $v->add_error($field, "invalid_item");
+      $v->add_error("album_cover_item_id", "invalid_item");
     }
   }
 
-- 
cgit v1.2.3


From f268128043a56888ef35d07ee5d02012b8349c74 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 26 Jan 2010 00:24:10 -0800
Subject: Add support for adding tags in the item_tags and tag_items
 relationship collections.

---
 modules/tag/helpers/item_tags_rest.php | 13 +++++++++++++
 modules/tag/helpers/tag_items_rest.php | 13 +++++++++++++
 modules/tag/helpers/tags_rest.php      |  7 ++++++-
 3 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/modules/tag/helpers/item_tags_rest.php b/modules/tag/helpers/item_tags_rest.php
index 385d06e8..ce814f77 100644
--- a/modules/tag/helpers/item_tags_rest.php
+++ b/modules/tag/helpers/item_tags_rest.php
@@ -30,6 +30,19 @@ class item_tags_rest_Core {
       "members" => $tags);
   }
 
+  static function post($request) {
+    $tag = rest::resolve($request->params->tag);
+    $item = rest::resolve($request->params->item);
+    access::required("view", $item);
+
+    tag::add($item, $tag->name);
+    return array(
+      "url" => rest::url("tag_item", $tag, $item),
+      "members" => array(
+        rest::url("tag", $tag),
+        rest::url("item", $item)));
+  }
+
   static function delete($request) {
     list ($tag, $item) = rest::resolve($request->url);
     $tag->remove($item);
diff --git a/modules/tag/helpers/tag_items_rest.php b/modules/tag/helpers/tag_items_rest.php
index 2a00c565..369a8d83 100644
--- a/modules/tag/helpers/tag_items_rest.php
+++ b/modules/tag/helpers/tag_items_rest.php
@@ -32,6 +32,19 @@ class tag_items_rest_Core {
       "members" => $items);
   }
 
+  static function post($request) {
+    $tag = rest::resolve($request->params->tag);
+    $item = rest::resolve($request->params->item);
+    access::required("view", $item);
+
+    tag::add($item, $tag->name);
+    return array(
+      "url" => rest::url("tag_item", $tag, $item),
+      "members" => array(
+        rest::url("tag", $tag),
+        rest::url("item", $item)));
+  }
+
   static function delete($request) {
     list ($tag, $item) = rest::resolve($request->url);
     $tag->remove($item);
diff --git a/modules/tag/helpers/tags_rest.php b/modules/tag/helpers/tags_rest.php
index 57461125..89ff0f21 100644
--- a/modules/tag/helpers/tags_rest.php
+++ b/modules/tag/helpers/tags_rest.php
@@ -23,7 +23,8 @@ class tags_rest_Core {
     foreach (ORM::factory("tag")->find_all() as $tag) {
       $tags[] = rest::url("tag", $tag);
     }
-    return array("members" => $tags);
+    return array("url" => rest::url("tags"),
+                 "members" => $tags);
   }
 
   static function post($request) {
@@ -45,4 +46,8 @@ class tags_rest_Core {
 
     return array("url" => rest::url("tag", $tag));
   }
+
+  static function url() {
+    return url::abs_site("rest/tags");
+  }
 }
-- 
cgit v1.2.3


From e315ce348bee75290e65e2376cc4f34b0f285cea Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 26 Jan 2010 13:26:03 -0800
Subject: Added view_permissions_propagate_down_to_photos_test().

---
 modules/gallery/tests/Access_Helper_Test.php | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/modules/gallery/tests/Access_Helper_Test.php b/modules/gallery/tests/Access_Helper_Test.php
index b2244766..298dd0ac 100644
--- a/modules/gallery/tests/Access_Helper_Test.php
+++ b/modules/gallery/tests/Access_Helper_Test.php
@@ -203,6 +203,18 @@ class Access_Helper_Test extends Unit_Test_Case {
     $this->assert_true(access::group_can(identity::everybody(), "view", $album));
   }
 
+  public function view_permissions_propagate_down_to_photos_test() {
+    $album = album::create(item::root(), rand(), "test album");
+    $photo = photo::create($album, MODPATH . "gallery/images/gallery.png", "", "");
+    identity::set_active_user(identity::guest());
+
+    $this->assert_true(access::can("view", $photo));
+    access::deny(identity::everybody(), "view", $album);
+
+    $photo->reload();  // view permissions are cached in the photo
+    $this->assert_false(access::can("view", $photo));
+  }
+
   public function can_toggle_view_permissions_propagate_down_test() {
     $root = ORM::factory("item", 1);
     $album1 = album::create($root, rand(), "test album");
-- 
cgit v1.2.3


From c5cdd13b41c2911390a67e22700fa414dfe53ea2 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 26 Jan 2010 13:26:03 -0800
Subject: Added view_permissions_propagate_down_to_photos_test().

---
 modules/gallery/tests/Access_Helper_Test.php | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/modules/gallery/tests/Access_Helper_Test.php b/modules/gallery/tests/Access_Helper_Test.php
index 7ddd2875..35cf5edb 100644
--- a/modules/gallery/tests/Access_Helper_Test.php
+++ b/modules/gallery/tests/Access_Helper_Test.php
@@ -193,6 +193,18 @@ class Access_Helper_Test extends Gallery_Unit_Test_Case {
     $this->assert_true(access::group_can(identity::everybody(), "view", $album));
   }
 
+  public function view_permissions_propagate_down_to_photos_test() {
+    $album = album::create(item::root(), rand(), "test album");
+    $photo = photo::create($album, MODPATH . "gallery/images/gallery.png", "", "");
+    identity::set_active_user(identity::guest());
+
+    $this->assert_true(access::can("view", $photo));
+    access::deny(identity::everybody(), "view", $album);
+
+    $photo->reload();  // view permissions are cached in the photo
+    $this->assert_false(access::can("view", $photo));
+  }
+
   public function can_toggle_view_permissions_propagate_down_test() {
     $album1 = test::random_album(item::root());
     $album2 = test::random_album($album1);
-- 
cgit v1.2.3


From f5b9742e2bbce7f30519c9e0b5ce196863dc0707 Mon Sep 17 00:00:00 2001
From: Andy Staudacher <andy.st@gmail.com>
Date: Tue, 26 Jan 2010 18:53:47 -0800
Subject: Fix for ticket 833: Fixes broken playback of videos that had
 non-ascii characters in their path. (This is a copy of the modified
 flowplayer.js from the vendor branch.)

---
 lib/flowplayer.js | 155 +++++++++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 131 insertions(+), 24 deletions(-)

diff --git a/lib/flowplayer.js b/lib/flowplayer.js
index b1c33150..d4b619c3 100644
--- a/lib/flowplayer.js
+++ b/lib/flowplayer.js
@@ -1,24 +1,131 @@
-/** 
- * flowplayer.js 3.0.5. The Flowplayer API
- * 
- * Copyright 2009 Flowplayer Oy
- * 
- * This file is part of Flowplayer.
- * 
- * Flowplayer is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- * 
- * Flowplayer is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- * 
- * You should have received a copy of the GNU General Public License
- * along with Flowplayer.  If not, see <http://www.gnu.org/licenses/>.
- * 
- * Version: 3.0.5 - Tue Feb 03 2009 13:14:17 GMT-0000 (GMT+00:00)
- */
-(function(){function log(args){console.log("$f.fireEvent",[].slice.call(args));}function clone(obj){if(!obj||typeof obj!='object'){return obj;}var temp=new obj.constructor();for(var key in obj){if(obj.hasOwnProperty(key)){temp[key]=clone(obj[key]);}}return temp;}function each(obj,fn){if(!obj){return;}var name,i=0,length=obj.length;if(length===undefined){for(name in obj){if(fn.call(obj[name],name,obj[name])===false){break;}}}else{for(var value=obj[0];i<length&&fn.call(value,i,value)!==false;value=obj[++i]){}}return obj;}function el(id){return document.getElementById(id);}function extend(to,from,skipFuncs){if(to&&from){each(from,function(name,value){if(!skipFuncs||typeof value!='function'){to[name]=value;}});}}function select(query){var index=query.indexOf(".");if(index!=-1){var tag=query.substring(0,index)||"*";var klass=query.substring(index+1,query.length);var els=[];each(document.getElementsByTagName(tag),function(){if(this.className&&this.className.indexOf(klass)!=-1){els.push(this);}});return els;}}function stopEvent(e){e=e||window.event;if(e.preventDefault){e.stopPropagation();e.preventDefault();}else{e.returnValue=false;e.cancelBubble=true;}return false;}function bind(to,evt,fn){to[evt]=to[evt]||[];to[evt].push(fn);}function makeId(){return"_"+(""+Math.random()).substring(2,10);}var Clip=function(json,index,player){var self=this;var cuepoints={};var listeners={};self.index=index;if(typeof json=='string'){json={url:json};}extend(this,json,true);each(("Begin*,Start,Pause*,Resume*,Seek*,Stop*,Finish*,LastSecond,Update,BufferFull,BufferEmpty,BufferStop").split(","),function(){var evt="on"+this;if(evt.indexOf("*")!=-1){evt=evt.substring(0,evt.length-1);var before="onBefore"+evt.substring(2);self[before]=function(fn){bind(listeners,before,fn);return self;};}self[evt]=function(fn){bind(listeners,evt,fn);return self;};if(index==-1){if(self[before]){player[before]=self[before];}if(self[evt]){player[evt]=self[evt];}}});extend(this,{onCuepoint:function(points,fn){if(arguments.length==1){cuepoints.embedded=[null,points];return self;}if(typeof points=='number'){points=[points];}var fnId=makeId();cuepoints[fnId]=[points,fn];if(player.isLoaded()){player._api().fp_addCuepoints(points,index,fnId);}return self;},update:function(json){extend(self,json);if(player.isLoaded()){player._api().fp_updateClip(json,index);}var conf=player.getConfig();var clip=(index==-1)?conf.clip:conf.playlist[index];extend(clip,json,true);},_fireEvent:function(evt,arg1,arg2,target){if(evt=='onLoad'){each(cuepoints,function(key,val){if(val[0]){player._api().fp_addCuepoints(val[0],index,key);}});return false;}target=target||self;if(evt=='onCuepoint'){var fn=cuepoints[arg1];if(fn){return fn[1].call(player,target,arg2);}}if(evt=='onStart'||evt=='onUpdate'){extend(target,arg1);if(!target.duration){target.duration=arg1.metaData.duration;}else{target.fullDuration=arg1.metaData.duration;}}var ret=true;each(listeners[evt],function(){ret=this.call(player,target,arg1,arg2);});return ret;}});if(json.onCuepoint){var arg=json.onCuepoint;self.onCuepoint.apply(self,typeof arg=='function'?[arg]:arg);delete json.onCuepoint;}each(json,function(key,val){if(typeof val=='function'){bind(listeners,key,val);delete json[key];}});if(index==-1){player.onCuepoint=this.onCuepoint;}};var Plugin=function(name,json,player,fn){var listeners={};var self=this;var hasMethods=false;if(fn){extend(listeners,fn);}each(json,function(key,val){if(typeof val=='function'){listeners[key]=val;delete json[key];}});extend(this,{animate:function(props,speed,fn){if(!props){return self;}if(typeof speed=='function'){fn=speed;speed=500;}if(typeof props=='string'){var key=props;props={};props[key]=speed;speed=500;}if(fn){var fnId=makeId();listeners[fnId]=fn;}if(speed===undefined){speed=500;}json=player._api().fp_animate(name,props,speed,fnId);return self;},css:function(props,val){if(val!==undefined){var css={};css[props]=val;props=css;}json=player._api().fp_css(name,props);extend(self,json);return self;},show:function(){this.display='block';player._api().fp_showPlugin(name);return self;},hide:function(){this.display='none';player._api().fp_hidePlugin(name);return self;},toggle:function(){this.display=player._api().fp_togglePlugin(name);return self;},fadeTo:function(o,speed,fn){if(typeof speed=='function'){fn=speed;speed=500;}if(fn){var fnId=makeId();listeners[fnId]=fn;}this.display=player._api().fp_fadeTo(name,o,speed,fnId);this.opacity=o;return self;},fadeIn:function(speed,fn){return self.fadeTo(1,speed,fn);},fadeOut:function(speed,fn){return self.fadeTo(0,speed,fn);},getName:function(){return name;},_fireEvent:function(evt,arg){if(evt=='onUpdate'){var json=player._api().fp_getPlugin(name);if(!json){return;}extend(self,json);delete self.methods;if(!hasMethods){each(json.methods,function(){var method=""+this;self[method]=function(){var a=[].slice.call(arguments);var ret=player._api().fp_invoke(name,method,a);return ret=='undefined'?self:ret;};});hasMethods=true;}}var fn=listeners[evt];if(fn){fn.call(self,arg);if(evt.substring(0,1)=="_"){delete listeners[evt];}}}});};function Player(wrapper,params,conf){var
-self=this,api=null,html,commonClip,playlist=[],plugins={},listeners={},playerId,apiId,playerIndex,activeIndex,swfHeight,wrapperHeight;extend(self,{id:function(){return playerId;},isLoaded:function(){return(api!==null);},getParent:function(){return wrapper;},hide:function(all){if(all){wrapper.style.height="0px";}if(api){api.style.height="0px";}return self;},show:function(){wrapper.style.height=wrapperHeight+"px";if(api){api.style.height=swfHeight+"px";}return self;},isHidden:function(){return api&&parseInt(api.style.height,10)===0;},load:function(fn){if(!api&&self._fireEvent("onBeforeLoad")!==false){each(players,function(){this.unload();});html=wrapper.innerHTML;flashembed(wrapper,params,{config:conf});if(fn){fn.cached=true;bind(listeners,"onLoad",fn);}}return self;},unload:function(){try{if(api&&api.fp_isFullscreen()){}}catch(error){return;}if(api&&html.replace(/\s/g,'')!==''&&!api.fp_isFullscreen()&&self._fireEvent("onBeforeUnload")!==false){api.fp_close();wrapper.innerHTML=html;self._fireEvent("onUnload");api=null;}return self;},getClip:function(index){if(index===undefined){index=activeIndex;}return playlist[index];},getCommonClip:function(){return commonClip;},getPlaylist:function(){return playlist;},getPlugin:function(name){var plugin=plugins[name];if(!plugin&&self.isLoaded()){var json=self._api().fp_getPlugin(name);if(json){plugin=new Plugin(name,json,self);plugins[name]=plugin;}}return plugin;},getScreen:function(){return self.getPlugin("screen");},getControls:function(){return self.getPlugin("controls");},getConfig:function(copy){return copy?clone(conf):conf;},getFlashParams:function(){return params;},loadPlugin:function(name,url,props,fn){if(typeof props=='function'){fn=props;props={};}var fnId=fn?makeId():"_";self._api().fp_loadPlugin(name,url,props,fnId);var arg={};arg[fnId]=fn;var p=new Plugin(name,null,self,arg);plugins[name]=p;return p;},getState:function(){return api?api.fp_getState():-1;},play:function(clip){function play(){if(clip!==undefined){self._api().fp_play(clip);}else{self._api().fp_play();}}if(api){play();}else{self.load(function(){play();});}return self;},getVersion:function(){var js="flowplayer.js 3.0.5";if(api){var ver=api.fp_getVersion();ver.push(js);return ver;}return js;},_api:function(){if(!api){throw"Flowplayer "+self.id()+" not loaded. Try moving your call to player's onLoad event";}return api;},_dump:function(){console.log(listeners);},setClip:function(clip){self.setPlaylist([clip]);},getIndex:function(){return playerIndex;}});each(("Click*,Load*,Unload*,Keypress*,Volume*,Mute*,Unmute*,PlaylistReplace,Fullscreen*,FullscreenExit,Error").split(","),function(){var name="on"+this;if(name.indexOf("*")!=-1){name=name.substring(0,name.length-1);var name2="onBefore"+name.substring(2);self[name2]=function(fn){bind(listeners,name2,fn);return self;};}self[name]=function(fn){bind(listeners,name,fn);return self;};});each(("pause,resume,mute,unmute,stop,toggle,seek,getStatus,getVolume,setVolume,getTime,isPaused,isPlaying,startBuffering,stopBuffering,isFullscreen,reset,close,setPlaylist").split(","),function(){var name=this;self[name]=function(arg){if(!api){return self;}var ret=(arg===undefined)?api["fp_"+name]():api["fp_"+name](arg);return ret=='undefined'?self:ret;};});self._fireEvent=function(evt,arg0,arg1,arg2){if(conf.debug){log(arguments);}if(!api&&evt=='onLoad'&&arg0=='player'){api=api||el(apiId);swfHeight=api.clientHeight;each(playlist,function(){this._fireEvent("onLoad");});each(plugins,function(name,p){p._fireEvent("onUpdate");});commonClip._fireEvent("onLoad");}if(evt=='onLoad'&&arg0!='player'){return;}if(evt=='onError'){if(typeof arg0=='string'||(typeof arg0=='number'&&typeof arg1=='number')){arg0=arg1;arg1=arg2;}}if(evt=='onContextMenu'){each(conf.contextMenu[arg0],function(key,fn){fn.call(self);});return;}if(evt=='onPluginEvent'){var name=arg0.name||arg0;var p=plugins[name];if(p){p._fireEvent("onUpdate",arg0);p._fireEvent(arg1);}return;}if(evt=='onPlaylistReplace'){playlist=[];var index=0;each(arg0,function(){playlist.push(new Clip(this,index++,self));});}var ret=true;if(typeof arg0=='number'&&arg0<playlist.length){activeIndex=arg0;var clip=playlist[arg0];if(clip){ret=clip._fireEvent(evt,arg1,arg2);}if(!clip||ret!==false){ret=commonClip._fireEvent(evt,arg1,arg2,clip);}}var i=0;each(listeners[evt],function(){ret=this.call(self,arg0,arg1);if(this.cached){listeners[evt].splice(i,1);}if(ret===false){return false;}i++;});return ret;};function init(){if($f(wrapper)){$f(wrapper).getParent().innerHTML="";playerIndex=$f(wrapper).getIndex();players[playerIndex]=self;}else{players.push(self);playerIndex=players.length-1;}wrapperHeight=parseInt(wrapper.style.height,10)||wrapper.clientHeight;if(typeof params=='string'){params={src:params};}playerId=wrapper.id||"fp"+makeId();apiId=params.id||playerId+"_api";params.id=apiId;conf.playerId=playerId;if(typeof conf=='string'){conf={clip:{url:conf}};}if(typeof conf.clip=='string'){conf.clip={url:conf.clip};}conf.clip=conf.clip||{};if(wrapper.getAttribute("href",2)&&!conf.clip.url){conf.clip.url=wrapper.getAttribute("href",2);}commonClip=new Clip(conf.clip,-1,self);conf.playlist=conf.playlist||[conf.clip];var index=0;each(conf.playlist,function(){var clip=this;if(typeof clip=='object'&&clip.length){clip=""+clip;}if(typeof clip=='string'){clip={url:clip};}each(conf.clip,function(key,val){if(conf.clip[key]!==undefined&&typeof val!='function'){clip[key]=val;}});conf.playlist[index]=clip;clip=new Clip(clip,index,self);playlist.push(clip);index++;});each(conf,function(key,val){if(typeof val=='function'){bind(listeners,key,val);delete conf[key];}});each(conf.plugins,function(name,val){if(val){plugins[name]=new Plugin(name,val,self);}});if(!conf.plugins||conf.plugins.controls===undefined){plugins.controls=new Plugin("controls",null,self);}params.bgcolor=params.bgcolor||"#000000";params.version=params.version||[9,0];params.expressInstall='http://www.flowplayer.org/swf/expressinstall.swf';function doClick(e){if(!self.isLoaded()&&self._fireEvent("onBeforeClick")!==false){self.load();}return stopEvent(e);}html=wrapper.innerHTML;if(html.replace(/\s/g,'')!==''){if(wrapper.addEventListener){wrapper.addEventListener("click",doClick,false);}else if(wrapper.attachEvent){wrapper.attachEvent("onclick",doClick);}}else{if(wrapper.addEventListener){wrapper.addEventListener("click",stopEvent,false);}self.load();}}if(typeof wrapper=='string'){flashembed.domReady(function(){var node=el(wrapper);if(!node){throw"Flowplayer cannot access element: "+wrapper;}else{wrapper=node;init();}});}else{init();}}var players=[];function Iterator(arr){this.length=arr.length;this.each=function(fn){each(arr,fn);};this.size=function(){return arr.length;};}window.flowplayer=window.$f=function(){var instance=null;var arg=arguments[0];if(!arguments.length){each(players,function(){if(this.isLoaded()){instance=this;return false;}});return instance||players[0];}if(arguments.length==1){if(typeof arg=='number'){return players[arg];}else{if(arg=='*'){return new Iterator(players);}each(players,function(){if(this.id()==arg.id||this.id()==arg||this.getParent()==arg){instance=this;return false;}});return instance;}}if(arguments.length>1){var swf=arguments[1];var conf=(arguments.length==3)?arguments[2]:{};if(typeof arg=='string'){if(arg.indexOf(".")!=-1){var instances=[];each(select(arg),function(){instances.push(new Player(this,clone(swf),clone(conf)));});return new Iterator(instances);}else{var node=el(arg);return new Player(node!==null?node:arg,swf,conf);}}else if(arg){return new Player(arg,swf,conf);}}return null;};extend(window.$f,{fireEvent:function(id,evt,a0,a1,a2){var p=$f(id);return p?p._fireEvent(evt,a0,a1,a2):null;},addPlugin:function(name,fn){Player.prototype[name]=fn;return $f;},each:each,extend:extend});if(document.all){window.onbeforeunload=function(){$f("*").each(function(){if(this.isLoaded()){this.close();}});};}if(typeof jQuery=='function'){jQuery.prototype.flowplayer=function(params,conf){if(!arguments.length||typeof arguments[0]=='number'){var arr=[];this.each(function(){var p=$f(this);if(p){arr.push(p);}});return arguments.length?arr[arguments[0]]:new Iterator(arr);}return this.each(function(){$f(this,clone(params),conf?clone(conf):{});});};}})();(function(){var jQ=typeof jQuery=='function';function isDomReady(){if(domReady.done){return false;}var d=document;if(d&&d.getElementsByTagName&&d.getElementById&&d.body){clearInterval(domReady.timer);domReady.timer=null;for(var i=0;i<domReady.ready.length;i++){domReady.ready[i].call();}domReady.ready=null;domReady.done=true;}}var domReady=jQ?jQuery:function(f){if(domReady.done){return f();}if(domReady.timer){domReady.ready.push(f);}else{domReady.ready=[f];domReady.timer=setInterval(isDomReady,13);}};function extend(to,from){if(from){for(key in from){if(from.hasOwnProperty(key)){to[key]=from[key];}}}return to;}function asString(obj){switch(typeOf(obj)){case'string':obj=obj.replace(new RegExp('(["\\\\])','g'),'\\$1');obj=obj.replace(/^\s?(\d+)%/,"$1pct");return'"'+obj+'"';case'array':return'['+map(obj,function(el){return asString(el);}).join(',')+']';case'function':return'"function()"';case'object':var str=[];for(var prop in obj){if(obj.hasOwnProperty(prop)){str.push('"'+prop+'":'+asString(obj[prop]));}}return'{'+str.join(',')+'}';}return String(obj).replace(/\s/g," ").replace(/\'/g,"\"");}function typeOf(obj){if(obj===null||obj===undefined){return false;}var type=typeof obj;return(type=='object'&&obj.push)?'array':type;}if(window.attachEvent){window.attachEvent("onbeforeunload",function(){__flash_unloadHandler=function(){};__flash_savedUnloadHandler=function(){};});}function map(arr,func){var newArr=[];for(var i in arr){if(arr.hasOwnProperty(i)){newArr[i]=func(arr[i]);}}return newArr;}function getHTML(p,c){var ie=document.all;var html='<object width="'+p.width+'" height="'+p.height+'"';if(ie&&!p.id){p.id="_"+(""+Math.random()).substring(9);}if(p.id){html+=' id="'+p.id+'"';}if(p.w3c||!ie){html+=' data="'+p.src+'" type="application/x-shockwave-flash"';}else{html+=' classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000"';}html+='>';if(p.w3c||ie){html+='<param name="movie" value="'+p.src+'" />';}var e=extend({},p);e.width=e.height=e.id=e.w3c=e.src=null;for(var k in e){if(e[k]!==null){html+='<param name="'+k+'" value="'+e[k]+'" />';}}var vars="";if(c){for(var key in c){if(c[key]!==null){vars+=key+'='+(typeof c[key]=='object'?asString(c[key]):c[key])+'&';}}vars=vars.substring(0,vars.length-1);html+='<param name="flashvars" value=\''+vars+'\' />';}html+="</object>";return html;}function Flash(root,opts,flashvars){var version=flashembed.getVersion();extend(this,{getContainer:function(){return root;},getConf:function(){return conf;},getVersion:function(){return version;},getFlashvars:function(){return flashvars;},getApi:function(){return root.firstChild;},getHTML:function(){return getHTML(opts,flashvars);}});var required=opts.version;var express=opts.expressInstall;var ok=!required||flashembed.isSupported(required);if(ok){opts.onFail=opts.version=opts.expressInstall=null;root.innerHTML=getHTML(opts,flashvars);}else if(required&&express&&flashembed.isSupported([6,65])){extend(opts,{src:express});flashvars={MMredirectURL:location.href,MMplayerType:'PlugIn',MMdoctitle:document.title};root.innerHTML=getHTML(opts,flashvars);}else{if(root.innerHTML.replace(/\s/g,'')!==''){}else{root.innerHTML="<h2>Flash version "+required+" or greater is required</h2>"+"<h3>"+(version[0]>0?"Your version is "+version:"You have no flash plugin installed")+"</h3>"+"<p>Download latest version from <a href='http://www.adobe.com/go/getflashplayer'>here</a></p>";}}if(!ok&&opts.onFail){var ret=opts.onFail.call(this);if(typeof ret=='string'){root.innerHTML=ret;}}}window.flashembed=function(root,conf,flashvars){if(typeof root=='string'){var el=document.getElementById(root);if(el){root=el;}else{domReady(function(){flashembed(root,conf,flashvars);});return;}}if(!root){return;}var opts={width:'100%',height:'100%',allowfullscreen:true,allowscriptaccess:'always',quality:'high',version:null,onFail:null,expressInstall:null,w3c:false};if(typeof conf=='string'){conf={src:conf};}extend(opts,conf);return new Flash(root,opts,flashvars);};extend(window.flashembed,{getVersion:function(){var version=[0,0];if(navigator.plugins&&typeof navigator.plugins["Shockwave Flash"]=="object"){var _d=navigator.plugins["Shockwave Flash"].description;if(typeof _d!="undefined"){_d=_d.replace(/^.*\s+(\S+\s+\S+$)/,"$1");var _m=parseInt(_d.replace(/^(.*)\..*$/,"$1"),10);var _r=/r/.test(_d)?parseInt(_d.replace(/^.*r(.*)$/,"$1"),10):0;version=[_m,_r];}}else if(window.ActiveXObject){try{var _a=new ActiveXObject("ShockwaveFlash.ShockwaveFlash.7");}catch(e){try{_a=new ActiveXObject("ShockwaveFlash.ShockwaveFlash.6");version=[6,0];_a.AllowScriptAccess="always";}catch(ee){if(version[0]==6){return;}}try{_a=new ActiveXObject("ShockwaveFlash.ShockwaveFlash");}catch(eee){}}if(typeof _a=="object"){_d=_a.GetVariable("$version");if(typeof _d!="undefined"){_d=_d.replace(/^\S+\s+(.*)$/,"$1").split(",");version=[parseInt(_d[0],10),parseInt(_d[2],10)];}}}return version;},isSupported:function(version){var now=flashembed.getVersion();var ret=(now[0]>version[0])||(now[0]==version[0]&&now[1]>=version[1]);return ret;},domReady:domReady,asString:asString,getHTML:getHTML});if(jQ){jQuery.prototype.flashembed=function(conf,flashvars){return this.each(function(){flashembed(this,conf,flashvars);});};}})();
\ No newline at end of file
+
+(function(){function log(args){console.log("$f.fireEvent",[].slice.call(args));}
+function clone(obj){if(!obj||typeof obj!='object'){return obj;}
+var temp=new obj.constructor();for(var key in obj){if(obj.hasOwnProperty(key)){temp[key]=clone(obj[key]);}}
+return temp;}
+function each(obj,fn){if(!obj){return;}
+var name,i=0,length=obj.length;if(length===undefined){for(name in obj){if(fn.call(obj[name],name,obj[name])===false){break;}}}else{for(var value=obj[0];i<length&&fn.call(value,i,value)!==false;value=obj[++i]){}}
+return obj;}
+function el(id){return document.getElementById(id);}
+function extend(to,from,skipFuncs){if(typeof from!='object'){return to;}
+if(to&&from){each(from,function(name,value){if(!skipFuncs||typeof value!='function'){to[name]=value;}});}
+return to;}
+function select(query){var index=query.indexOf(".");if(index!=-1){var tag=query.substring(0,index)||"*";var klass=query.substring(index+1,query.length);var els=[];each(document.getElementsByTagName(tag),function(){if(this.className&&this.className.indexOf(klass)!=-1){els.push(this);}});return els;}}
+function stopEvent(e){e=e||window.event;if(e.preventDefault){e.stopPropagation();e.preventDefault();}else{e.returnValue=false;e.cancelBubble=true;}
+return false;}
+function bind(to,evt,fn){to[evt]=to[evt]||[];to[evt].push(fn);}
+function makeId(){return"_"+(""+Math.random()).substring(2,10);}
+var Clip=function(json,index,player){var self=this;var cuepoints={};var listeners={};self.index=index;if(typeof json=='string'){json={url:json};}
+extend(this,json,true);each(("Begin*,Start,Pause*,Resume*,Seek*,Stop*,Finish*,LastSecond,Update,BufferFull,BufferEmpty,BufferStop").split(","),function(){var evt="on"+this;if(evt.indexOf("*")!=-1){evt=evt.substring(0,evt.length-1);var before="onBefore"+evt.substring(2);self[before]=function(fn){bind(listeners,before,fn);return self;};}
+self[evt]=function(fn){bind(listeners,evt,fn);return self;};if(index==-1){if(self[before]){player[before]=self[before];}
+if(self[evt]){player[evt]=self[evt];}}});extend(this,{onCuepoint:function(points,fn){if(arguments.length==1){cuepoints.embedded=[null,points];return self;}
+if(typeof points=='number'){points=[points];}
+var fnId=makeId();cuepoints[fnId]=[points,fn];if(player.isLoaded()){player._api().fp_addCuepoints(points,index,fnId);}
+return self;},update:function(json){extend(self,json);if(player.isLoaded()){player._api().fp_updateClip(json,index);}
+var conf=player.getConfig();var clip=(index==-1)?conf.clip:conf.playlist[index];extend(clip,json,true);},_fireEvent:function(evt,arg1,arg2,target){if(evt=='onLoad'){each(cuepoints,function(key,val){if(val[0]){player._api().fp_addCuepoints(val[0],index,key);}});return false;}
+target=target||self;if(evt=='onCuepoint'){var fn=cuepoints[arg1];if(fn){return fn[1].call(player,target,arg2);}}
+if(arg1&&"onBeforeBegin,onMetaData,onStart,onUpdate,onResume".indexOf(evt)!=-1){extend(target,arg1);if(arg1.metaData){if(!target.duration){target.duration=arg1.metaData.duration;}else{target.fullDuration=arg1.metaData.duration;}}}
+var ret=true;each(listeners[evt],function(){ret=this.call(player,target,arg1,arg2);});return ret;}});if(json.onCuepoint){var arg=json.onCuepoint;self.onCuepoint.apply(self,typeof arg=='function'?[arg]:arg);delete json.onCuepoint;}
+each(json,function(key,val){if(typeof val=='function'){bind(listeners,key,val);delete json[key];}});if(index==-1){player.onCuepoint=this.onCuepoint;}};var Plugin=function(name,json,player,fn){var listeners={};var self=this;var hasMethods=false;if(fn){extend(listeners,fn);}
+each(json,function(key,val){if(typeof val=='function'){listeners[key]=val;delete json[key];}});extend(this,{animate:function(props,speed,fn){if(!props){return self;}
+if(typeof speed=='function'){fn=speed;speed=500;}
+if(typeof props=='string'){var key=props;props={};props[key]=speed;speed=500;}
+if(fn){var fnId=makeId();listeners[fnId]=fn;}
+if(speed===undefined){speed=500;}
+json=player._api().fp_animate(name,props,speed,fnId);return self;},css:function(props,val){if(val!==undefined){var css={};css[props]=val;props=css;}
+json=player._api().fp_css(name,props);extend(self,json);return self;},show:function(){this.display='block';player._api().fp_showPlugin(name);return self;},hide:function(){this.display='none';player._api().fp_hidePlugin(name);return self;},toggle:function(){this.display=player._api().fp_togglePlugin(name);return self;},fadeTo:function(o,speed,fn){if(typeof speed=='function'){fn=speed;speed=500;}
+if(fn){var fnId=makeId();listeners[fnId]=fn;}
+this.display=player._api().fp_fadeTo(name,o,speed,fnId);this.opacity=o;return self;},fadeIn:function(speed,fn){return self.fadeTo(1,speed,fn);},fadeOut:function(speed,fn){return self.fadeTo(0,speed,fn);},getName:function(){return name;},getPlayer:function(){return player;},_fireEvent:function(evt,arg,arg2){if(evt=='onUpdate'){var json=player._api().fp_getPlugin(name);if(!json){return;}
+extend(self,json);delete self.methods;if(!hasMethods){each(json.methods,function(){var method=""+this;self[method]=function(){var a=[].slice.call(arguments);var ret=player._api().fp_invoke(name,method,a);return ret==='undefined'||ret===undefined?self:ret;};});hasMethods=true;}}
+var fn=listeners[evt];if(fn){fn.apply(self,arg);if(evt.substring(0,1)=="_"){delete listeners[evt];}}}});};function Player(wrapper,params,conf){var
+self=this,api=null,html,commonClip,playlist=[],plugins={},listeners={},playerId,apiId,playerIndex,activeIndex,swfHeight,wrapperHeight;extend(self,{id:function(){return playerId;},isLoaded:function(){return(api!==null);},getParent:function(){return wrapper;},hide:function(all){if(all){wrapper.style.height="0px";}
+if(api){api.style.height="0px";}
+return self;},show:function(){wrapper.style.height=wrapperHeight+"px";if(api){api.style.height=swfHeight+"px";}
+return self;},isHidden:function(){return api&&parseInt(api.style.height,10)===0;},load:function(fn){if(!api&&self._fireEvent("onBeforeLoad")!==false){each(players,function(){this.unload();});html=wrapper.innerHTML;if(html&&!flashembed.isSupported(params.version)){wrapper.innerHTML="";}
+flashembed(wrapper,params,{config:conf});if(fn){fn.cached=true;bind(listeners,"onLoad",fn);}}
+return self;},unload:function(){if(html.replace(/\s/g,'')!==''){if(self._fireEvent("onBeforeUnload")===false){return self;}
+try{if(api){api.fp_close();self._fireEvent("onUnload");}}catch(error){}
+api=null;wrapper.innerHTML=html;}
+return self;},getClip:function(index){if(index===undefined){index=activeIndex;}
+return playlist[index];},getCommonClip:function(){return commonClip;},getPlaylist:function(){return playlist;},getPlugin:function(name){var plugin=plugins[name];if(!plugin&&self.isLoaded()){var json=self._api().fp_getPlugin(name);if(json){plugin=new Plugin(name,json,self);plugins[name]=plugin;}}
+return plugin;},getScreen:function(){return self.getPlugin("screen");},getControls:function(){return self.getPlugin("controls");},getConfig:function(copy){return copy?clone(conf):conf;},getFlashParams:function(){return params;},loadPlugin:function(name,url,props,fn){if(typeof props=='function'){fn=props;props={};}
+var fnId=fn?makeId():"_";self._api().fp_loadPlugin(name,url,props,fnId);var arg={};arg[fnId]=fn;var p=new Plugin(name,null,self,arg);plugins[name]=p;return p;},getState:function(){return api?api.fp_getState():-1;},play:function(clip,instream){function play(){if(clip!==undefined){self._api().fp_play(clip,instream);}else{self._api().fp_play();}}
+if(api){play();}else{self.load(function(){play();});}
+return self;},getVersion:function(){var js="flowplayer.js @VERSION";if(api){var ver=api.fp_getVersion();ver.push(js);return ver;}
+return js;},_api:function(){if(!api){throw"Flowplayer "+self.id()+" not loaded when calling an API method";}
+return api;},setClip:function(clip){self.setPlaylist([clip]);return self;},getIndex:function(){return playerIndex;}});each(("Click*,Load*,Unload*,Keypress*,Volume*,Mute*,Unmute*,PlaylistReplace,ClipAdd,Fullscreen*,FullscreenExit,Error,MouseOver,MouseOut").split(","),function(){var name="on"+this;if(name.indexOf("*")!=-1){name=name.substring(0,name.length-1);var name2="onBefore"+name.substring(2);self[name2]=function(fn){bind(listeners,name2,fn);return self;};}
+self[name]=function(fn){bind(listeners,name,fn);return self;};});each(("pause,resume,mute,unmute,stop,toggle,seek,getStatus,getVolume,setVolume,getTime,isPaused,isPlaying,startBuffering,stopBuffering,isFullscreen,toggleFullscreen,reset,close,setPlaylist,addClip,playFeed").split(","),function(){var name=this;self[name]=function(a1,a2){if(!api){return self;}
+var ret=null;if(a1!==undefined&&a2!==undefined){ret=api["fp_"+name](a1,a2);}else{ret=(a1===undefined)?api["fp_"+name]():api["fp_"+name](a1);}
+return ret==='undefined'||ret===undefined?self:ret;};});self._fireEvent=function(a){if(typeof a=='string'){a=[a];}
+var evt=a[0],arg0=a[1],arg1=a[2],arg2=a[3],i=0;if(conf.debug){log(a);}
+if(!api&&evt=='onLoad'&&arg0=='player'){api=api||el(apiId);swfHeight=api.clientHeight;each(playlist,function(){this._fireEvent("onLoad");});each(plugins,function(name,p){p._fireEvent("onUpdate");});commonClip._fireEvent("onLoad");}
+if(evt=='onLoad'&&arg0!='player'){return;}
+if(evt=='onError'){if(typeof arg0=='string'||(typeof arg0=='number'&&typeof arg1=='number')){arg0=arg1;arg1=arg2;}}
+if(evt=='onContextMenu'){each(conf.contextMenu[arg0],function(key,fn){fn.call(self);});return;}
+if(evt=='onPluginEvent'){var name=arg0.name||arg0;var p=plugins[name];if(p){p._fireEvent("onUpdate",arg0);p._fireEvent(arg1,a.slice(3));}
+return;}
+if(evt=='onPlaylistReplace'){playlist=[];var index=0;each(arg0,function(){playlist.push(new Clip(this,index++,self));});}
+if(evt=='onClipAdd'){if(arg0.isInStream){return;}
+arg0=new Clip(arg0,arg1,self);playlist.splice(arg1,0,arg0);for(i=arg1+1;i<playlist.length;i++){playlist[i].index++;}}
+var ret=true;if(typeof arg0=='number'&&arg0<playlist.length){activeIndex=arg0;var clip=playlist[arg0];if(clip){ret=clip._fireEvent(evt,arg1,arg2);}
+if(!clip||ret!==false){ret=commonClip._fireEvent(evt,arg1,arg2,clip);}}
+each(listeners[evt],function(){ret=this.call(self,arg0,arg1);if(this.cached){listeners[evt].splice(i,1);}
+if(ret===false){return false;}
+i++;});return ret;};function init(){if($f(wrapper)){$f(wrapper).getParent().innerHTML="";playerIndex=$f(wrapper).getIndex();players[playerIndex]=self;}else{players.push(self);playerIndex=players.length-1;}
+wrapperHeight=parseInt(wrapper.style.height,10)||wrapper.clientHeight;if(typeof params=='string'){params={src:params};}
+playerId=wrapper.id||"fp"+makeId();apiId=params.id||playerId+"_api";params.id=apiId;conf.playerId=playerId;if(typeof conf=='string'){conf={clip:{url:conf}};}
+if(typeof conf.clip=='string'){conf.clip={url:conf.clip};}
+conf.clip=conf.clip||{};if(wrapper.getAttribute("href",2)&&!conf.clip.url){conf.clip.url=wrapper.getAttribute("href",2);}
+commonClip=new Clip(conf.clip,-1,self);conf.playlist=conf.playlist||[conf.clip];var index=0;each(conf.playlist,function(){var clip=this;if(typeof clip=='object'&&clip.length){clip={url:""+clip};}
+each(conf.clip,function(key,val){if(val!==undefined&&clip[key]===undefined&&typeof val!='function'){clip[key]=val;}});conf.playlist[index]=clip;clip=new Clip(clip,index,self);playlist.push(clip);index++;});each(conf,function(key,val){if(typeof val=='function'){if(commonClip[key]){commonClip[key](val);}else{bind(listeners,key,val);}
+delete conf[key];}});each(conf.plugins,function(name,val){if(val){plugins[name]=new Plugin(name,val,self);}});if(!conf.plugins||conf.plugins.controls===undefined){plugins.controls=new Plugin("controls",null,self);}
+plugins.canvas=new Plugin("canvas",null,self);params.bgcolor=params.bgcolor||"#000000";params.version=params.version||[9,0];params.expressInstall='http://www.flowplayer.org/swf/expressinstall.swf';function doClick(e){if(!self.isLoaded()&&self._fireEvent("onBeforeClick")!==false){self.load();}
+return stopEvent(e);}
+html=wrapper.innerHTML;if(html.replace(/\s/g,'')!==''){if(wrapper.addEventListener){wrapper.addEventListener("click",doClick,false);}else if(wrapper.attachEvent){wrapper.attachEvent("onclick",doClick);}}else{if(wrapper.addEventListener){wrapper.addEventListener("click",stopEvent,false);}
+self.load();}}
+if(typeof wrapper=='string'){flashembed.domReady(function(){var node=el(wrapper);if(!node){throw"Flowplayer cannot access element: "+wrapper;}else{wrapper=node;init();}});}else{init();}}
+var players=[];function Iterator(arr){this.length=arr.length;this.each=function(fn){each(arr,fn);};this.size=function(){return arr.length;};}
+window.flowplayer=window.$f=function(){var instance=null;var arg=arguments[0];if(!arguments.length){each(players,function(){if(this.isLoaded()){instance=this;return false;}});return instance||players[0];}
+if(arguments.length==1){if(typeof arg=='number'){return players[arg];}else{if(arg=='*'){return new Iterator(players);}
+each(players,function(){if(this.id()==arg.id||this.id()==arg||this.getParent()==arg){instance=this;return false;}});return instance;}}
+if(arguments.length>1){var swf=arguments[1];var conf=(arguments.length==3)?arguments[2]:{};if(typeof arg=='string'){if(arg.indexOf(".")!=-1){var instances=[];each(select(arg),function(){instances.push(new Player(this,clone(swf),clone(conf)));});return new Iterator(instances);}else{var node=el(arg);return new Player(node!==null?node:arg,swf,conf);}}else if(arg){return new Player(arg,swf,conf);}}
+return null;};extend(window.$f,{fireEvent:function(){var a=[].slice.call(arguments);var p=$f(a[0]);return p?p._fireEvent(a.slice(1)):null;},addPlugin:function(name,fn){Player.prototype[name]=fn;return $f;},each:each,extend:extend});if(typeof jQuery=='function'){jQuery.prototype.flowplayer=function(params,conf){if(!arguments.length||typeof arguments[0]=='number'){var arr=[];this.each(function(){var p=$f(this);if(p){arr.push(p);}});return arguments.length?arr[arguments[0]]:new Iterator(arr);}
+return this.each(function(){$f(this,clone(params),conf?clone(conf):{});});};}})();(function(){var jQ=typeof jQuery=='function';var options={width:'100%',height:'100%',allowfullscreen:true,allowscriptaccess:'always',quality:'high',version:null,onFail:null,expressInstall:null,w3c:false,cachebusting:false};if(jQ){jQuery.tools=jQuery.tools||{};jQuery.tools.flashembed={version:'1.0.4',conf:options};}
+function isDomReady(){if(domReady.done){return false;}
+var d=document;if(d&&d.getElementsByTagName&&d.getElementById&&d.body){clearInterval(domReady.timer);domReady.timer=null;for(var i=0;i<domReady.ready.length;i++){domReady.ready[i].call();}
+domReady.ready=null;domReady.done=true;}}
+var domReady=jQ?jQuery:function(f){if(domReady.done){return f();}
+if(domReady.timer){domReady.ready.push(f);}else{domReady.ready=[f];domReady.timer=setInterval(isDomReady,13);}};function extend(to,from){if(from){for(key in from){if(from.hasOwnProperty(key)){to[key]=from[key];}}}
+return to;}
+var cx=/[\u0000\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/g,escapable=/[\\\"\x00-\x1f\x7f-\x9f\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/g,gap,indent,meta={'\b':'\\b','\t':'\\t','\n':'\\n','\f':'\\f','\r':'\\r','"':'\\"','\\':'\\\\'},rep;function string2JsonString(string){escapable.lastIndex=0;return escapable.test(string)?'"'+string.replace(escapable,function(a){var c=meta[a];return typeof c==='string'?c:'\\u'+('0000'+a.charCodeAt(0).toString(16)).slice(-4);})+'"':'"'+string+'"';}
+function asString(obj){switch(typeOf(obj)){case'string':return string2JsonString(obj);case'array':return'['+map(obj,function(el){return asString(el);}).join(',')+']';case'function':return'"function()"';case'object':var str=[];for(var prop in obj){if(obj.hasOwnProperty(prop)){str.push('"'+prop+'":'+asString(obj[prop]));}}
+return'{'+str.join(',')+'}';}
+return String(obj).replace(/\s/g," ").replace(/\'/g,"\"");}
+function typeOf(obj){if(obj===null||obj===undefined){return false;}
+var type=typeof obj;return(type=='object'&&obj.push)?'array':type;}
+if(window.attachEvent){window.attachEvent("onbeforeunload",function(){__flash_unloadHandler=function(){};__flash_savedUnloadHandler=function(){};});}
+function map(arr,func){var newArr=[];for(var i in arr){if(arr.hasOwnProperty(i)){newArr[i]=func(arr[i]);}}
+return newArr;}
+function getHTML(p,c){var e=extend({},p);var ie=document.all;var html='<object width="'+e.width+'" height="'+e.height+'"';if(ie&&!e.id){e.id="_"+(""+Math.random()).substring(9);}
+if(e.id){html+=' id="'+e.id+'"';}
+if(e.cachebusting){e.src+=((e.src.indexOf("?")!=-1?"&":"?")+Math.random());}
+if(e.w3c||!ie){html+=' data="'+e.src+'" type="application/x-shockwave-flash"';}else{html+=' classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000"';}
+html+='>';if(e.w3c||ie){html+='<param name="movie" value="'+e.src+'" />';}
+e.width=e.height=e.id=e.w3c=e.src=null;for(var k in e){if(e[k]!==null){html+='<param name="'+k+'" value="'+e[k]+'" />';}}
+var vars="";if(c){for(var key in c){if(c[key]!==null){vars+=encodeURIComponent(key)+'='
++encodeURIComponent(typeof c[key]=='object'?asString(c[key]):c[key])
++'&';}}
+vars=vars.substring(0,vars.length-1);html+='<param name="flashvars" value="'+vars+'" />';}
+html+="</object>";return html;}
+function Flash(root,opts,flashvars){var version=flashembed.getVersion();extend(this,{getContainer:function(){return root;},getConf:function(){return opts;},getVersion:function(){return version;},getFlashvars:function(){return flashvars;},getApi:function(){return root.firstChild;},getHTML:function(){return getHTML(opts,flashvars);}});var required=opts.version;var express=opts.expressInstall;var ok=!required||flashembed.isSupported(required);if(ok){opts.onFail=opts.version=opts.expressInstall=null;root.innerHTML=getHTML(opts,flashvars);}else if(required&&express&&flashembed.isSupported([6,65])){extend(opts,{src:express});flashvars={MMredirectURL:location.href,MMplayerType:'PlugIn',MMdoctitle:document.title};root.innerHTML=getHTML(opts,flashvars);}else{if(root.innerHTML.replace(/\s/g,'')!==''){}else{root.innerHTML="<h2>Flash version "+required+" or greater is required</h2>"+"<h3>"+
+(version[0]>0?"Your version is "+version:"You have no flash plugin installed")+"</h3>"+
+(root.tagName=='A'?"<p>Click here to download latest version</p>":"<p>Download latest version from <a href='http://www.adobe.com/go/getflashplayer'>here</a></p>");if(root.tagName=='A'){root.onclick=function(){location.href='http://www.adobe.com/go/getflashplayer';};}}}
+if(!ok&&opts.onFail){var ret=opts.onFail.call(this);if(typeof ret=='string'){root.innerHTML=ret;}}
+if(document.all){window[opts.id]=document.getElementById(opts.id);}}
+window.flashembed=function(root,conf,flashvars){if(typeof root=='string'){var el=document.getElementById(root);if(el){root=el;}else{domReady(function(){flashembed(root,conf,flashvars);});return;}}
+if(!root){return;}
+if(typeof conf=='string'){conf={src:conf};}
+var opts=extend({},options);extend(opts,conf);return new Flash(root,opts,flashvars);};extend(window.flashembed,{getVersion:function(){var version=[0,0];if(navigator.plugins&&typeof navigator.plugins["Shockwave Flash"]=="object"){var _d=navigator.plugins["Shockwave Flash"].description;if(typeof _d!="undefined"){_d=_d.replace(/^.*\s+(\S+\s+\S+$)/,"$1");var _m=parseInt(_d.replace(/^(.*)\..*$/,"$1"),10);var _r=/r/.test(_d)?parseInt(_d.replace(/^.*r(.*)$/,"$1"),10):0;version=[_m,_r];}}else if(window.ActiveXObject){try{var _a=new ActiveXObject("ShockwaveFlash.ShockwaveFlash.7");}catch(e){try{_a=new ActiveXObject("ShockwaveFlash.ShockwaveFlash.6");version=[6,0];_a.AllowScriptAccess="always";}catch(ee){if(version[0]==6){return version;}}
+try{_a=new ActiveXObject("ShockwaveFlash.ShockwaveFlash");}catch(eee){}}
+if(typeof _a=="object"){_d=_a.GetVariable("$version");if(typeof _d!="undefined"){_d=_d.replace(/^\S+\s+(.*)$/,"$1").split(",");version=[parseInt(_d[0],10),parseInt(_d[2],10)];}}}
+return version;},isSupported:function(version){var now=flashembed.getVersion();var ret=(now[0]>version[0])||(now[0]==version[0]&&now[1]>=version[1]);return ret;},domReady:domReady,asString:asString,getHTML:getHTML});if(jQ){jQuery.fn.flashembed=function(conf,flashvars){var el=null;this.each(function(){el=flashembed(this,conf,flashvars);});return conf.api===false?this:el;};}})();
\ No newline at end of file
-- 
cgit v1.2.3


From 0de067312e375fae00d63b99d280aa796f043c22 Mon Sep 17 00:00:00 2001
From: Tim Almdal <tnalmdal@shaw.ca>
Date: Tue, 26 Jan 2010 19:59:44 -0800
Subject: Add a routing that allow add and edit form requests to be routed the
 same way as non admin forms.  i.e. a uri of
 /form/add/admin/<controller>/parms gets routed as
 admin/<controller/form_add/<parms>

---
 modules/gallery/config/routes.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/gallery/config/routes.php b/modules/gallery/config/routes.php
index 63cc6150..8ccd5a01 100644
--- a/modules/gallery/config/routes.php
+++ b/modules/gallery/config/routes.php
@@ -21,6 +21,10 @@
 // Admin controllers are not available, except via /admin
 $config["^admin_.*"] = null;
 
+// Redirect /form/add/admin/controller and /form/edit/admin/controller to
+// admin/controller/form_(add|edit)/parms. provides the same as below for admin pages
+$config["^form/(edit|add)/admin/(\w+)/(.*)$"] = "admin/$2/form_$1/$3";
+
 // Redirect /form/add and /form/edit to the module/form_(add|edit)/parms.
 $config["^form/(edit|add)/(\w+)/(.*)$"] = "$2/form_$1/$3";
 
-- 
cgit v1.2.3


From 63db756441fe2971bdcbcee3ba1bb20c179ffa59 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 27 Jan 2010 01:49:37 -0800
Subject: Switch to using test helper.  Also, reload the album before running
 access::deny since the mptt pointers will have changed.

---
 modules/gallery/tests/Access_Helper_Test.php | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/modules/gallery/tests/Access_Helper_Test.php b/modules/gallery/tests/Access_Helper_Test.php
index 35cf5edb..5331117d 100644
--- a/modules/gallery/tests/Access_Helper_Test.php
+++ b/modules/gallery/tests/Access_Helper_Test.php
@@ -194,14 +194,15 @@ class Access_Helper_Test extends Gallery_Unit_Test_Case {
   }
 
   public function view_permissions_propagate_down_to_photos_test() {
-    $album = album::create(item::root(), rand(), "test album");
-    $photo = photo::create($album, MODPATH . "gallery/images/gallery.png", "", "");
+    $album = test::random_album();
+    $photo = test::random_photo($album);
     identity::set_active_user(identity::guest());
 
     $this->assert_true(access::can("view", $photo));
+    $album->reload();  // MPTT pointers have changed, so reload before calling access::deny
     access::deny(identity::everybody(), "view", $album);
 
-    $photo->reload();  // view permissions are cached in the photo
+    $photo->reload();  // view permissions are cached in the photo, so reload before checking
     $this->assert_false(access::can("view", $photo));
   }
 
-- 
cgit v1.2.3


From 7667864d61c857907795a351fbeb54c8f3506f6f Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 27 Jan 2010 09:55:00 -0800
Subject: Minor test-only fixes.

---
 modules/tag/tests/Tags_Rest_Helper_Test.php | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/tag/tests/Tags_Rest_Helper_Test.php b/modules/tag/tests/Tags_Rest_Helper_Test.php
index 33220b3b..0254adc8 100644
--- a/modules/tag/tests/Tags_Rest_Helper_Test.php
+++ b/modules/tag/tests/Tags_Rest_Helper_Test.php
@@ -33,6 +33,7 @@ class Tags_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $request = new stdClass();
     $this->assert_equal_array(
       array(
+        "url" => rest::url("tags"),
         "members" => array(
           rest::url("tag", $t1),
           rest::url("tag", $t2))),
@@ -50,6 +51,7 @@ class Tags_Rest_Helper_Test extends Gallery_Unit_Test_Case {
 
   public function post_fails_without_permissions_test() {
     access::deny(identity::everybody(), "edit", item::root());
+    identity::set_active_user(identity::guest());
 
     try {
       $request->params->name = "test tag";
-- 
cgit v1.2.3


From f9062101479c809b0957903b7116aaed86f24d76 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 27 Jan 2010 09:55:49 -0800
Subject: Verified and updated

---
 modules/gallery/tests/controller_auth_data.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/gallery/tests/controller_auth_data.txt b/modules/gallery/tests/controller_auth_data.txt
index 40f37e96..0aa26057 100644
--- a/modules/gallery/tests/controller_auth_data.txt
+++ b/modules/gallery/tests/controller_auth_data.txt
@@ -19,7 +19,7 @@ modules/gallery/controllers/quick.php                        form_edit
 modules/gallery/controllers/simple_uploader.php              start                DIRTY_AUTH
 modules/gallery/controllers/simple_uploader.php              finish               DIRTY_AUTH
 modules/gallery/controllers/upgrader.php                     index                DIRTY_AUTH
-modules/gallery/controllers/user_profile.php                 show                 DIRTY_CSRF|DIRTY_AUTH
+modules/gallery/controllers/user_profile.php                 show                 DIRTY_AUTH
 modules/gallery/controllers/user_profile.php                 contact              DIRTY_AUTH
 modules/gallery/controllers/user_profile.php                 send                 DIRTY_AUTH
 modules/gallery/controllers/welcome_message.php              index                DIRTY_AUTH
-- 
cgit v1.2.3


From ec0f89f10a58c3c3751387d5c1d1efcbf940bc9a Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 27 Jan 2010 21:40:48 -0800
Subject: Change "resource" to "entity" in REST responses.  They're all
 resources, but we differentiate resources as collections and entities.

---
 modules/gallery/helpers/item_rest.php           |  2 +-
 modules/gallery/tests/Item_Rest_Helper_Test.php | 11 ++++++-----
 modules/tag/helpers/tag_rest.php                |  2 +-
 modules/tag/tests/Tag_Rest_Helper_Test.php      |  4 ++--
 4 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/modules/gallery/helpers/item_rest.php b/modules/gallery/helpers/item_rest.php
index 9598b191..2236fbbb 100644
--- a/modules/gallery/helpers/item_rest.php
+++ b/modules/gallery/helpers/item_rest.php
@@ -77,7 +77,7 @@ class item_rest_Core {
 
     return array(
       "url" => $request->url,
-      "resource" => $item->as_array(),
+      "entity" => $item->as_array(),
       "members" => $members,
       "relationships" => rest::relationships("item", $item));
   }
diff --git a/modules/gallery/tests/Item_Rest_Helper_Test.php b/modules/gallery/tests/Item_Rest_Helper_Test.php
index 8ce6bc43..d91e0f58 100644
--- a/modules/gallery/tests/Item_Rest_Helper_Test.php
+++ b/modules/gallery/tests/Item_Rest_Helper_Test.php
@@ -36,7 +36,7 @@ class Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $request->params = new stdClass();
     $this->assert_equal_array(
       array("url" => rest::url("item", $album1),
-            "resource" => $album1->as_array(),
+            "entity" => $album1->as_array(),
             "members" => array(
               rest::url("item", $photo1),
               rest::url("item", $album2)),
@@ -50,7 +50,7 @@ class Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $request->params->scope = "direct";
     $this->assert_equal_array(
       array("url" => rest::url("item", $album1),
-            "resource" => $album1->as_array(),
+            "entity" => $album1->as_array(),
             "members" => array(
               rest::url("item", $photo1),
               rest::url("item", $album2)),
@@ -64,7 +64,7 @@ class Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $request->params->scope = "all";
     $this->assert_equal_array(
       array("url" => rest::url("item", $album1),
-            "resource" => $album1->as_array(),
+            "entity" => $album1->as_array(),
             "members" => array(
               rest::url("item", $photo1),
               rest::url("item", $album2),
@@ -88,7 +88,7 @@ class Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $request->params->name = "foo";
     $this->assert_equal_array(
       array("url" => rest::url("item", $album1),
-            "resource" => $album1->as_array(),
+            "entity" => $album1->as_array(),
             "members" => array(
               rest::url("item", $photo2)),
             "relationships" => array(
@@ -108,7 +108,7 @@ class Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $request->params->type = "album";
     $this->assert_equal_array(
       array("url" => rest::url("item", $album1),
-            "resource" => $album1->as_array(),
+            "entity" => $album1->as_array(),
             "members" => array(
               rest::url("item", $album2)),
             "relationships" => array(
@@ -210,6 +210,7 @@ class Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
   public function delete_album_fails_without_permission_test() {
     $album1 = test::random_album();
     access::deny(identity::everybody(), "edit", $album1);
+    identity::set_active_user(identity::guest());
 
     $request->url = rest::url("item", $album1);
     try {
diff --git a/modules/tag/helpers/tag_rest.php b/modules/tag/helpers/tag_rest.php
index 4b2a4b46..7143daa9 100644
--- a/modules/tag/helpers/tag_rest.php
+++ b/modules/tag/helpers/tag_rest.php
@@ -29,7 +29,7 @@ class tag_rest_Core {
 
     return array(
       "url" => $request->url,
-      "resource" => $tag->as_array(),
+      "entity" => $tag->as_array(),
       "relationships" => array(
         "items" => array(
           "url" => rest::url("tag_items", $tag),
diff --git a/modules/tag/tests/Tag_Rest_Helper_Test.php b/modules/tag/tests/Tag_Rest_Helper_Test.php
index eacf91b3..d3cae0fb 100644
--- a/modules/tag/tests/Tag_Rest_Helper_Test.php
+++ b/modules/tag/tests/Tag_Rest_Helper_Test.php
@@ -31,7 +31,7 @@ class Tag_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $request->url = rest::url("tag", $tag);
     $this->assert_equal_array(
       array("url" => rest::url("tag", $tag),
-            "resource" => $tag->as_array(),
+            "entity" => $tag->as_array(),
             "relationships" => array(
               "items" => array(
                 "url" => rest::url("tag_items", $tag),
@@ -56,7 +56,7 @@ class Tag_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $request->url = rest::url("tag", $tag);
     $this->assert_equal_array(
       array("url" => rest::url("tag", $tag),
-            "resource" => $tag->as_array(),
+            "entity" => $tag->as_array(),
             "relationships" => array(
               "items" => array(
                 "url" => rest::url("tag_items", $tag),
-- 
cgit v1.2.3


From 212633d05a5a8abb77a744a69c61d6e3051b73c5 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 27 Jan 2010 21:52:18 -0800
Subject: Prevent accidentally deleting the root album.

---
 modules/gallery/models/item.php           |  6 ++++++
 modules/gallery/tests/Item_Model_Test.php | 10 ++++++++++
 2 files changed, 16 insertions(+)

diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php
index e4ff0bfb..9706d61f 100644
--- a/modules/gallery/models/item.php
+++ b/modules/gallery/models/item.php
@@ -71,6 +71,12 @@ class Item_Model extends ORM_MPTT {
   }
 
   public function delete() {
+    if ($this->id == 1) {
+      $v = new Validation(array("id"));
+      $v->add_error("id", "cant_delete_root_album");
+      ORM_Validation_Exception::handle_validation($this->table_name, $v);
+    }
+
     $old = clone $this;
     module::event("item_before_delete", $this);
 
diff --git a/modules/gallery/tests/Item_Model_Test.php b/modules/gallery/tests/Item_Model_Test.php
index 1e77076a..eb9ecc99 100644
--- a/modules/gallery/tests/Item_Model_Test.php
+++ b/modules/gallery/tests/Item_Model_Test.php
@@ -336,4 +336,14 @@ class Item_Model_Test extends Gallery_Unit_Test_Case {
     }
     $this->assert_true(false, "Shouldn't get here");
   }
+
+  public function cant_delete_root_album_test() {
+    try {
+      item::root()->delete();
+    } catch (ORM_Validation_Exception $e) {
+      $this->assert_same(array("id" => "cant_delete_root_album"), $e->validation->errors());
+      return;  // pass
+    }
+    $this->assert_true(false, "Shouldn't get here");
+  }
 }
-- 
cgit v1.2.3


From cfbbf9ef606094868ccbd25ccf65e1a6f610528b Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 27 Jan 2010 21:58:06 -0800
Subject: Convert __toString() to use (string) cast instead.

---
 modules/exif/helpers/exif_task.php        |  2 +-
 modules/g2_import/helpers/g2_import.php   | 10 +++++-----
 modules/gallery/helpers/gallery_task.php  |  8 ++++----
 modules/gallery/helpers/task.php          |  4 ++--
 modules/organize/controllers/organize.php | 10 +++++-----
 modules/tag/controllers/tags.php          |  2 +-
 6 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/modules/exif/helpers/exif_task.php b/modules/exif/helpers/exif_task.php
index 27352643..90869630 100644
--- a/modules/exif/helpers/exif_task.php
+++ b/modules/exif/helpers/exif_task.php
@@ -82,7 +82,7 @@ class exif_task_Core {
       $task->done = true;
       $task->state = "error";
       $task->status = $e->getMessage();
-      $task->log($e->__toString());
+      $task->log((string)$e);
     }
   }
 }
diff --git a/modules/g2_import/helpers/g2_import.php b/modules/g2_import/helpers/g2_import.php
index 6f019aa8..74164305 100644
--- a/modules/g2_import/helpers/g2_import.php
+++ b/modules/g2_import/helpers/g2_import.php
@@ -239,7 +239,7 @@ class g2_import_Core {
       $g2_group = g2(GalleryCoreApi::loadEntitiesById($g2_group_id));
     } catch (Exception $e) {
       return t("Failed to import Gallery 2 group with id: %id\n%exception",
-               array("id" => $g2_group_id, "exception" => $e->__toString()));
+               array("id" => $g2_group_id, "exception" => (string)$e));
     }
 
     switch ($g2_group->getGroupType()) {
@@ -295,7 +295,7 @@ class g2_import_Core {
       $g2_user = g2(GalleryCoreApi::loadEntitiesById($g2_user_id));
     } catch (Exception $e) {
       return t("Failed to import Gallery 2 user with id: %id\n%exception",
-               array("id" => $g2_user_id, "exception" => $e->__toString()));
+               array("id" => $g2_user_id, "exception" => (string)$e));
     }
     $g2_groups = g2(GalleryCoreApi::fetchGroupsForUser($g2_user->getId()));
 
@@ -449,7 +449,7 @@ class g2_import_Core {
       $g2_path = g2($g2_item->fetchPath());
     } catch (Exception $e) {
       return t("Failed to import Gallery 2 item with id: %id\n%exception",
-               array("id" => $g2_item_id, "exception" => $e->__toString()));
+               array("id" => $g2_item_id, "exception" => (string)$e));
     }
 
     $parent = ORM::factory("item")->where("id", "=", self::map($g2_item->getParentId()))->find();
@@ -596,7 +596,7 @@ class g2_import_Core {
       $g2_comment = g2(GalleryCoreApi::loadEntitiesById($g2_comment_id));
     } catch (Exception $e) {
       return t("Failed to import Gallery 2 comment with id: %id\%exception",
-               array("id" => $g2_comment_id, "exception" => $e->__toString()));
+               array("id" => $g2_comment_id, "exception" => (string)$e));
     }
 
     $text = $g2_comment->getSubject();
@@ -642,7 +642,7 @@ class g2_import_Core {
       $tag_names = array_values(g2(TagsHelper::getTagsByItemId($g2_item_id)));
     } catch (Exception $e) {
       return t("Failed to import Gallery 2 tags for item with id: %id\n%exception",
-               array("id" => $g2_item_id, "exception" => $e->__toString()));
+               array("id" => $g2_item_id, "exception" => (string)$e));
     }
 
     foreach ($tag_names as $tag_name) {
diff --git a/modules/gallery/helpers/gallery_task.php b/modules/gallery/helpers/gallery_task.php
index 5402b5d1..c75e050a 100644
--- a/modules/gallery/helpers/gallery_task.php
+++ b/modules/gallery/helpers/gallery_task.php
@@ -81,7 +81,7 @@ class gallery_task_Core {
           } catch (Exception $e) {
             $errors[] = t("Unable to rebuild images for '%title'",
                           array("title" => html::purify($item->title)));
-            $errors[] = $e->__toString();
+            $errors[] = (string)$e;
             $ignored[$item->id] = 1;
           }
         }
@@ -114,7 +114,7 @@ class gallery_task_Core {
       $task->done = true;
       $task->state = "error";
       $task->status = $e->getMessage();
-      $errors[] = $e->__toString();
+      $errors[] = (string)$e;
     }
     if ($errors) {
       $task->log($errors);
@@ -217,7 +217,7 @@ class gallery_task_Core {
       $task->done = true;
       $task->state = "error";
       $task->status = $e->getMessage();
-      $errors[] = $e->__toString();
+      $errors[] = (string)$e;
     }
     if ($errors) {
       $task->log($errors);
@@ -284,7 +284,7 @@ class gallery_task_Core {
       $task->done = true;
       $task->state = "error";
       $task->status = $e->getMessage();
-      $errors[] = $e->__toString();
+      $errors[] = (string)$e;
     }
     if ($errors) {
       $task->log($errors);
diff --git a/modules/gallery/helpers/task.php b/modules/gallery/helpers/task.php
index ad756ecd..645850d1 100644
--- a/modules/gallery/helpers/task.php
+++ b/modules/gallery/helpers/task.php
@@ -84,7 +84,7 @@ class task_Core {
       }
       $task->save();
     } catch (Exception $e) {
-      Kohana_Log::add("error", $e->__toString());
+      Kohana_Log::add("error", (string)$e);
 
       // Ugh.  I hate to use instanceof, But this beats catching the exception separately since
       // we mostly want to treat it the same way as all other exceptions
@@ -92,7 +92,7 @@ class task_Core {
         Kohana_Log::add("error", "Validation errors: " . print_r($e->validation->errors(), 1));
       }
 
-      $task->log($e->__toString());
+      $task->log((string)$e);
       $task->state = "error";
       $task->done = true;
       $task->status = substr($e->getMessage(), 0, 255);
diff --git a/modules/organize/controllers/organize.php b/modules/organize/controllers/organize.php
index 201ced30..4a4b9f13 100644
--- a/modules/organize/controllers/organize.php
+++ b/modules/organize/controllers/organize.php
@@ -36,7 +36,7 @@ class Organize_Controller extends Controller {
     access::required("edit", $album);
 
     print json_encode(
-      array("grid" => self::_get_micro_thumb_grid($album, $offset)->__toString(),
+      array("grid" => (string)self::_get_micro_thumb_grid($album, $offset),
             "sort_column" => $album->sort_column,
             "sort_order" => $album->sort_order));
   }
@@ -57,8 +57,8 @@ class Organize_Controller extends Controller {
     }
 
     print json_encode(
-      array("tree" => self::_expanded_tree(ORM::factory("item", 1), $target_album)->__toString(),
-            "grid" => self::_get_micro_thumb_grid($target_album, 0)->__toString()));
+      array("tree" => (string)self::_expanded_tree(ORM::factory("item", 1), $target_album),
+            "grid" => (string)self::_get_micro_thumb_grid($target_album, 0)));
   }
 
   function rearrange($target_id, $before_or_after) {
@@ -114,7 +114,7 @@ class Organize_Controller extends Controller {
     module::event("album_rearrange", $album);
 
     print json_encode(
-      array("grid" => self::_get_micro_thumb_grid($album, 0)->__toString(),
+      array("grid" => (string)self::_get_micro_thumb_grid($album, 0),
             "sort_column" => $album->sort_column,
             "sort_order" => $album->sort_order));
   }
@@ -136,7 +136,7 @@ class Organize_Controller extends Controller {
     $album->save();
 
     print json_encode(
-      array("grid" => self::_get_micro_thumb_grid($album, 0)->__toString(),
+      array("grid" => (string)self::_get_micro_thumb_grid($album, 0),
             "sort_column" => $album->sort_column,
             "sort_order" => $album->sort_order));
   }
diff --git a/modules/tag/controllers/tags.php b/modules/tag/controllers/tags.php
index e28b7a83..1eede907 100644
--- a/modules/tag/controllers/tags.php
+++ b/modules/tag/controllers/tags.php
@@ -69,7 +69,7 @@ class Tags_Controller extends Controller {
 
       print json_encode(
         array("result" => "success",
-              "cloud" => tag::cloud(30)->__toString()));
+              "cloud" => (string)tag::cloud(30)));
     } else {
       print json_encode(array("result" => "error", "form" => (string) $form));
     }
-- 
cgit v1.2.3


From 4b32a71afc7650fe7bdd02ba384c8914f60538f3 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 27 Jan 2010 22:34:11 -0800
Subject: Convert back to using ORM::factory(..., $id) instead of calling
 where().

---
 modules/comment/models/comment.php            |  2 +-
 modules/comment/tests/Comment_Event_Test.php  |  2 +-
 modules/g2_import/controllers/g2.php          |  2 +-
 modules/g2_import/helpers/g2_import.php       | 11 +++++------
 modules/gallery/helpers/gallery_installer.php |  2 +-
 modules/gallery/helpers/item_rest.php         |  2 +-
 modules/gallery/libraries/ORM_MPTT.php        |  2 +-
 modules/gallery/models/item.php               |  4 ++--
 modules/server_add/controllers/server_add.php | 13 ++++++-------
 modules/tag/helpers/item_tags_rest.php        |  2 +-
 modules/tag/helpers/tag_item_rest.php         |  4 ++--
 modules/tag/helpers/tag_items_rest.php        |  2 +-
 modules/tag/helpers/tag_rest.php              |  2 +-
 modules/user/models/group.php                 |  2 +-
 modules/user/models/user.php                  |  2 +-
 15 files changed, 26 insertions(+), 28 deletions(-)

diff --git a/modules/comment/models/comment.php b/modules/comment/models/comment.php
index 43c4148f..8be022b5 100644
--- a/modules/comment/models/comment.php
+++ b/modules/comment/models/comment.php
@@ -108,7 +108,7 @@ class Comment_Model extends ORM {
       module::event("comment_created", $this);
     } else {
       // Updated comment
-      $original = ORM::factory("comment")->where("id", "=", $this->id)->find();
+      $original = ORM::factory("comment", $this->id);
       $visible_change = $original->state == "published" || $this->state == "published";
       parent::save();
       module::event("comment_updated", $original, $this);
diff --git a/modules/comment/tests/Comment_Event_Test.php b/modules/comment/tests/Comment_Event_Test.php
index 27272055..08f55b3f 100644
--- a/modules/comment/tests/Comment_Event_Test.php
+++ b/modules/comment/tests/Comment_Event_Test.php
@@ -30,6 +30,6 @@ class Comment_Event_Test extends Gallery_Unit_Test_Case {
 
     $album->delete();
 
-    $this->assert_false(ORM::factory("comment")->where("id", "=", $comment->id)->find()->loaded());
+    $this->assert_false(ORM::factory("comment", $comment->id)->loaded());
   }
 }
diff --git a/modules/g2_import/controllers/g2.php b/modules/g2_import/controllers/g2.php
index 3e002758..5fd4400c 100644
--- a/modules/g2_import/controllers/g2.php
+++ b/modules/g2_import/controllers/g2.php
@@ -50,7 +50,7 @@ class G2_Controller extends Admin_Controller {
       throw new Kohana_404_Exception();
     }
 
-    $item = ORM::factory("item")->where("id", "=", $g2_map->g3_id)->find();
+    $item = ORM::factory("item", $g2_map->g3_id);
     if (!$item->loaded() || !access::can("view", $item)) {
       throw new Kohana_404_Exception();
     }
diff --git a/modules/g2_import/helpers/g2_import.php b/modules/g2_import/helpers/g2_import.php
index 74164305..fa95e547 100644
--- a/modules/g2_import/helpers/g2_import.php
+++ b/modules/g2_import/helpers/g2_import.php
@@ -358,8 +358,7 @@ class g2_import_Core {
     if ($g2_album->getParentId() == null) {
       return t("Skipping Gallery 2 root album");
     }
-    $parent_album =
-      ORM::factory("item")->where("id", "=", self::map($g2_album->getParentId()))->find();
+    $parent_album = ORM::factory("item", self::map($g2_album->getParentId()));
 
     $album = ORM::factory("item");
     $album->type = "album";
@@ -423,8 +422,8 @@ class g2_import_Core {
       }
       $item_id = self::map($g2_source->getId());
       if ($item_id) {
-        $item = ORM::factory("item")->where("id", "=", $item_id)->find();
-        $g2_album = ORM::factory("item")->where("id", "=", $g3_album_id)->find();
+        $item = ORM::factory("item", $item_id);
+        $g2_album = ORM::factory("item", $g3_album_id);
         $g2_album->album_cover_item_id = $item->id;
         $g2_album->thumb_dirty = 1;
         $g2_album->view_count = g2(GalleryCoreApi::fetchItemViewCount($g2_album_id));
@@ -452,7 +451,7 @@ class g2_import_Core {
                array("id" => $g2_item_id, "exception" => (string)$e));
     }
 
-    $parent = ORM::factory("item")->where("id", "=", self::map($g2_item->getParentId()))->find();
+    $parent = ORM::factory("item", self::map($g2_item->getParentId()));
 
     $g2_type = $g2_item->getEntityType();
     $corrupt = 0;
@@ -633,7 +632,7 @@ class g2_import_Core {
 
     GalleryCoreApi::requireOnce("modules/tags/classes/TagsHelper.class");
     $g2_item_id = array_shift($queue);
-    $g3_item = ORM::factory("item")->where("id", "=", self::map($g2_item_id))->find();
+    $g3_item = ORM::factory("item", self::map($g2_item_id));
     if (!$g3_item->loaded()) {
       return;
     }
diff --git a/modules/gallery/helpers/gallery_installer.php b/modules/gallery/helpers/gallery_installer.php
index aa297236..bfab4645 100644
--- a/modules/gallery/helpers/gallery_installer.php
+++ b/modules/gallery/helpers/gallery_installer.php
@@ -228,7 +228,7 @@ class gallery_installer {
             "updated" => $now,
             "weight" => 1))
       ->execute();
-    $root = ORM::factory("item")->where("id", "=", 1)->find();
+    $root = ORM::factory("item", 1);
     access::add_item($root);
 
     module::set_var("gallery", "active_site_theme", "wind");
diff --git a/modules/gallery/helpers/item_rest.php b/modules/gallery/helpers/item_rest.php
index 2236fbbb..d5ca1456 100644
--- a/modules/gallery/helpers/item_rest.php
+++ b/modules/gallery/helpers/item_rest.php
@@ -145,7 +145,7 @@ class item_rest_Core {
   }
 
   static function resolve($id) {
-    $item = ORM::factory("item")->where("id", "=", $id)->find();
+    $item = ORM::factory("item", $id);
     if (!access::can("view", $item)) {
       throw new Kohana_404_Exception();
     }
diff --git a/modules/gallery/libraries/ORM_MPTT.php b/modules/gallery/libraries/ORM_MPTT.php
index a7bb24ea..83f9b51e 100644
--- a/modules/gallery/libraries/ORM_MPTT.php
+++ b/modules/gallery/libraries/ORM_MPTT.php
@@ -48,7 +48,7 @@ class ORM_MPTT_Core extends ORM {
   function save() {
     if (!$this->loaded()) {
       $this->lock();
-      $parent = ORM::factory("item")->where("id", "=", $this->parent_id)->find();
+      $parent = ORM::factory("item", $this->parent_id);
 
       try {
         // Make a hole in the parent for this new item
diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php
index 9706d61f..ae1b6608 100644
--- a/modules/gallery/models/item.php
+++ b/modules/gallery/models/item.php
@@ -423,7 +423,7 @@ class Item_Model extends ORM_MPTT {
 
         // If any significant fields have changed, load up a copy of the original item and
         // keep it around.
-        $original = ORM::factory("item")->where("id", "=", $this->id)->find();
+        $original = ORM::factory("item", $this->id);
         if (array_intersect($this->changed, array("parent_id", "name", "slug"))) {
           $original->_build_relative_caches();
           $this->relative_path_cache = null;
@@ -787,7 +787,7 @@ class Item_Model extends ORM_MPTT {
     if ($this->is_movie() || $this->is_photo()) {
       if ($this->loaded()) {
         // Existing items can't change their extension
-        $original = ORM::factory("item")->where("id", "=", $this->id)->find();
+        $original = ORM::factory("item", $this->id);
         $new_ext = pathinfo($this->name, PATHINFO_EXTENSION);
         $old_ext = pathinfo($original->name, PATHINFO_EXTENSION);
         if (strcasecmp($new_ext, $old_ext)) {
diff --git a/modules/server_add/controllers/server_add.php b/modules/server_add/controllers/server_add.php
index 4d6d5dfe..287855b6 100644
--- a/modules/server_add/controllers/server_add.php
+++ b/modules/server_add/controllers/server_add.php
@@ -24,7 +24,7 @@ class Server_Add_Controller extends Admin_Controller {
       $files[] = $path;
     }
 
-    $item = ORM::factory("item")->where("id", "=", $id)->find();
+    $item = ORM::factory("item", $id);
     $view = new View("server_add_tree_dialog.html");
     $view->item = $item;
     $view->tree = new View("server_add_tree.html");
@@ -78,7 +78,7 @@ class Server_Add_Controller extends Admin_Controller {
    */
   public function start() {
     access::verify_csrf();
-    $item = ORM::factory("item")->where("id", "=", Input::instance()->get("item_id"))->find();
+    $item = ORM::factory("item", Input::instance()->get("item_id"));
 
     foreach (Input::instance()->post("paths") as $path) {
       if (server_add::is_valid_path($path)) {
@@ -104,7 +104,7 @@ class Server_Add_Controller extends Admin_Controller {
   function run($task_id) {
     access::verify_csrf();
 
-    $task = ORM::factory("task")->where("id", "=", $task_id)->find();
+    $task = ORM::factory("task", $task_id);
     if (!$task->loaded() || $task->owner_id != identity::active_user()->id) {
       access::forbidden();
     }
@@ -216,12 +216,11 @@ class Server_Add_Controller extends Admin_Controller {
 
         // Look up the parent item for this entry.  By now it should exist, but if none was
         // specified, then this belongs as a child of the current item.
-        $parent_entry =
-          ORM::factory("server_add_file")->where("id", "=", $entry->parent_id)->find();
+        $parent_entry = ORM::factory("server_add_file", $entry->parent_id);
         if (!$parent_entry->loaded()) {
-          $parent = ORM::factory("item")->where("id", "=", $task->get("item_id"))->find();
+          $parent = ORM::factory("item", $task->get("item_id"));
         } else {
-          $parent = ORM::factory("item")->where("id", "=", $parent_entry->item_id)->find();
+          $parent = ORM::factory("item", $parent_entry->item_id);
         }
 
         $name = basename($entry->file);
diff --git a/modules/tag/helpers/item_tags_rest.php b/modules/tag/helpers/item_tags_rest.php
index ce814f77..43e2cef0 100644
--- a/modules/tag/helpers/item_tags_rest.php
+++ b/modules/tag/helpers/item_tags_rest.php
@@ -50,7 +50,7 @@ class item_tags_rest_Core {
   }
 
   static function resolve($id) {
-    $item = ORM::factory("item")->where("id", "=", $id)->find();
+    $item = ORM::factory("item", $id);
     if (!access::can("view", $item)) {
       throw new Kohana_404_Exception();
     }
diff --git a/modules/tag/helpers/tag_item_rest.php b/modules/tag/helpers/tag_item_rest.php
index cd9bb6fe..60d37437 100644
--- a/modules/tag/helpers/tag_item_rest.php
+++ b/modules/tag/helpers/tag_item_rest.php
@@ -35,8 +35,8 @@ class tag_item_rest_Core {
 
   static function resolve($tuple) {
     list ($tag_id, $item_id) = split(",", $tuple);
-    $tag = ORM::factory("tag")->where("id", "=", $tag_id)->find();
-    $item = ORM::factory("item")->where("id", "=", $item_id)->find();
+    $tag = ORM::factory("tag", $tag_id);
+    $item = ORM::factory("item", $item_id);
     if (!$tag->loaded() || !$item->loaded() || !$tag->has($item)) {
       throw new Kohana_404_Exception();
     }
diff --git a/modules/tag/helpers/tag_items_rest.php b/modules/tag/helpers/tag_items_rest.php
index 369a8d83..ef563ac6 100644
--- a/modules/tag/helpers/tag_items_rest.php
+++ b/modules/tag/helpers/tag_items_rest.php
@@ -52,7 +52,7 @@ class tag_items_rest_Core {
   }
 
   static function resolve($id) {
-    return ORM::factory("tag")->where("id", "=", $id)->find();
+    return ORM::factory("tag", $id);
   }
 
   static function url($tag) {
diff --git a/modules/tag/helpers/tag_rest.php b/modules/tag/helpers/tag_rest.php
index 7143daa9..4879cf63 100644
--- a/modules/tag/helpers/tag_rest.php
+++ b/modules/tag/helpers/tag_rest.php
@@ -77,7 +77,7 @@ class tag_rest_Core {
   }
 
   static function resolve($id) {
-    $tag = ORM::factory("tag")->where("id", "=", $id)->find();
+    $tag = ORM::factory("tag", $id);
     if (!$tag->loaded()) {
       throw new Kohana_404_Exception();
     }
diff --git a/modules/user/models/group.php b/modules/user/models/group.php
index 85114ede..851e72e6 100644
--- a/modules/user/models/group.php
+++ b/modules/user/models/group.php
@@ -55,7 +55,7 @@ class Group_Model extends ORM implements Group_Definition {
       module::event("group_created", $this);
     } else {
       // Updated group
-      $original = ORM::factory("group")->where("id", "=", $this->id)->find();
+      $original = ORM::factory("group", $this->id);
       parent::save();
       module::event("group_updated", $original, $this);
     }
diff --git a/modules/user/models/user.php b/modules/user/models/user.php
index 7c97bae7..78c31047 100644
--- a/modules/user/models/user.php
+++ b/modules/user/models/user.php
@@ -99,7 +99,7 @@ class User_Model extends ORM implements User_Definition {
       module::event("user_created", $this);
     } else {
       // Updated user
-      $original = ORM::factory("user")->where("id", "=", $this->id)->find();
+      $original = ORM::factory("user", $this->id);
       parent::save();
       module::event("user_updated", $original, $this);
     }
-- 
cgit v1.2.3


From acbb5aac05d41aad89176d28f1d583c8072f2a2a Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 27 Jan 2010 22:41:09 -0800
Subject: Remove unnecessary rules() in the form.

---
 modules/gallery/helpers/album.php | 1 -
 1 file changed, 1 deletion(-)

diff --git a/modules/gallery/helpers/album.php b/modules/gallery/helpers/album.php
index 55282252..641f0708 100644
--- a/modules/gallery/helpers/album.php
+++ b/modules/gallery/helpers/album.php
@@ -53,7 +53,6 @@ class album_Core {
     $group->textarea("description")->label(t("Description"))->value($parent->description);
     if ($parent->id != 1) {
       $group->input("name")->label(t("Directory Name"))->value($parent->name)
-        ->rules("required")
         ->error_messages(
           "conflict", t("There is already a movie, photo or album with this name"))
         ->error_messages("no_slashes", t("The directory name can't contain a \"/\""))
-- 
cgit v1.2.3


From a2fc1d3422dec370dd1c177d6930bbad8c1aa1d8 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 27 Jan 2010 22:55:54 -0800
Subject: Localize error messages for the built-in rules.

---
 modules/gallery/helpers/album.php | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/modules/gallery/helpers/album.php b/modules/gallery/helpers/album.php
index 641f0708..30eeb960 100644
--- a/modules/gallery/helpers/album.php
+++ b/modules/gallery/helpers/album.php
@@ -29,14 +29,20 @@ class album_Core {
     $form = new Forge("albums/create/{$parent->id}", "", "post", array("id" => "g-add-album-form"));
     $group = $form->group("add_album")
       ->label(t("Add an album to %album_title", array("album_title" => $parent->title)));
-    $group->input("title")->label(t("Title"));
+    $group->input("title")->label(t("Title"))
+      ->error_messages("required", t("You must provide a title"))
+      ->error_messages("length", t("Your title is too long"));
     $group->textarea("description")->label(t("Description"));
     $group->input("name")->label(t("Directory name"))
-      ->error_messages("no_slashes", t("The directory name can't contain the \"/\" character"));
+      ->error_messages("no_slashes", t("The directory name can't contain the \"/\" character"))
+      ->error_messages("required", t("You must provide a directory name"))
+      ->error_messages("length", t("Your directory name is too long"));
     $group->input("slug")->label(t("Internet Address"))
       ->error_messages(
         "not_url_safe",
-        t("The internet address should contain only letters, numbers, hyphens and underscores"));
+        t("The internet address should contain only letters, numbers, hyphens and underscores"))
+      ->error_messages("required", t("You must provide an Internet Address"))
+      ->error_messages("length", t("Your Internet Address is too long"));
     $group->hidden("type")->value("album");
     $group->submit("")->value(t("Create"));
     $form->script("")
@@ -49,20 +55,26 @@ class album_Core {
     $form->hidden("from_id");
     $group = $form->group("edit_item")->label(t("Edit Album"));
 
-    $group->input("title")->label(t("Title"))->value($parent->title);
+    $group->input("title")->label(t("Title"))->value($parent->title)
+        ->error_messages("required", t("You must provide a title"))
+      ->error_messages("length", t("Your title is too long"));
     $group->textarea("description")->label(t("Description"))->value($parent->description);
     if ($parent->id != 1) {
       $group->input("name")->label(t("Directory Name"))->value($parent->name)
         ->error_messages(
           "conflict", t("There is already a movie, photo or album with this name"))
         ->error_messages("no_slashes", t("The directory name can't contain a \"/\""))
-        ->error_messages("no_trailing_period", t("The directory name can't end in \".\""));
+        ->error_messages("no_trailing_period", t("The directory name can't end in \".\""))
+        ->error_messages("required", t("You must provide a directory name"))
+        ->error_messages("length", t("Your directory name is too long"));
       $group->input("slug")->label(t("Internet Address"))->value($parent->slug)
         ->error_messages(
           "conflict", t("There is already a movie, photo or album with this internet address"))
         ->error_messages(
           "not_url_safe",
-          t("The internet address should contain only letters, numbers, hyphens and underscores"));
+          t("The internet address should contain only letters, numbers, hyphens and underscores"))
+        ->error_messages("required", t("You must provide an Internet Address"))
+        ->error_messages("length", t("Your Internet Address is too long"));
     } else {
       $group->hidden("name")->value($parent->name);
       $group->hidden("slug")->value($parent->slug);
-- 
cgit v1.2.3


From e5b25983a67a53ad209aa4b8c251afa3276853fa Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 27 Jan 2010 23:00:29 -0800
Subject: Localize all error messages.

---
 modules/gallery/helpers/photo.php | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/modules/gallery/helpers/photo.php b/modules/gallery/helpers/photo.php
index 9bd277bc..bbdf2e3b 100644
--- a/modules/gallery/helpers/photo.php
+++ b/modules/gallery/helpers/photo.php
@@ -28,19 +28,25 @@ class photo_Core {
     $form = new Forge("photos/update/$photo->id", "", "post", array("id" => "g-edit-photo-form"));
     $form->hidden("from_id");
     $group = $form->group("edit_item")->label(t("Edit Photo"));
-    $group->input("title")->label(t("Title"))->value($photo->title);
+    $group->input("title")->label(t("Title"))->value($photo->title)
+      ->error_messages("required", t("You must provide a title"))
+      ->error_messages("length", t("Your title is too long"));
     $group->textarea("description")->label(t("Description"))->value($photo->description);
     $group->input("name")->label(t("Filename"))->value($photo->name)
       ->error_messages("conflict", t("There is already a movie, photo or album with this name"))
       ->error_messages("no_slashes", t("The photo name can't contain a \"/\""))
       ->error_messages("no_trailing_period", t("The photo name can't end in \".\""))
-      ->error_messages("illegal_extension", t("You cannot change the filename extension"));
+      ->error_messages("illegal_data_file_extension", t("You cannot change the photo file extension"))
+      ->error_messages("required", t("You must provide a photo file name"))
+      ->error_messages("length", t("Your photo file name is too long"));
     $group->input("slug")->label(t("Internet Address"))->value($photo->slug)
       ->error_messages(
         "conflict", t("There is already a movie, photo or album with this internet address"))
       ->error_messages(
         "not_url_safe",
-        t("The internet address should contain only letters, numbers, hyphens and underscores"));
+        t("The internet address should contain only letters, numbers, hyphens and underscores"))
+      ->error_messages("required", t("You must provide an internet address"))
+      ->error_messages("length", t("Your internet address is too long"));
 
     module::event("item_edit_form", $photo, $form);
 
-- 
cgit v1.2.3


From 0e5b5e25595dd3dd75222cf8ead58e32f8d5859f Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 27 Jan 2010 23:00:49 -0800
Subject: Fix capitalization of "internet address".

---
 modules/gallery/helpers/album.php | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/modules/gallery/helpers/album.php b/modules/gallery/helpers/album.php
index 30eeb960..389f6e48 100644
--- a/modules/gallery/helpers/album.php
+++ b/modules/gallery/helpers/album.php
@@ -41,8 +41,8 @@ class album_Core {
       ->error_messages(
         "not_url_safe",
         t("The internet address should contain only letters, numbers, hyphens and underscores"))
-      ->error_messages("required", t("You must provide an Internet Address"))
-      ->error_messages("length", t("Your Internet Address is too long"));
+      ->error_messages("required", t("You must provide an internet address"))
+      ->error_messages("length", t("Your internet address is too long"));
     $group->hidden("type")->value("album");
     $group->submit("")->value(t("Create"));
     $form->script("")
@@ -73,8 +73,8 @@ class album_Core {
         ->error_messages(
           "not_url_safe",
           t("The internet address should contain only letters, numbers, hyphens and underscores"))
-        ->error_messages("required", t("You must provide an Internet Address"))
-        ->error_messages("length", t("Your Internet Address is too long"));
+        ->error_messages("required", t("You must provide an internet address"))
+        ->error_messages("length", t("Your internet address is too long"));
     } else {
       $group->hidden("name")->value($parent->name);
       $group->hidden("slug")->value($parent->slug);
-- 
cgit v1.2.3


From 31e4c217194f8d938c8a6963449d42007663f473 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 27 Jan 2010 23:03:47 -0800
Subject: Localize error messages.

---
 modules/comment/helpers/comment.php | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/modules/comment/helpers/comment.php b/modules/comment/helpers/comment.php
index 389c8922..c9c20879 100644
--- a/modules/comment/helpers/comment.php
+++ b/modules/comment/helpers/comment.php
@@ -27,10 +27,20 @@ class comment_Core {
   static function get_add_form($item) {
     $form = new Forge("comments/create/{$item->id}", "", "post", array("id" => "g-comment-form"));
     $group = $form->group("add_comment")->label(t("Add comment"));
-    $group->input("name")   ->label(t("Name"))            ->id("g-author");
-    $group->input("email")  ->label(t("Email (hidden)"))  ->id("g-email");
-    $group->input("url")    ->label(t("Website (hidden)"))->id("g-url");
-    $group->textarea("text")->label(t("Comment"))         ->id("g-text");
+    $group->input("name")
+      ->label(t("Name"))
+      ->id("g-author")
+      ->error_messages("required", t("You must enter a name for yourself"));
+    $group->input("email")
+      ->label(t("Email (hidden)"))
+      ->id("g-email");
+    $group->input("url")
+      ->label(t("Website (hidden)"))
+      ->id("g-url");
+    $group->textarea("text")
+      ->label(t("Comment"))
+      ->id("g-text")
+      ->error_messages("required", t("You must enter a comment"));
     $group->hidden("item_id")->value($item->id);
     module::event("comment_add_form", $form);
     $group->submit("")->value(t("Add"))->class("ui-state-default ui-corner-all");
-- 
cgit v1.2.3


From bbe70119ef99e77a57dbc5354bc348c7adaece46 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Wed, 27 Jan 2010 23:05:57 -0800
Subject: Localize validation messages.

---
 modules/comment/helpers/comment.php |  3 ---
 modules/gallery/helpers/movie.php   | 12 +++++++++---
 2 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/modules/comment/helpers/comment.php b/modules/comment/helpers/comment.php
index c9c20879..f710ad92 100644
--- a/modules/comment/helpers/comment.php
+++ b/modules/comment/helpers/comment.php
@@ -50,10 +50,7 @@ class comment_Core {
       $group->inputs["name"]->value($active->full_name)->disabled("disabled");
       $group->email->value($active->email)->disabled("disabled");
       $group->url->value($active->url)->disabled("disabled");
-    } else {
-      $group->inputs["name"]->error_messages("missing", t("You must provide a name"));
     }
-    $group->text->error_messages("missing", t("You must provide a comment"));
 
     return $form;
   }
diff --git a/modules/gallery/helpers/movie.php b/modules/gallery/helpers/movie.php
index b07a9e69..7033b7da 100644
--- a/modules/gallery/helpers/movie.php
+++ b/modules/gallery/helpers/movie.php
@@ -28,20 +28,26 @@ class movie_Core {
     $form = new Forge("movies/update/$movie->id", "", "post", array("id" => "g-edit-movie-form"));
     $form->hidden("from_id");
     $group = $form->group("edit_item")->label(t("Edit Movie"));
-    $group->input("title")->label(t("Title"))->value($movie->title);
+    $group->input("title")->label(t("Title"))->value($movie->title)
+      ->error_messages("required", t("You must provide a title"))
+      ->error_messages("length", t("Your title is too long"));
     $group->textarea("description")->label(t("Description"))->value($movie->description);
     $group->input("name")->label(t("Filename"))->value($movie->name)
       ->error_messages(
         "conflict", t("There is already a movie, photo or album with this name"))
       ->error_messages("no_slashes", t("The movie name can't contain a \"/\""))
       ->error_messages("no_trailing_period", t("The movie name can't end in \".\""))
-      ->error_messages("illegal_extension", t("You cannot change the filename extension"));
+      ->error_messages("illegal_data_file_extension", t("You cannot change the movie file extension"))
+      ->error_messages("required", t("You must provide a movie file name"))
+      ->error_messages("length", t("Your movie file name is too long"));
     $group->input("slug")->label(t("Internet Address"))->value($movie->slug)
       ->error_messages(
         "conflict", t("There is already a movie, photo or album with this internet address"))
       ->error_messages(
         "not_url_safe",
-        t("The internet address should contain only letters, numbers, hyphens and underscores"));
+        t("The internet address should contain only letters, numbers, hyphens and underscores"))
+      ->error_messages("required", t("You must provide an internet address"))
+      ->error_messages("length", t("Your internet address is too long"));
 
     module::event("item_edit_form", $movie, $form);
 
-- 
cgit v1.2.3


From cedbc82dccaf74a983f1f92846735b69391fdf10 Mon Sep 17 00:00:00 2001
From: Tim Almdal <tnalmdal@shaw.ca>
Date: Thu, 28 Jan 2010 07:44:58 -0800
Subject: Do all the html::clean|purify calls in the views and not the
 controller. Also clean the subject line and email message body of the contact
 user email.

---
 modules/gallery/controllers/user_profile.php     | 4 ++--
 modules/gallery/helpers/gallery_event.php        | 2 +-
 modules/gallery/views/user_profile.html.php      | 2 +-
 modules/gallery/views/user_profile_info.html.php | 2 +-
 modules/rest/views/user_profile_rest.html.php    | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/modules/gallery/controllers/user_profile.php b/modules/gallery/controllers/user_profile.php
index a0e6619e..327d2ff1 100644
--- a/modules/gallery/controllers/user_profile.php
+++ b/modules/gallery/controllers/user_profile.php
@@ -53,11 +53,11 @@ class User_Profile_Controller extends Controller {
     if ($form->validate()) {
       Sendmail::factory()
         ->to($user->email)
-        ->subject($form->message->subject->value)
+        ->subject(html::clean($form->message->subject->value))
         ->header("Mime-Version", "1.0")
         ->header("Content-type", "text/html; charset=iso-8859-1")
         ->reply_to($form->message->reply_to->value)
-        ->message($form->message->message->value)
+        ->message(html::purify($form->message->message->value))
         ->send();
       message::success(t("Sent message to %user_name", array("user_name" => $user->display_name())));
       print json_encode(array("result" => "success"));
diff --git a/modules/gallery/helpers/gallery_event.php b/modules/gallery/helpers/gallery_event.php
index 70c6de4a..9b252f61 100644
--- a/modules/gallery/helpers/gallery_event.php
+++ b/modules/gallery/helpers/gallery_event.php
@@ -411,7 +411,7 @@ class gallery_event_Core {
         if ($field == "locale") {
           $value = locales::display_name($value);
         }
-        $v->fields[(string) $label] = html::clean($value);
+        $v->fields[(string) $label] = $value;
       }
     }
     $data->content[] = (object) array("title" => t("User information"), "view" => $v);
diff --git a/modules/gallery/views/user_profile.html.php b/modules/gallery/views/user_profile.html.php
index 708b1613..7dc9d13e 100644
--- a/modules/gallery/views/user_profile.html.php
+++ b/modules/gallery/views/user_profile.html.php
@@ -41,7 +41,7 @@
   <? foreach ($info_parts as $info): ?>
   <div>
     <fieldset>
-    <label><?= $info->title ?></label>
+    <label><?= html::purify($info->title) ?></label>
     <div>
     <?= $info->view ?>
     </div>
diff --git a/modules/gallery/views/user_profile_info.html.php b/modules/gallery/views/user_profile_info.html.php
index 2a2549c8..2f2d68d3 100644
--- a/modules/gallery/views/user_profile_info.html.php
+++ b/modules/gallery/views/user_profile_info.html.php
@@ -3,7 +3,7 @@
   <? foreach ($fields as $field => $value): ?>
   <tr>
     <td><?= $field ?></td>
-    <td><?= $value ?></td>
+    <td><?= html::purify($value) ?></td>
   </tr>
   <? endforeach ?>
 </table>
diff --git a/modules/rest/views/user_profile_rest.html.php b/modules/rest/views/user_profile_rest.html.php
index 3807817e..397afa89 100644
--- a/modules/rest/views/user_profile_rest.html.php
+++ b/modules/rest/views/user_profile_rest.html.php
@@ -2,7 +2,7 @@
 <div id="g-rest-detail">
 <ul>
   <li id="g-rest-key">
-  <p><b><?= t("Key") ?></b>:<?= $rest_key ?></p>
+  <p><b><?= t("Key") ?></b>:<?= html::clean($rest_key) ?></p>
   </li>
 </ul>
 </div>
-- 
cgit v1.2.3


From f943a2deefa822544ef737e579649c6437dc3450 Mon Sep 17 00:00:00 2001
From: Tim Almdal <tnalmdal@shaw.ca>
Date: Thu, 28 Jan 2010 08:14:33 -0800
Subject: Don't show a link to the user profile for the guest user

---
 modules/comment/views/admin_block_recent_comments.html.php | 6 ++++++
 modules/comment/views/comment.html.php                     | 6 ++++++
 modules/comment/views/comments.html.php                    | 6 ++++++
 modules/gallery/views/admin_block_log_entries.html.php     | 4 ++++
 4 files changed, 22 insertions(+)

diff --git a/modules/comment/views/admin_block_recent_comments.html.php b/modules/comment/views/admin_block_recent_comments.html.php
index 99f72a30..4017e4f9 100644
--- a/modules/comment/views/admin_block_recent_comments.html.php
+++ b/modules/comment/views/admin_block_recent_comments.html.php
@@ -8,10 +8,16 @@
          width="32"
          height="32" />
     <?= gallery::date_time($comment->created) ?>
+    <? if ($comment->author()->guest): ?>
+    <?= t('%author_name said <em>%comment_text</em>',
+          array("author_name" => html::clean($comment->author_name()),
+                "comment_text" => text::limit_words(nl2br(html::purify($comment->text)), 50))); ?>
+    <? else: ?>
     <?= t('<a href="%url">%author_name</a> said <em>%comment_text</em>',
           array("author_name" => html::clean($comment->author_name()),
                 "url" => user_profile::url($comment->author_id),
                 "comment_text" => text::limit_words(nl2br(html::purify($comment->text)), 50))); ?>
+    <? endif ?>
   </li>
   <? endforeach ?>
 </ul>
diff --git a/modules/comment/views/comment.html.php b/modules/comment/views/comment.html.php
index c4cf1ce0..263e5f97 100644
--- a/modules/comment/views/comment.html.php
+++ b/modules/comment/views/comment.html.php
@@ -8,10 +8,16 @@
            width="40"
            height="40" />
     </a>
+    <? if ($comment->author()->guest): ?>
+    <?= t("on %date_time, %name said",
+          array("date_time" => gallery::date_time($comment->created),
+                "name" => html::clean($comment->author_name()))) ?>
+    <? else: ?>
     <?= t("on %date_time,  <a href=\"%url\">%name</a> said",
           array("date_time" => gallery::date_time($comment->created),
                 "url" => user_profile::url($comment->author_id),
                 "name" => html::clean($comment->author_name()))) ?>
+    <? endif ?>
   </p>
   <div>
   <?= nl2br(html::purify($comment->text)) ?>
diff --git a/modules/comment/views/comments.html.php b/modules/comment/views/comments.html.php
index c8236997..0ed07c22 100644
--- a/modules/comment/views/comments.html.php
+++ b/modules/comment/views/comments.html.php
@@ -22,10 +22,16 @@
              width="40"
              height="40" />
       </a>
+      <? if ($comment->author()->guest): ?>
+      <?= t('on %date %name said',
+            array("date" => date("Y-M-d H:i:s", $comment->created),
+                  "name" => html::clean($comment->author_name()))); ?>
+      <? else: ?>
       <?= t('on %date <a href="%url">%name</a> said',
             array("date" => date("Y-M-d H:i:s", $comment->created),
                   "url" => user_profile::url($comment->author_id),
                   "name" => html::clean($comment->author_name()))); ?>
+      <? endif ?>
     </p>
     <div>
       <?= nl2br(html::purify($comment->text)) ?>
diff --git a/modules/gallery/views/admin_block_log_entries.html.php b/modules/gallery/views/admin_block_log_entries.html.php
index 453724cb..5a8ed23c 100644
--- a/modules/gallery/views/admin_block_log_entries.html.php
+++ b/modules/gallery/views/admin_block_log_entries.html.php
@@ -2,7 +2,11 @@
 <ul>
   <? foreach ($entries as $entry): ?>
   <li class="<?= log::severity_class($entry->severity) ?>" style="direction: ltr">
+    <? if ($entry->user->guest): ?>
+    </span><?= html::clean($entry->user->name) ?></span>
+    <? else: ?>
     <a href="<?= user_profile::url($entry->user->id) ?>"><?= html::clean($entry->user->name) ?></a>
+    <? endif ?>
     <?= gallery::date_time($entry->timestamp) ?>
     <?= $entry->message ?>
     <?= $entry->html ?>
-- 
cgit v1.2.3


From 75aec29350442351299c5ecadfa07042b857c558 Mon Sep 17 00:00:00 2001
From: Tim Almdal <tnalmdal@shaw.ca>
Date: Thu, 28 Jan 2010 08:42:14 -0800
Subject: Update the xss golden file for user profile changes.

---
 modules/gallery/tests/xss_data.txt | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/modules/gallery/tests/xss_data.txt b/modules/gallery/tests/xss_data.txt
index a89725c0..04add4c7 100644
--- a/modules/gallery/tests/xss_data.txt
+++ b/modules/gallery/tests/xss_data.txt
@@ -34,6 +34,9 @@ modules/comment/views/comment.mrss.php                       35  DIRTY_ATTR $chi
 modules/comment/views/comment.mrss.php                       35  DIRTY_ATTR $child->thumb_width
 modules/comment/views/comments.html.php                      16  DIRTY_ATTR $comment->id
 modules/comment/views/comments.html.php                      19  DIRTY_ATTR $comment->author()->avatar_url(40,$theme->url(,true))
+modules/comment/views/user_profile_comments.html.php         5   DIRTY_ATTR $comment->id
+modules/comment/views/user_profile_comments.html.php         10  DIRTY_JS $comment->item()->url()
+modules/comment/views/user_profile_comments.html.php         11  DIRTY    $comment->item()->thumb_img(array(),50)
 modules/digibug/views/digibug_form.html.php                  4   DIRTY    form::open("http://www.digibug.com/dapi/order.php")
 modules/digibug/views/digibug_form.html.php                  5   DIRTY    form::hidden($order_parms)
 modules/digibug/views/digibug_form.html.php                  6   DIRTY    form::close()
@@ -43,10 +46,10 @@ modules/g2_import/views/admin_g2_import.html.php             30  DIRTY    $form
 modules/gallery/views/admin_advanced_settings.html.php       21  DIRTY_ATTR text::alternate("g-odd","g-even")
 modules/gallery/views/admin_advanced_settings.html.php       22  DIRTY    $var->module_name
 modules/gallery/views/admin_block_log_entries.html.php       4   DIRTY_ATTR log::severity_class($entry->severity)
-modules/gallery/views/admin_block_log_entries.html.php       5   DIRTY_JS user_profile::url($entryr->id)
-modules/gallery/views/admin_block_log_entries.html.php       6   DIRTY    gallery::date_time($entry->timestamp)
-modules/gallery/views/admin_block_log_entries.html.php       7   DIRTY    $entry->message
-modules/gallery/views/admin_block_log_entries.html.php       8   DIRTY    $entry->html
+modules/gallery/views/admin_block_log_entries.html.php       8   DIRTY_JS user_profile::url($entry->user->id)
+modules/gallery/views/admin_block_log_entries.html.php       10  DIRTY    gallery::date_time($entry->timestamp)
+modules/gallery/views/admin_block_log_entries.html.php       11  DIRTY    $entry->message
+modules/gallery/views/admin_block_log_entries.html.php       12  DIRTY    $entry->html
 modules/gallery/views/admin_block_news.html.php              5   DIRTY_JS $entry["link"]
 modules/gallery/views/admin_block_news.html.php              5   DIRTY    $entry["title"]
 modules/gallery/views/admin_block_news.html.php              7   DIRTY    text::limit_words(strip_tags($entry["description"]),25);
@@ -219,10 +222,9 @@ modules/gallery/views/upgrader.html.php                      77  DIRTY    $modul
 modules/gallery/views/upgrader.html.php                      99  DIRTY_ATTR $done?"muted":""
 modules/gallery/views/upgrader.html.php                      102 DIRTY_ATTR $done?"muted":""
 modules/gallery/views/user_languages_block.html.php          2   DIRTY    form::dropdown("g-select-session-locale",$installed_locales,$selected)
-modules/gallery/views/user_profile.html.php                  35  DIRTY_ATTR $height
-modules/gallery/views/user_profile.html.php                  44  DIRTY    $field
-modules/gallery/views/user_profile.html.php                  45  DIRTY    $value
-modules/gallery/views/user_profile.html.php                  65  DIRTY_JS $return->for_html_attr()
+modules/gallery/views/user_profile.html.php                  35  DIRTY_ATTR $user->avatar_url(40,$theme->url(,true))
+modules/gallery/views/user_profile.html.php                  46  DIRTY    $info->view
+modules/gallery/views/user_profile_info.html.php             5   DIRTY    $field
 modules/image_block/views/image_block_block.html.php         3   DIRTY_JS $item->url()
 modules/image_block/views/image_block_block.html.php         4   DIRTY    $item->thumb_img(array("class"=>"g-thumbnail"))
 modules/info/views/info_block.html.php                       22  DIRTY    date("M j, Y H:i:s",$item->captured)
@@ -235,6 +237,8 @@ modules/notification/views/item_deleted.html.php             18  DIRTY_JS $item-
 modules/notification/views/item_deleted.html.php             19  DIRTY    $item->parent()->abs_url()
 modules/notification/views/item_updated.html.php             20  DIRTY_JS $item->abs_url()
 modules/notification/views/item_updated.html.php             20  DIRTY    $item->abs_url()
+modules/notification/views/user_profile_notification.html.php 5   DIRTY_ATTR $subscription->id
+modules/notification/views/user_profile_notification.html.php 6   DIRTY_JS $subscription->url
 modules/organize/views/organize_dialog.html.php              3   DIRTY_JS url::site("organize/move_to/__ALBUM_ID__?csrf=$csrf")
 modules/organize/views/organize_dialog.html.php              4   DIRTY_JS url::site("organize/rearrange/__TARGET_ID__/__BEFORE__?csrf=$csrf")
 modules/organize/views/organize_dialog.html.php              5   DIRTY_JS url::site("organize/sort_order/__ALBUM_ID__/__COL__/__DIR__?csrf=$csrf")
-- 
cgit v1.2.3


From c51fe9682075c961972c344f4888a4adceabe3eb Mon Sep 17 00:00:00 2001
From: Tim Almdal <tnalmdal@shaw.ca>
Date: Thu, 28 Jan 2010 09:27:27 -0800
Subject: Make the varible for the profile name more descriptive and clean the
 label

---
 modules/gallery/helpers/gallery_event.php        | 4 ++--
 modules/gallery/tests/xss_data.txt               | 1 -
 modules/gallery/views/user_profile_info.html.php | 4 ++--
 3 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/modules/gallery/helpers/gallery_event.php b/modules/gallery/helpers/gallery_event.php
index 9b252f61..b3d4daab 100644
--- a/modules/gallery/helpers/gallery_event.php
+++ b/modules/gallery/helpers/gallery_event.php
@@ -404,14 +404,14 @@ class gallery_event_Core {
     if (!$data->display_all) {
       $fields = array("name" => t("Name"), "full_name" => t("Full name"), "url" => "Web site");
     }
-    $v->fields = array();
+    $v->user_profile_data = array();
     foreach ($fields as $field => $label) {
       if (!empty($data->user->$field)) {
         $value = $data->user->$field;
         if ($field == "locale") {
           $value = locales::display_name($value);
         }
-        $v->fields[(string) $label] = $value;
+        $v->user_profile_data[(string) $label] = $value;
       }
     }
     $data->content[] = (object) array("title" => t("User information"), "view" => $v);
diff --git a/modules/gallery/tests/xss_data.txt b/modules/gallery/tests/xss_data.txt
index 04add4c7..663080a0 100644
--- a/modules/gallery/tests/xss_data.txt
+++ b/modules/gallery/tests/xss_data.txt
@@ -224,7 +224,6 @@ modules/gallery/views/upgrader.html.php                      102 DIRTY_ATTR $don
 modules/gallery/views/user_languages_block.html.php          2   DIRTY    form::dropdown("g-select-session-locale",$installed_locales,$selected)
 modules/gallery/views/user_profile.html.php                  35  DIRTY_ATTR $user->avatar_url(40,$theme->url(,true))
 modules/gallery/views/user_profile.html.php                  46  DIRTY    $info->view
-modules/gallery/views/user_profile_info.html.php             5   DIRTY    $field
 modules/image_block/views/image_block_block.html.php         3   DIRTY_JS $item->url()
 modules/image_block/views/image_block_block.html.php         4   DIRTY    $item->thumb_img(array("class"=>"g-thumbnail"))
 modules/info/views/info_block.html.php                       22  DIRTY    date("M j, Y H:i:s",$item->captured)
diff --git a/modules/gallery/views/user_profile_info.html.php b/modules/gallery/views/user_profile_info.html.php
index 2f2d68d3..58e134bb 100644
--- a/modules/gallery/views/user_profile_info.html.php
+++ b/modules/gallery/views/user_profile_info.html.php
@@ -1,8 +1,8 @@
 <?php defined("SYSPATH") or die("No direct script access.") ?>
 <table>
-  <? foreach ($fields as $field => $value): ?>
+  <? foreach ($user_profile_data as $label => $value): ?>
   <tr>
-    <td><?= $field ?></td>
+    <td><?= html::clean($label) ?></td>
     <td><?= html::purify($value) ?></td>
   </tr>
   <? endforeach ?>
-- 
cgit v1.2.3


From 44b372077c64b0f051051c6dd16a88f1507c507f Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Thu, 28 Jan 2010 09:35:38 -0800
Subject: Secure the t("Continue") strings in javascript.

---
 modules/gallery/views/admin_modules.html.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/gallery/views/admin_modules.html.php b/modules/gallery/views/admin_modules.html.php
index 26b2c87c..c5015e68 100644
--- a/modules/gallery/views/admin_modules.html.php
+++ b/modules/gallery/views/admin_modules.html.php
@@ -22,7 +22,7 @@
             buttons: {
               <?= t("Continue")->for_js() ?>: function() {
                 $("form", this).submit();
-                $(".ui-dialog-buttonpane button:contains(<?= t("Continue") ?>)")
+                $(".ui-dialog-buttonpane button:contains(" + <?= t("Continue")->for_js() ?> + ")")
                   .attr("disabled", "disabled")
                   .addClass("ui-state-disabled");
               },
@@ -32,7 +32,7 @@
             }
           });
           if (!data.allow_continue) {
-            $(".ui-dialog-buttonpane button:contains(<?= t("Continue") ?>)")
+            $(".ui-dialog-buttonpane button:contains(" + <?= t("Continue")->for_js() ?> + ")")
               .attr("disabled", "disabled")
               .addClass("ui-state-disabled");
           }
-- 
cgit v1.2.3


From c011b0e1f63215a4389658ca0a6edcef47a0ea8c Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Thu, 28 Jan 2010 09:37:33 -0800
Subject: Secure the t("Completed") call.

---
 modules/gallery/views/form_uploadify.html.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/gallery/views/form_uploadify.html.php b/modules/gallery/views/form_uploadify.html.php
index b3b81ecb..137cb353 100644
--- a/modules/gallery/views/form_uploadify.html.php
+++ b/modules/gallery/views/form_uploadify.html.php
@@ -58,7 +58,7 @@
             "<li class=\"g-error\">" + fileObj.name + " - " + msg[1] + "</li>");
         } else {
           $("#g-add-photos-status ul").append(
-            "<li class=\"g-success\">" + fileObj.name + " - <?= t("Completed") ?></li>");
+            "<li class=\"g-success\">" + fileObj.name + " - " + <?= t("Completed")->for_js() ?> + "</li>");
         }
         return true;
       },
-- 
cgit v1.2.3


From 86721d3884568c534f412915175088be667ca65b Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Thu, 28 Jan 2010 09:40:04 -0800
Subject: Reviewed all DIRTY_JS entries

---
 modules/gallery/tests/xss_data.txt | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/modules/gallery/tests/xss_data.txt b/modules/gallery/tests/xss_data.txt
index 663080a0..d139d297 100644
--- a/modules/gallery/tests/xss_data.txt
+++ b/modules/gallery/tests/xss_data.txt
@@ -97,8 +97,6 @@ modules/gallery/views/admin_maintenance.html.php             158 DIRTY    $task-
 modules/gallery/views/admin_maintenance_show_log.html.php    8   DIRTY_JS url::site("admin/maintenance/save_log/$task->id?csrf=$csrf")
 modules/gallery/views/admin_maintenance_show_log.html.php    13  DIRTY    $task->name
 modules/gallery/views/admin_maintenance_task.html.php        55  DIRTY    $task->name
-modules/gallery/views/admin_modules.html.php                 25  DIRTY_JS t("Continue")
-modules/gallery/views/admin_modules.html.php                 35  DIRTY_JS t("Continue")
 modules/gallery/views/admin_modules.html.php                 51  DIRTY    access::csrf_form_field()
 modules/gallery/views/admin_modules.html.php                 60  DIRTY_ATTR text::alternate("g-odd","g-even")
 modules/gallery/views/admin_modules.html.php                 63  DIRTY    form::checkbox($data,'1',module::is_active($module_name))
@@ -127,7 +125,6 @@ modules/gallery/views/form_uploadify.html.php                30  DIRTY_JS url::f
 modules/gallery/views/form_uploadify.html.php                31  DIRTY_JS url::site("simple_uploader/add_photo/{$album->id}")
 modules/gallery/views/form_uploadify.html.php                35  DIRTY_JS url::file("lib/uploadify/cancel.png")
 modules/gallery/views/form_uploadify.html.php                36  DIRTY_JS $simultaneous_upload_limit
-modules/gallery/views/form_uploadify.html.php                61  DIRTY_JS t("Completed")
 modules/gallery/views/in_place_edit.html.php                 2   DIRTY    form::open($action,array("method"=>"post","id"=>"g-in-place-edit-form","class"=>"g-short-form"),$hidden)
 modules/gallery/views/in_place_edit.html.php                 5   DIRTY    form::input("input",$form["input"]," class=\"textbox\"")
 modules/gallery/views/in_place_edit.html.php                 12  DIRTY    form::close()
-- 
cgit v1.2.3


From fcc72bbbd032e21d2fe0ec727f09692886c8e09e Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Thu, 28 Jan 2010 09:41:18 -0800
Subject: Rename $class to $css_class for clarity.

---
 modules/gallery/views/admin_modules_confirm.html.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/gallery/views/admin_modules_confirm.html.php b/modules/gallery/views/admin_modules_confirm.html.php
index 59592505..8c4cb2bd 100644
--- a/modules/gallery/views/admin_modules_confirm.html.php
+++ b/modules/gallery/views/admin_modules_confirm.html.php
@@ -6,9 +6,9 @@
 
   <div id="g-admin-modules-messages" class="g-block-content">
    <ul>
-     <? foreach (array("error" => "g-error", "warn" => "g-warning") as $type => $class): ?>
+     <? foreach (array("error" => "g-error", "warn" => "g-warning") as $type => $css_class): ?>
      <? foreach ($messages[$type] as $message): ?>
-     <li class="<?= $class ?>" style="padding-bottom: 0"><?= $message ?></li>
+     <li class="<?= $css_class ?>" style="padding-bottom: 0"><?= $message ?></li>
      <? endforeach ?>
      <? endforeach ?>
    </ul>
-- 
cgit v1.2.3


From df3db40ab7a181ba0f461fe2ebf84d2ba828265c Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Thu, 28 Jan 2010 09:43:10 -0800
Subject: Reviewed DIRTY_ATTR

---
 modules/gallery/tests/xss_data.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/gallery/tests/xss_data.txt b/modules/gallery/tests/xss_data.txt
index d139d297..c2769647 100644
--- a/modules/gallery/tests/xss_data.txt
+++ b/modules/gallery/tests/xss_data.txt
@@ -101,7 +101,7 @@ modules/gallery/views/admin_modules.html.php                 51  DIRTY    access
 modules/gallery/views/admin_modules.html.php                 60  DIRTY_ATTR text::alternate("g-odd","g-even")
 modules/gallery/views/admin_modules.html.php                 63  DIRTY    form::checkbox($data,'1',module::is_active($module_name))
 modules/gallery/views/admin_modules.html.php                 65  DIRTY    $module_info->version
-modules/gallery/views/admin_modules_confirm.html.php         11  DIRTY_ATTR $class
+modules/gallery/views/admin_modules_confirm.html.php         11  DIRTY_ATTR $css_class
 modules/gallery/views/admin_modules_confirm.html.php         11  DIRTY    $message
 modules/gallery/views/admin_modules_confirm.html.php         16  DIRTY    access::csrf_form_field()
 modules/gallery/views/admin_modules_confirm.html.php         18  DIRTY    form::hidden($module,1)
-- 
cgit v1.2.3


From 11fbcfeb25a9da60737807d2e0705993d93d24da Mon Sep 17 00:00:00 2001
From: Tim Almdal <tnalmdal@shaw.ca>
Date: Thu, 28 Jan 2010 09:55:41 -0800
Subject: Found another broken link for what should have been the user profile

---
 modules/gallery/helpers/auth.php | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/modules/gallery/helpers/auth.php b/modules/gallery/helpers/auth.php
index 21a39bfb..bdff2f70 100644
--- a/modules/gallery/helpers/auth.php
+++ b/modules/gallery/helpers/auth.php
@@ -51,6 +51,8 @@ class auth_Core {
       module::event("user_logout", $user);
     }
     log::info("user", t("User %name logged out", array("name" => $user->name)),
-              html::anchor("user/$user->id", html::clean($user->name)));
+              t('<a href="%url">%user_name</a>',
+                array("url" => user_profile::url($user->id),
+                      "user_name" => html::clean($user->name))));
   }
 }
\ No newline at end of file
-- 
cgit v1.2.3


From b8fb891828effa441a37efdd5babe03a5c7f5efe Mon Sep 17 00:00:00 2001
From: Tim Almdal <tnalmdal@shaw.ca>
Date: Thu, 28 Jan 2010 11:46:28 -0800
Subject: Make the return button work in chrome, FF, IE, safari and opera.

---
 modules/gallery/views/user_profile.html.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/gallery/views/user_profile.html.php b/modules/gallery/views/user_profile.html.php
index 7dc9d13e..f35f8c3f 100644
--- a/modules/gallery/views/user_profile.html.php
+++ b/modules/gallery/views/user_profile.html.php
@@ -26,6 +26,7 @@
   $(document).ready(function() {
     $("#g-profile-return").click(function(event) {
       history.go(-1);
+      return false;
     })
   });
 </script>
-- 
cgit v1.2.3


From 5c527513c688571adcff45f513efff54b9c55e61 Mon Sep 17 00:00:00 2001
From: Andy Staudacher <andy.st@gmail.com>
Date: Thu, 28 Jan 2010 19:46:53 -0800
Subject: Fix language preference block / language cookie reading.

The preference block must have been broken by a jquery update, and the cookie reading by a Kohana update.
---
 modules/gallery/helpers/locales.php                 | 4 +++-
 modules/gallery/views/user_languages_block.html.php | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/modules/gallery/helpers/locales.php b/modules/gallery/helpers/locales.php
index 5c8c227a..dc32b12f 100644
--- a/modules/gallery/helpers/locales.php
+++ b/modules/gallery/helpers/locales.php
@@ -238,7 +238,9 @@ class locales_Core {
   }
 
   static function cookie_locale() {
-    $cookie_data = Input::instance()->cookie("g_locale");
+    // Can't use Input framework for client side cookies since
+    // they're not signed.
+    $cookie_data = isset($_COOKIE["g_locale"]) ? $_COOKIE["g_locale"] : null;
     $locale = null;
     if ($cookie_data) {
       if (preg_match("/^([a-z]{2,3}(?:_[A-Z]{2})?)$/", trim($cookie_data), $matches)) {
diff --git a/modules/gallery/views/user_languages_block.html.php b/modules/gallery/views/user_languages_block.html.php
index 89185967..3776ca13 100644
--- a/modules/gallery/views/user_languages_block.html.php
+++ b/modules/gallery/views/user_languages_block.html.php
@@ -1,7 +1,7 @@
 <?php defined("SYSPATH") or die("No direct script access.") ?>
 <?= form::dropdown("g-select-session-locale", $installed_locales, $selected) ?>
 <script type="text/javascript">
-  $("#g-select-session-locale").change(function() {
+  $("select[name=g-select-session-locale]").change(function() {
     var old_locale_preference = <?= html::js_string($selected) ?>;
     var locale = $(this).val();
     if (old_locale_preference == locale) {
-- 
cgit v1.2.3


From 56d04b1ed83dc098eacd3d05496fef98cfaf8b8a Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Thu, 28 Jan 2010 20:38:48 -0800
Subject: cast $task->done to bool so that it doesn't show up as "0" to the JS,
 which will interpret that as a true value, when it's not.

---
 modules/server_add/controllers/server_add.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/server_add/controllers/server_add.php b/modules/server_add/controllers/server_add.php
index 287855b6..2a948653 100644
--- a/modules/server_add/controllers/server_add.php
+++ b/modules/server_add/controllers/server_add.php
@@ -110,7 +110,7 @@ class Server_Add_Controller extends Admin_Controller {
     }
 
     $task = task::run($task_id);
-    print json_encode(array("done" => $task->done,
+    print json_encode(array("done" => (bool)$task->done,
                             "status" => $task->status,
                             "percent_complete" => $task->percent_complete));
   }
-- 
cgit v1.2.3


From 3ed81869cbbf021a11868f612ffc79c031df42f2 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Thu, 28 Jan 2010 20:44:10 -0800
Subject: Cast the SafeString $task->status to (string) so that it doesn't come
 down to the JS as an object.

---
 modules/gallery/controllers/admin_maintenance.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/gallery/controllers/admin_maintenance.php b/modules/gallery/controllers/admin_maintenance.php
index aa4fb29f..3062ea09 100644
--- a/modules/gallery/controllers/admin_maintenance.php
+++ b/modules/gallery/controllers/admin_maintenance.php
@@ -215,7 +215,7 @@ class Admin_Maintenance_Controller extends Admin_Controller {
       print json_encode(array("result" => "success",
                               "task" => array(
                                 "percent_complete" => $task->percent_complete,
-                                "status" => $task->status,
+                                "status" => (string) $task->status,
                                 "done" => (bool) $task->done),
                               "location" => url::site("admin/maintenance")));
 
@@ -223,7 +223,7 @@ class Admin_Maintenance_Controller extends Admin_Controller {
       print json_encode(array("result" => "in_progress",
                               "task" => array(
                                 "percent_complete" => $task->percent_complete,
-                                "status" => $task->status,
+                                "status" => (string) $task->status,
                                 "done" => (bool) $task->done)));
     }
   }
-- 
cgit v1.2.3


From f0ae2c81654a056b19ba5f2b433f34cf32e9d953 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Thu, 28 Jan 2010 20:55:38 -0800
Subject: Localize edit form error messages.

---
 modules/user/controllers/users.php | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/modules/user/controllers/users.php b/modules/user/controllers/users.php
index b1ac1944..ede1f0de 100644
--- a/modules/user/controllers/users.php
+++ b/modules/user/controllers/users.php
@@ -78,12 +78,17 @@ class Users_Controller extends Controller {
   private function _get_edit_form($user) {
     $form = new Forge("users/update/$user->id", "", "post", array("id" => "g-edit-user-form"));
     $group = $form->group("edit_user")->label(t("Edit User: %name", array("name" => $user->name)));
-    $group->input("full_name")->label(t("Full Name"))->id("g-fullname")->value($user->full_name);
+    $group->input("full_name")->label(t("Full Name"))->id("g-fullname")->value($user->full_name)
+      ->error_messages("length", t("Your name is too long"));
     self::_add_locale_dropdown($group, $user);
-    $group->password("password")->label(t("Password"))->id("g-password");
+    $group->password("password")->label(t("Password"))->id("g-password")
+      ->error_messages("min_length", t("Your password is too short"));
     $group->password("password2")->label(t("Confirm Password"))->id("g-password2")
-      ->matches($group->password);
-    $group->input("email")->label(t("Email"))->id("g-email")->value($user->email);
+      ->matches($group->password)
+      ->error_messages("matches", t("The passwords you entered do not match"));
+    $group->input("email")->label(t("Email"))->id("g-email")->value($user->email)
+      ->error_messages("email", t("You must enter a valid email address"))
+      ->error_messages("required", t("You must enter a valid email address"));
     $group->input("url")->label(t("URL"))->id("g-url")->value($user->url);
 
     module::event("user_edit_form", $user, $form);
-- 
cgit v1.2.3


From b6322b1c9f9b0914fa639dba3361f1ff6fe05ab5 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Thu, 28 Jan 2010 21:31:54 -0800
Subject: Updated for model based validation.  We must now provide a
 placeholder email address for the admin user, since one is required for all
 users.

---
 installer/install.sql | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/installer/install.sql b/installer/install.sql
index 95a57d86..39637fb3 100644
--- a/installer/install.sql
+++ b/installer/install.sql
@@ -355,7 +355,7 @@ CREATE TABLE {users} (
 ) AUTO_INCREMENT=3 DEFAULT CHARSET=utf8;
 SET character_set_client = @saved_cs_client;
 INSERT INTO {users} VALUES (1,'guest','Guest User','',0,0,NULL,0,1,NULL,NULL,NULL);
-INSERT INTO {users} VALUES (2,'admin','Gallery Administrator','',0,0,NULL,1,0,NULL,NULL,NULL);
+INSERT INTO {users} VALUES (2,'admin','Gallery Administrator','',0,0,'unknown@unknown.com',1,0,NULL,NULL,NULL);
 DROP TABLE IF EXISTS {vars};
 SET @saved_cs_client     = @@character_set_client;
 SET character_set_client = utf8;
@@ -366,7 +366,7 @@ CREATE TABLE {vars} (
   `value` text,
   PRIMARY KEY  (`id`),
   UNIQUE KEY `module_name` (`module_name`,`name`)
-) AUTO_INCREMENT=37 DEFAULT CHARSET=utf8;
+) AUTO_INCREMENT=39 DEFAULT CHARSET=utf8;
 SET character_set_client = @saved_cs_client;
 INSERT INTO {vars} VALUES (NULL,'gallery','active_site_theme','wind');
 INSERT INTO {vars} VALUES (NULL,'gallery','active_admin_theme','admin_wind');
@@ -385,8 +385,8 @@ INSERT INTO {vars} VALUES (NULL,'gallery','date_time_format','Y-M-d H:i:s');
 INSERT INTO {vars} VALUES (NULL,'gallery','date_format','Y-M-d');
 INSERT INTO {vars} VALUES (NULL,'gallery','blocks_dashboard_center','a:3:{i:6;a:2:{i:0;s:7:\"gallery\";i:1;s:7:\"welcome\";}i:7;a:2:{i:0;s:7:\"gallery\";i:1;s:12:\"photo_stream\";}i:8;a:2:{i:0;s:7:\"gallery\";i:1;s:11:\"log_entries\";}}');
 INSERT INTO {vars} VALUES (NULL,'gallery','choose_default_tookit','1');
+INSERT INTO {vars} VALUES (NULL,'gallery','identity_provider','user');
 INSERT INTO {vars} VALUES (NULL,'user','mininum_password_length','5');
 INSERT INTO {vars} VALUES (NULL,'comment','spam_caught','0');
-INSERT INTO {vars} VALUES (NULL,'gallery','identity_provider','user');
 INSERT INTO {vars} VALUES (NULL,'gallery','blocks_site_sidebar','a:3:{i:9;a:2:{i:0;s:4:\"info\";i:1;s:8:\"metadata\";}i:10;a:2:{i:0;s:3:\"rss\";i:1;s:9:\"rss_feeds\";}i:11;a:2:{i:0;s:3:\"tag\";i:1;s:3:\"tag\";}}');
 INSERT INTO {vars} VALUES (NULL,'slideshow','max_scale','0');
-- 
cgit v1.2.3


From 3584856afcf9f745d09dcd56b63932c8bf0716d1 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Thu, 28 Jan 2010 21:32:50 -0800
Subject: Use auth::login() when we initially log in the admin user.

---
 modules/gallery/helpers/identity.php | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/modules/gallery/helpers/identity.php b/modules/gallery/helpers/identity.php
index ef93d72f..6df860d6 100644
--- a/modules/gallery/helpers/identity.php
+++ b/modules/gallery/helpers/identity.php
@@ -68,9 +68,7 @@ class identity_Core {
       // upconvert into a user.
       // @todo set the user name into the session instead of 2 and then use it to get the user object
       if ($user === 2) {
-        $user = IdentityProvider::instance()->admin_user();
-        self::set_active_user($user);
-        $session->set("user", $user);
+        auth::login(IdentityProvider::instance()->admin_user());
       }
 
       if (!$session->get("group_ids")) {
@@ -82,7 +80,7 @@ class identity_Core {
       }
     } catch (Exception $e) {
       // Log it, so we at least have so notification that we swallowed the exception.
-      Kohana_Log::add("error", "Load_user Exception: " .
+      Kohana_Log::add("error", "load_user Exception: " .
                       $e->getMessage() . "\n" . $e->getTraceAsString());
       try {
         Session::instance()->destroy();
-- 
cgit v1.2.3


From 70b235e13d3b8ba12977c1699eb108e35a73f069 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Thu, 28 Jan 2010 21:33:01 -0800
Subject: In auth::login() make the user active before trying to save it, else
 the validation code fails because it expects there to be an active user.

---
 modules/gallery/helpers/auth.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/gallery/helpers/auth.php b/modules/gallery/helpers/auth.php
index bdff2f70..f7d4f7e8 100644
--- a/modules/gallery/helpers/auth.php
+++ b/modules/gallery/helpers/auth.php
@@ -30,12 +30,12 @@ class auth_Core {
   }
 
   static function login($user) {
+    identity::set_active_user($user);
     if (identity::is_writable()) {
       $user->login_count += 1;
       $user->last_login = time();
       $user->save();
     }
-    identity::set_active_user($user);
     log::info("user", t("User %name logged in", array("name" => $user->name)));
     module::event("user_login", $user);
   }
-- 
cgit v1.2.3


From 9908f37eef22db81061eef7783d4d7fd11ccaf3b Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Thu, 28 Jan 2010 21:33:41 -0800
Subject: Use identity::set_active_user() instead of auth::login() when we
 change providers otherwise the user_installer code is going to be calling
 auth::login() which causes all kinds of unexpected weirdness, like it
 triggers the handler in gallery_event which detects graphics toolkits, and
 that's only supposed to run on the first admin login.

---
 modules/gallery/libraries/IdentityProvider.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/gallery/libraries/IdentityProvider.php b/modules/gallery/libraries/IdentityProvider.php
index c6b393ec..3f1666eb 100644
--- a/modules/gallery/libraries/IdentityProvider.php
+++ b/modules/gallery/libraries/IdentityProvider.php
@@ -83,7 +83,7 @@ class IdentityProvider_Core {
 
       module::event("identity_provider_changed", $current_provider, $new_provider);
 
-      auth::login($provider->admin_user());
+      identity::set_active_user($provider->admin_user());
       Session::instance()->regenerate();
     } catch (Exception $e) {
       static $restore_already_running;
-- 
cgit v1.2.3


From aacafaaf35d8cc41c9d6374412c8cf1e2544dad7 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Thu, 28 Jan 2010 23:17:32 -0800
Subject: Add @todo.

---
 modules/gallery/controllers/quick.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/gallery/controllers/quick.php b/modules/gallery/controllers/quick.php
index 7f9a9826..04aab8dc 100644
--- a/modules/gallery/controllers/quick.php
+++ b/modules/gallery/controllers/quick.php
@@ -47,6 +47,7 @@ class Quick_Controller extends Controller {
       graphics::generate($item);
 
       $parent = $item->parent();
+      // @todo: this is an inadequate way to regenerate the parent's thumbnail after rotation.
       if ($parent->album_cover_item_id == $item->id) {
         copy($item->thumb_path(), $parent->thumb_path());
         $parent->thumb_width = $item->thumb_width;
-- 
cgit v1.2.3


From 743fbe76965b00087d8e091f742acd61d3a740d0 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Thu, 28 Jan 2010 23:22:38 -0800
Subject: Add page_type to the rotate and delete context menu items so that the
 quick menu knows where to send you after the action is done.

---
 modules/gallery/helpers/gallery_event.php | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/modules/gallery/helpers/gallery_event.php b/modules/gallery/helpers/gallery_event.php
index b3d4daab..80452276 100644
--- a/modules/gallery/helpers/gallery_event.php
+++ b/modules/gallery/helpers/gallery_event.php
@@ -286,6 +286,7 @@ class gallery_event_Core {
                   ->label(t("Options"))
                   ->css_class("ui-icon-carat-1-n"));
 
+    $page_type = $theme->page_type();
     if (access::can("edit", $item)) {
       switch ($item->type) {
       case "movie":
@@ -324,7 +325,7 @@ class gallery_event_Core {
             ->css_class("ui-icon-rotate-ccw")
             ->ajax_handler("function(data) { " .
                            "\$.gallery_replace_image(data, \$('$thumb_css_selector')) }")
-            ->url(url::site("quick/rotate/$item->id/ccw?csrf=$csrf&from_id=$theme_item->id")))
+            ->url(url::site("quick/rotate/$item->id/ccw?csrf=$csrf&from_id=$theme_item->id&page_type=$page_type")))
           ->append(
             Menu::factory("ajax_link")
             ->id("rotate_cw")
@@ -332,7 +333,7 @@ class gallery_event_Core {
             ->css_class("ui-icon-rotate-cw")
             ->ajax_handler("function(data) { " .
                            "\$.gallery_replace_image(data, \$('$thumb_css_selector')) }")
-            ->url(url::site("quick/rotate/$item->id/cw?csrf=$csrf&from_id=$theme_item->id")));
+            ->url(url::site("quick/rotate/$item->id/cw?csrf=$csrf&from_id=$theme_item->id&page_type=$page_type")));
       }
 
       // @todo Don't move photos from the photo page; we don't yet have a good way of redirecting
@@ -372,7 +373,7 @@ class gallery_event_Core {
                    ->label($delete_title)
                    ->css_class("ui-icon-trash")
                    ->css_id("g-quick-delete")
-                   ->url(url::site("quick/form_delete/$item->id?csrf=$csrf&from_id=$theme_item->id")));
+                   ->url(url::site("quick/form_delete/$item->id?csrf=$csrf&from_id=$theme_item->id&page_type=$page_type")));
       }
 
       if ($item->is_album()) {
-- 
cgit v1.2.3


From 0d73738099f7c12f2185018a29b647763c9d36ce Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 29 Jan 2010 10:13:10 -0800
Subject: Stop using obsolete form::close() Update the way we include the
 hidden CSRF field for InPlaceEdit.

---
 modules/digibug/views/digibug_form.html.php  | 2 +-
 modules/gallery/libraries/InPlaceEdit.php    | 1 -
 modules/gallery/views/in_place_edit.html.php | 5 +++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/modules/digibug/views/digibug_form.html.php b/modules/digibug/views/digibug_form.html.php
index c6994cbe..f7b34e16 100644
--- a/modules/digibug/views/digibug_form.html.php
+++ b/modules/digibug/views/digibug_form.html.php
@@ -3,7 +3,7 @@
   <body>
     <?= form::open("http://www.digibug.com/dapi/order.php") ?>
     <?= form::hidden($order_parms) ?>
-    <?= form::close() ?>
+    </form>
     <script type="text/javascript">
       document.forms[0].submit();
     </script>
diff --git a/modules/gallery/libraries/InPlaceEdit.php b/modules/gallery/libraries/InPlaceEdit.php
index 67ab3805..04a2e9a5 100644
--- a/modules/gallery/libraries/InPlaceEdit.php
+++ b/modules/gallery/libraries/InPlaceEdit.php
@@ -70,7 +70,6 @@ class InPlaceEdit_Core {
 
   public function render() {
     $v = new View("in_place_edit.html");
-    $v->hidden = array("csrf" => access::csrf_token());
     $v->action = url::site($this->action);
     $v->form = $this->form;
     $v->errors = $this->errors;
diff --git a/modules/gallery/views/in_place_edit.html.php b/modules/gallery/views/in_place_edit.html.php
index 45cf1d8c..b556829c 100644
--- a/modules/gallery/views/in_place_edit.html.php
+++ b/modules/gallery/views/in_place_edit.html.php
@@ -1,5 +1,6 @@
 <?php defined("SYSPATH") or die("No direct script access.") ?>
-<?= form::open($action, array("method" => "post", "id" => "g-in-place-edit-form", "class" => "g-short-form"), $hidden) ?>
+<?= form::open($action, array("method" => "post", "id" => "g-in-place-edit-form", "class" => "g-short-form")) ?>
+  <?= access::csrf_form_field() ?>
   <ul>
     <li<? if (!empty($errors["input"])): ?> class="g-error"<? endif ?>>
       <?= form::input("input", $form["input"], " class=\"textbox\"") ?>
@@ -9,7 +10,7 @@
     </li>
     <li><a href="#" class="g-cancel"><?= t("Cancel") ?></a></li>
   </ul>
-<?= form::close() ?>
+</form>
 <? if (!empty($errors["input"])): ?>
 <div id="g-in-place-edit-message" class="g-error"><?= $errors["input"] ?></div>
 <? endif ?>
-- 
cgit v1.2.3


From c214dfd0948c1878dbd034694c2d8d6f8c8e1180 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 29 Jan 2010 10:54:59 -0800
Subject: Clean up form validation code.

---
 modules/akismet/controllers/admin_akismet.php | 11 +----------
 modules/akismet/helpers/akismet.php           | 17 +++++++++++------
 2 files changed, 12 insertions(+), 16 deletions(-)

diff --git a/modules/akismet/controllers/admin_akismet.php b/modules/akismet/controllers/admin_akismet.php
index ca3a1473..4847db53 100644
--- a/modules/akismet/controllers/admin_akismet.php
+++ b/modules/akismet/controllers/admin_akismet.php
@@ -25,17 +25,8 @@ class Admin_Akismet_Controller extends Admin_Controller {
       // @todo move the "post" handler part of this code into a separate function
       access::verify_csrf();
 
-      $valid = $form->validate();
-
-      if ($valid) {
+      if ($form->validate()) {
         $new_key = $form->configure_akismet->api_key->value;
-        if ($new_key && !akismet::validate_key($new_key)) {
-          $form->configure_akismet->api_key->add_error("invalid", 1);
-          $valid = false;
-        }
-      }
-
-      if ($valid) {
         $old_key = module::get_var("akismet", "api_key");
         if ($old_key && !$new_key) {
           message::success(t("Your Akismet key has been cleared."));
diff --git a/modules/akismet/helpers/akismet.php b/modules/akismet/helpers/akismet.php
index 46a305b2..b4405de5 100644
--- a/modules/akismet/helpers/akismet.php
+++ b/modules/akismet/helpers/akismet.php
@@ -23,8 +23,9 @@ class akismet_Core {
   static function get_configure_form() {
     $form = new Forge("admin/akismet", "", "post", array("id" => "g-configure-akismet-form"));
     $group = $form->group("configure_akismet")->label(t("Configure Akismet"));
-    $group->input("api_key")->label(t("API Key"))->value(module::get_var("akismet", "api_key"));
-    $group->api_key->error_messages("invalid", t("The API key you provided is invalid."));
+    $group->input("api_key")->label(t("API Key"))->value(module::get_var("akismet", "api_key"))
+      ->callback("akismet::validate_key")
+      ->error_messages("invalid", t("The API key you provided is invalid."));
     $group->submit("")->value(t("Save"));
     return $form;
   }
@@ -82,10 +83,14 @@ class akismet_Core {
    * @param  string   $api_key the API key
    * @return boolean
    */
-  static function validate_key($api_key) {
-    $request = self::_build_verify_request($api_key);
-    $response = self::_http_post($request, "rest.akismet.com");
-    return "valid" == $response->body[0];
+  static function validate_key($api_key_input) {
+    if ($api_key_input->value) {
+      $request = self::_build_verify_request($api_key_input->value);
+      $response = self::_http_post($request, "rest.akismet.com");
+      if ("valid" != $response->body[0]) {
+        $api_key_input->add_error("invalid", 1);
+      }
+    }
   }
 
 
-- 
cgit v1.2.3


From 3f5ad7d77a4b877220cd410afbb286dce5b15b75 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 29 Jan 2010 11:20:35 -0800
Subject: Clean up form validation code.

---
 modules/recaptcha/controllers/admin_recaptcha.php |  2 +-
 modules/recaptcha/helpers/recaptcha.php           | 40 ++++++++++++++---------
 2 files changed, 25 insertions(+), 17 deletions(-)

diff --git a/modules/recaptcha/controllers/admin_recaptcha.php b/modules/recaptcha/controllers/admin_recaptcha.php
index 6874fce9..0ddb98c1 100644
--- a/modules/recaptcha/controllers/admin_recaptcha.php
+++ b/modules/recaptcha/controllers/admin_recaptcha.php
@@ -42,7 +42,7 @@ class Admin_Recaptcha_Controller extends Admin_Controller {
         } else {
           module::set_var("recaptcha", "public_key", "");
           module::set_var("recaptcha", "private_key", "");
-          message::success(t("reCAPTCHA disabled!"));
+          message::success(t("No keys provided.  reCAPTCHA is disabled!"));
           log::success("recaptcha", t("reCAPTCHA public and private keys cleared"));
           url::redirect("admin/recaptcha");
         }
diff --git a/modules/recaptcha/helpers/recaptcha.php b/modules/recaptcha/helpers/recaptcha.php
index 789bae85..2b3b869c 100644
--- a/modules/recaptcha/helpers/recaptcha.php
+++ b/modules/recaptcha/helpers/recaptcha.php
@@ -24,12 +24,16 @@ class recaptcha_Core {
       ->label(t("Configure reCAPTCHA"));
     $group->input("public_key")
       ->label(t("Public Key"))
-      ->value(module::get_var("recaptcha", "public_key"));
-    $group->public_key->error_messages("invalid", t("The public key you provided is invalid."));
+      ->value(module::get_var("recaptcha", "public_key"))
+      ->rules("required")
+      ->error_messages("required", t("You must enter a public key"))
+      ->error_messages("invalid", t("This public key is invalid"));
     $group->input("private_key")
       ->label(t("Private Key"))
-      ->value(module::get_var("recaptcha", "private_key"));
-    $group->private_key->error_messages("invalid", t("The private key you provided is invalid."));
+      ->value(module::get_var("recaptcha", "private_key"))
+      ->callback("recaptcha::verify_key")
+      ->error_messages("required", t("You must enter a private key"))
+      ->error_messages("invalid", t("This private key is invalid"));
 
     $group->submit("")->value(t("Save"));
     $site_domain = urlencode(stripslashes($_SERVER["HTTP_HOST"]));
@@ -55,19 +59,23 @@ class recaptcha_Core {
    * @param string $private_key
    * @return boolean
    */
-  static function verify_key($private_key) {
+  static function verify_key($private_key_input) {
+    if (empty($private_key_input->value)) {
+      $private_key_input->add_error("required", 1);
+      return;
+    }
+
     $remote_ip = Input::instance()->server("REMOTE_ADDR");
     $response = self::_http_post("api-verify.recaptcha.net", "/verify",
-                                 array("privatekey" => $private_key,
+                                 array("privatekey" => $private_key_input->value,
                                        "remoteip" => $remote_ip,
                                        "challenge" => "right",
                                        "response" => "wrong"));
 
-    $answers = explode("\n", $response[1]);
-    if (trim($answers[0]) == "true") {
-      return null;
-    } else {
-      return $answers[1];
+    if ($response[1] == "false\ninvalid-site-private-key") {
+      // This is the only thing I can figure out how to verify.
+      // See http://recaptcha.net/apidocs/captcha for possible return values
+      $private_key_input->add_error("invalid", 1);
     }
   }
 
@@ -80,16 +88,16 @@ class recaptcha_Core {
     $input = Input::instance();
     $remote_ip = $input->server("REMOTE_ADDR");
 
-    //discard spam submissions
+    // discard spam submissions
     if (empty($challenge) || empty($response)) {
       return  "incorrect-captcha-sol";
     }
 
     $response = self::_http_post("api-verify.recaptcha.net", "/verify",
-                              array ("privatekey" => $private_key,
-                                        "remoteip" => $remote_ip,
-                                     "challenge" => $challenge,
-                                     "response" => $response));
+                              array("privatekey" => $private_key,
+                                    "remoteip" => $remote_ip,
+                                    "challenge" => $challenge,
+                                    "response" => $response));
 
     $answers = explode ("\n", $response [1]);
     if (trim ($answers [0]) == "true") {
-- 
cgit v1.2.3


From 660130cf1ab9fd6cb051712b57966b191064a6a6 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 29 Jan 2010 11:23:28 -0800
Subject: Work around a weirdness where empty() doesn't work on input values.

---
 modules/recaptcha/helpers/recaptcha.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/recaptcha/helpers/recaptcha.php b/modules/recaptcha/helpers/recaptcha.php
index 2b3b869c..5df22cbc 100644
--- a/modules/recaptcha/helpers/recaptcha.php
+++ b/modules/recaptcha/helpers/recaptcha.php
@@ -60,7 +60,7 @@ class recaptcha_Core {
    * @return boolean
    */
   static function verify_key($private_key_input) {
-    if (empty($private_key_input->value)) {
+    if (!$private_key_input->value) {
       $private_key_input->add_error("required", 1);
       return;
     }
-- 
cgit v1.2.3


From 1bc0d05760df7bff5cee0a330b5b7181b3c49835 Mon Sep 17 00:00:00 2001
From: Tim Almdal <tnalmdal@shaw.ca>
Date: Fri, 29 Jan 2010 11:36:35 -0800
Subject: Replace <?= form::close() ?> with </form>. Also add a call to
 access::csrf_form_field in the form template. Fixes ticket #996.

---
 modules/gallery/views/in_place_edit.html.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/gallery/views/in_place_edit.html.php b/modules/gallery/views/in_place_edit.html.php
index 45cf1d8c..ad9ea845 100644
--- a/modules/gallery/views/in_place_edit.html.php
+++ b/modules/gallery/views/in_place_edit.html.php
@@ -1,5 +1,6 @@
 <?php defined("SYSPATH") or die("No direct script access.") ?>
 <?= form::open($action, array("method" => "post", "id" => "g-in-place-edit-form", "class" => "g-short-form"), $hidden) ?>
+  <?= access::csrf_form_field() ?>
   <ul>
     <li<? if (!empty($errors["input"])): ?> class="g-error"<? endif ?>>
       <?= form::input("input", $form["input"], " class=\"textbox\"") ?>
@@ -9,7 +10,7 @@
     </li>
     <li><a href="#" class="g-cancel"><?= t("Cancel") ?></a></li>
   </ul>
-<?= form::close() ?>
+</form/>
 <? if (!empty($errors["input"])): ?>
 <div id="g-in-place-edit-message" class="g-error"><?= $errors["input"] ?></div>
 <? endif ?>
-- 
cgit v1.2.3


From c4e360431564627003e4c7864b5dd5a07297e91e Mon Sep 17 00:00:00 2001
From: Tim Almdal <tnalmdal@shaw.ca>
Date: Fri, 29 Jan 2010 14:04:27 -0800
Subject: Strongly type the argument list to the model::validate method.

---
 modules/comment/models/comment.php | 2 +-
 modules/gallery/models/item.php    | 2 +-
 modules/user/models/group.php      | 2 +-
 modules/user/models/user.php       | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/modules/comment/models/comment.php b/modules/comment/models/comment.php
index 8be022b5..add15ce8 100644
--- a/modules/comment/models/comment.php
+++ b/modules/comment/models/comment.php
@@ -56,7 +56,7 @@ class Comment_Model extends ORM {
   /**
    * Add some custom per-instance rules.
    */
-  public function validate($array=null) {
+  public function validate(Validation $array=null) {
     // validate() is recursive, only modify the rules on the outermost call.
     if (!$array) {
       $this->rules = array(
diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php
index ae1b6608..ae6e4cc9 100644
--- a/modules/gallery/models/item.php
+++ b/modules/gallery/models/item.php
@@ -720,7 +720,7 @@ class Item_Model extends ORM_MPTT {
   /**
    * Specify our rules here so that we have access to the instance of this model.
    */
-  public function validate($array=null) {
+  public function validate(Validation $array=null) {
     if (!$array) {
       $this->rules = array(
         "album_cover_item_id" => array("callbacks" => array(array($this, "valid_album_cover"))),
diff --git a/modules/user/models/group.php b/modules/user/models/group.php
index 851e72e6..82843ad1 100644
--- a/modules/user/models/group.php
+++ b/modules/user/models/group.php
@@ -37,7 +37,7 @@ class Group_Model extends ORM implements Group_Definition {
   /**
    * Specify our rules here so that we have access to the instance of this model.
    */
-  public function validate($array=null) {
+  public function validate(Validation $array=null) {
     // validate() is recursive, only modify the rules on the outermost call.
     if (!$array) {
       $this->rules = array(
diff --git a/modules/user/models/user.php b/modules/user/models/user.php
index 78c31047..0cd634ea 100644
--- a/modules/user/models/user.php
+++ b/modules/user/models/user.php
@@ -62,7 +62,7 @@ class User_Model extends ORM implements User_Definition {
   /**
    * Specify our rules here so that we have access to the instance of this model.
    */
-  public function validate($array=null) {
+  public function validate(Validation $array=null) {
     // validate() is recursive, only modify the rules on the outermost call.
     if (!$array) {
       $this->rules = array(
-- 
cgit v1.2.3


From 45cdac973d35de083875ed966ac687b805d60e7f Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 29 Jan 2010 14:06:36 -0800
Subject: Oops, somebody (me?) forgot to update the gallery module version
 number in gallery_installer::install() so the install.sql was out of sync.

---
 installer/install.sql                         | 2 +-
 modules/gallery/helpers/gallery_installer.php | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/installer/install.sql b/installer/install.sql
index 39637fb3..a5eec229 100644
--- a/installer/install.sql
+++ b/installer/install.sql
@@ -228,7 +228,7 @@ CREATE TABLE {modules} (
   UNIQUE KEY `name` (`name`)
 ) AUTO_INCREMENT=10 DEFAULT CHARSET=utf8;
 SET character_set_client = @saved_cs_client;
-INSERT INTO {modules} VALUES (1,1,'gallery',21);
+INSERT INTO {modules} VALUES (1,1,'gallery',22);
 INSERT INTO {modules} VALUES (2,1,'user',2);
 INSERT INTO {modules} VALUES (3,1,'comment',2);
 INSERT INTO {modules} VALUES (4,1,'organize',1);
diff --git a/modules/gallery/helpers/gallery_installer.php b/modules/gallery/helpers/gallery_installer.php
index bfab4645..93948045 100644
--- a/modules/gallery/helpers/gallery_installer.php
+++ b/modules/gallery/helpers/gallery_installer.php
@@ -276,7 +276,7 @@ class gallery_installer {
     // @todo this string needs to be picked up by l10n_scanner
     module::set_var("gallery", "credits", "Powered by <a href=\"%url\">Gallery %version</a>");
     module::set_var("gallery", "simultaneous_upload_limit", 5);
-    module::set_version("gallery", 21);
+    module::set_version("gallery", 22);
   }
 
   static function upgrade($version) {
-- 
cgit v1.2.3


From 844d40a759db80108d20684303680d2e489af9d0 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 29 Jan 2010 14:12:07 -0800
Subject: Oops, forgot to bump the version to 2 in install().

---
 modules/g2_import/helpers/g2_import_installer.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/g2_import/helpers/g2_import_installer.php b/modules/g2_import/helpers/g2_import_installer.php
index 77b61d3e..1ec8afa9 100644
--- a/modules/g2_import/helpers/g2_import_installer.php
+++ b/modules/g2_import/helpers/g2_import_installer.php
@@ -31,7 +31,7 @@ class g2_import_installer {
                KEY `g2_id` (`g2_id`))
                DEFAULT CHARSET=utf8;");
 
-    module::set_version("g2_import", 1);
+    module::set_version("g2_import", 2);
     mkdir(VARPATH . "modules/g2_import");
   }
 
-- 
cgit v1.2.3


From 98bcb95b1065a044909c4c4ff15d93fafc793df7 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 29 Jan 2010 14:20:34 -0800
Subject: Go through all slugs and make them legal values. Upgrade gallery3
 module to version 23

---
 modules/gallery/helpers/gallery_installer.php | 23 ++++++++++++++++++++++-
 modules/gallery/module.info                   |  2 +-
 2 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/modules/gallery/helpers/gallery_installer.php b/modules/gallery/helpers/gallery_installer.php
index 93948045..8227fdc9 100644
--- a/modules/gallery/helpers/gallery_installer.php
+++ b/modules/gallery/helpers/gallery_installer.php
@@ -450,7 +450,7 @@ class gallery_installer {
 
     // Update the graphics rules table so that the maximum height for resizes is 640 not 480.
     // Fixes ticket #671
-    if ( $version == 21) {
+    if ($version == 21) {
       $resize_rule = ORM::factory("graphics_rule")
         ->where("id", "=", "2")
         ->find();
@@ -463,6 +463,27 @@ class gallery_installer {
       }
       module::set_version("gallery", $version = 22);
     }
+
+    // Update slug values to be legal.  We should have done this in the 11->12 upgrader, but I was
+    // lazy.  Mea culpa!
+    if ($version == 22) {
+      foreach (db::build()
+               ->from("items")
+               ->select("id", "slug")
+               ->where(new Database_Expression("`slug` REGEXP '[^_A-Za-z0-9-]'"), "=", 1)
+               ->execute() as $row) {
+        $new_slug = item::convert_filename_to_slug($row->slug);
+        if (empty($new_slug)) {
+          $new_slug = rand();
+        }
+        db::build()
+          ->update("items")
+          ->set("slug", $new_slug)
+          ->where("id", "=", $row->id)
+          ->execute();
+      }
+      module::set_version("gallery", $version = 23);
+    }
   }
 
   static function uninstall() {
diff --git a/modules/gallery/module.info b/modules/gallery/module.info
index 107d9a12..ee169cf1 100644
--- a/modules/gallery/module.info
+++ b/modules/gallery/module.info
@@ -1,4 +1,4 @@
 name = "Gallery 3"
 description = "Gallery core application"
-version = 22
+version = 23
 
-- 
cgit v1.2.3


From d4998e37d859e4702407b9a85af6a8ac2fabe686 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 29 Jan 2010 14:25:57 -0800
Subject: Don't forget to flush the relative_url_cache when updating the slug.

---
 modules/gallery/helpers/gallery_installer.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/gallery/helpers/gallery_installer.php b/modules/gallery/helpers/gallery_installer.php
index 8227fdc9..d2378d64 100644
--- a/modules/gallery/helpers/gallery_installer.php
+++ b/modules/gallery/helpers/gallery_installer.php
@@ -479,6 +479,7 @@ class gallery_installer {
         db::build()
           ->update("items")
           ->set("slug", $new_slug)
+          ->set("relative_url_cache", null)
           ->where("id", "=", $row->id)
           ->execute();
       }
-- 
cgit v1.2.3


From a95609849e42656b35f0110a08cc4436ad56b916 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 29 Jan 2010 14:53:40 -0800
Subject: Use var_export instead of print_r for better clarity.

---
 modules/rest/helpers/rest.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/rest/helpers/rest.php b/modules/rest/helpers/rest.php
index 0d2ec9d4..1f95a7e7 100644
--- a/modules/rest/helpers/rest.php
+++ b/modules/rest/helpers/rest.php
@@ -25,8 +25,8 @@ class rest_Core {
       if (Input::instance()->get("output") == "html") {
         header("Content-type: text/html");
         $html = preg_replace(
-          "#(^|[\n ])([\w]+?://[\w]+[^ \"\n\r\t<]*)#ise", "'\\1<a href=\"\\2\" >\\2</a>'",
-          print_r($data, 1));
+          "#([\w]+?://[\w]+[^ \'\"\n\r\t<]*)#ise", "'<a href=\"\\1\" >\\1</a>'",
+          var_export($data, 1));
         print "<pre>$html</pre>";
       } else {
         header("Content-type: application/json");
-- 
cgit v1.2.3


From a04d0d278964c93b4829ec2e77f5f315abcba392 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 29 Jan 2010 19:42:38 -0800
Subject: Add missing permission checks. Make the tag relationship an
 associative array.

---
 modules/tag/helpers/tag_item_rest.php           | 6 +++---
 modules/tag/helpers/tag_items_rest.php          | 8 ++++++--
 modules/tag/tests/Tag_Item_Rest_Helper_Test.php | 4 ++--
 3 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/modules/tag/helpers/tag_item_rest.php b/modules/tag/helpers/tag_item_rest.php
index 60d37437..672cec53 100644
--- a/modules/tag/helpers/tag_item_rest.php
+++ b/modules/tag/helpers/tag_item_rest.php
@@ -23,8 +23,8 @@ class tag_item_rest_Core {
     return array(
       "url" => $request->url,
       "members" => array(
-        rest::url("tag", $tag),
-        rest::url("item", $item)));
+        "tag" => rest::url("tag", $tag),
+        "item" => rest::url("item", $item)));
   }
 
   static function delete($request) {
@@ -37,7 +37,7 @@ class tag_item_rest_Core {
     list ($tag_id, $item_id) = split(",", $tuple);
     $tag = ORM::factory("tag", $tag_id);
     $item = ORM::factory("item", $item_id);
-    if (!$tag->loaded() || !$item->loaded() || !$tag->has($item)) {
+    if (!$tag->loaded() || !$item->loaded() || !$tag->has($item) || !access::can("view", $item)) {
       throw new Kohana_404_Exception();
     }
 
diff --git a/modules/tag/helpers/tag_items_rest.php b/modules/tag/helpers/tag_items_rest.php
index ef563ac6..18973ebb 100644
--- a/modules/tag/helpers/tag_items_rest.php
+++ b/modules/tag/helpers/tag_items_rest.php
@@ -37,12 +37,16 @@ class tag_items_rest_Core {
     $item = rest::resolve($request->params->item);
     access::required("view", $item);
 
+    if (!$tag->loaded()) {
+      throw new Kohana_404_Exception();
+    }
+
     tag::add($item, $tag->name);
     return array(
       "url" => rest::url("tag_item", $tag, $item),
       "members" => array(
-        rest::url("tag", $tag),
-        rest::url("item", $item)));
+        "tag" => rest::url("tag", $tag),
+        "item" => rest::url("item", $item)));
   }
 
   static function delete($request) {
diff --git a/modules/tag/tests/Tag_Item_Rest_Helper_Test.php b/modules/tag/tests/Tag_Item_Rest_Helper_Test.php
index 6c49ad67..69c580f1 100644
--- a/modules/tag/tests/Tag_Item_Rest_Helper_Test.php
+++ b/modules/tag/tests/Tag_Item_Rest_Helper_Test.php
@@ -32,8 +32,8 @@ class Tag_Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $this->assert_equal_array(
       array("url" => rest::url("tag_item", $tag, item::root()),
             "members" => array(
-              rest::url("tag", $tag),
-              rest::url("item", item::root()))),
+              "tag" => rest::url("tag", $tag),
+              "item" => rest::url("item", item::root()))),
       tag_item_rest::get($request));
   }
 
-- 
cgit v1.2.3


From dcba664f74439e37cc269df0cf549a2fee552aeb Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Fri, 29 Jan 2010 20:37:48 -0800
Subject: Use ? or & as appropriate when appending output=html.

---
 modules/rest/helpers/rest.php | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/modules/rest/helpers/rest.php b/modules/rest/helpers/rest.php
index 1f95a7e7..3883794a 100644
--- a/modules/rest/helpers/rest.php
+++ b/modules/rest/helpers/rest.php
@@ -113,7 +113,11 @@ class rest_Core {
 
     $url = call_user_func_array(array($class, "url"), $args);
     if (Input::instance()->get("output") == "html") {
-      $url .= "?output=html";
+      if (strpos($url, "?") === false) {
+        $url .= "?output=html";
+      } else {
+        $url .= "&output=html";
+      }
     }
     return $url;
   }
-- 
cgit v1.2.3


From 43cb6d9b56f802a5952d16b8412f8407dd8cf3c4 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 30 Jan 2010 11:38:40 -0800
Subject: Make the error page more robust in the case where there's a failure
 early on in the framework code before we can load Gallery_I18n.php

---
 modules/gallery/views/kohana/error.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/gallery/views/kohana/error.php b/modules/gallery/views/kohana/error.php
index 7271db14..26628cf2 100644
--- a/modules/gallery/views/kohana/error.php
+++ b/modules/gallery/views/kohana/error.php
@@ -1,5 +1,6 @@
 <?php defined("SYSPATH") or die("No direct script access.") ?>
 <? $error_id = uniqid("error") ?>
+<? if (!function_exists("t")) { function t($msg) { return $msg; } } ?>
 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
   <head>
     <style type="text/css">
@@ -131,7 +132,7 @@
   </head>
   <body>
     <? try { $user = identity::active_user(); } catch (Exception $e) { } ?>
-    <? $admin = php_sapi_name() == "cli" || isset($user) && $user->admin ?>
+    <? $admin = php_sapi_name() == "cli" || (class_exists("User_Model") && isset($user) && $user->admin) ?>
     <div class="big_box" id="framework_error">
       <h1>
         <?= t("Dang...  Something went wrong!") ?>
-- 
cgit v1.2.3


From 923a515ffb33d0ba15730ef4716f8ffe45cf19fa Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 30 Jan 2010 11:48:43 -0800
Subject: The user must have some edit permission somewhere to create a tag

---
 modules/tag/helpers/tags_rest.php | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/modules/tag/helpers/tags_rest.php b/modules/tag/helpers/tags_rest.php
index 89ff0f21..ac0eb81d 100644
--- a/modules/tag/helpers/tags_rest.php
+++ b/modules/tag/helpers/tags_rest.php
@@ -28,10 +28,18 @@ class tags_rest_Core {
   }
 
   static function post($request) {
-    // @todo: what permission should be required to create a tag here?
-    // for now, require edit at the top level.  Perhaps later, just require any edit perms,
-    // anywhere in the gallery?
-    access::required("edit", item::root());
+    // The user must have some edit permission somewhere to create a tag.
+    if (!identity::active_user()->admin) {
+      $query = db::build()->from("access_caches")->and_open();
+      foreach (identity::active_user()->groups() as $group) {
+        $query->or_where("edit_{$group->id}", "=", access::ALLOW);
+      }
+      $has_any_edit_perm = $query->close()->count_records();
+
+      if (!$has_any_edit_perm) {
+        access::forbidden();
+      }
+    }
 
     if (empty($request->params->name)) {
       throw new Rest_Exception("Bad Request", 400);
-- 
cgit v1.2.3


From a161436015364a039107e767f8c4af91dbec89ed Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 30 Jan 2010 15:46:31 -0800
Subject: Remap parent_id and album_cover_item_id to and from RESTful urls.

---
 modules/gallery/helpers/item_rest.php | 39 ++++++++++++++++++++++++++++++-----
 1 file changed, 34 insertions(+), 5 deletions(-)

diff --git a/modules/gallery/helpers/item_rest.php b/modules/gallery/helpers/item_rest.php
index d5ca1456..f5056bc1 100644
--- a/modules/gallery/helpers/item_rest.php
+++ b/modules/gallery/helpers/item_rest.php
@@ -75,9 +75,20 @@ class item_rest_Core {
       $members[] = rest::url("item", $child);
     }
 
+    // Convert item ids to rest URLs for consistency
+    $entity = $item->as_array();
+    if ($tmp = $item->parent()) {
+      $entity["parent"] = rest::url("item", $tmp);
+    }
+    unset($entity["parent_id"]);
+    if ($tmp = $item->album_cover()) {
+      $entity["album_cover"] = rest::url("item", $tmp);
+    }
+    unset($entity["album_cover_id"]);
+
     return array(
       "url" => $request->url,
-      "entity" => $item->as_array(),
+      "entity" => $entity,
       "members" => $members,
       "relationships" => rest::relationships("item", $item));
   }
@@ -89,13 +100,31 @@ class item_rest_Core {
     $params = $request->params;
 
     // Only change fields from a whitelist.
-    foreach (array("album_cover_item_id", "captured", "description",
-                   "height", "mime_type", "name", "parent_id", "rand_key", "resize_dirty",
+    foreach (array("album_cover", "captured", "description",
+                   "height", "mime_type", "name", "parent", "rand_key", "resize_dirty",
                    "resize_height", "resize_width", "slug", "sort_column", "sort_order",
                    "thumb_dirty", "thumb_height", "thumb_width", "title", "view_count",
                    "weight", "width") as $key) {
-      if (property_exists($request->params, $key)) {
-        $item->$key = $request->params->$key;
+      switch ($key) {
+      case "album_cover":
+        if (property_exists($request->params, "album_cover")) {
+          $album_cover_item = rest::resolve($request->params->album_cover);
+          access::required("view", $album_cover_item);
+          $item->album_cover_item_id = $album_cover_item->id;
+        }
+        break;
+
+      case "parent":
+        if (property_exists($request->params, "parent")) {
+          $parent = rest::resolve($request->params->parent);
+          access::required("edit", $parent);
+          $item->parent_id = $parent->id;
+        }
+        break;
+      default:
+        if (property_exists($request->params, $key)) {
+          $item->$key = $request->params->$key;
+        }
       }
     }
     $item->save();
-- 
cgit v1.2.3


From 10e208ea5c1a98d509a520a5bd2cbd407ae2268a Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 30 Jan 2010 16:05:20 -0800
Subject: Fix #992: Digibug pops up a blank page and doesn't allow printing

form::hidden() changed in K24 breaking this.  Also fixed the spelling
of "$order_params"
---
 modules/digibug/controllers/digibug.php     | 2 +-
 modules/digibug/views/digibug_form.html.php | 6 ++++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/modules/digibug/controllers/digibug.php b/modules/digibug/controllers/digibug.php
index 6e6009db..e3b06196 100644
--- a/modules/digibug/controllers/digibug.php
+++ b/modules/digibug/controllers/digibug.php
@@ -36,7 +36,7 @@ class Digibug_Controller extends Controller {
     }
 
     $v = new View("digibug_form.html");
-    $v->order_parms = array(
+    $v->order_params = array(
       "digibug_api_version" => "100",
       "company_id" => module::get_var("digibug", "company_id"),
       "event_id" => module::get_var("digibug", "event_id"),
diff --git a/modules/digibug/views/digibug_form.html.php b/modules/digibug/views/digibug_form.html.php
index f7b34e16..af5a88b4 100644
--- a/modules/digibug/views/digibug_form.html.php
+++ b/modules/digibug/views/digibug_form.html.php
@@ -2,10 +2,12 @@
 <html>
   <body>
     <?= form::open("http://www.digibug.com/dapi/order.php") ?>
-    <?= form::hidden($order_parms) ?>
+    <? foreach ($order_params as $key => $value): ?>
+    <?= form::hidden($key, $value) ?>
+    <? endforeach ?>
     </form>
     <script type="text/javascript">
-      document.forms[0].submit();
+     document.forms[0].submit();
     </script>
   </body>
 </html>
-- 
cgit v1.2.3


From dccb2b73ffe205e359eeea57e4c7c52e584eccc5 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 30 Jan 2010 16:19:00 -0800
Subject: Dump out validation errors so that we have some extra information in
 the logs.

---
 modules/gallery/libraries/MY_Kohana_Exception.php | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/modules/gallery/libraries/MY_Kohana_Exception.php b/modules/gallery/libraries/MY_Kohana_Exception.php
index dd5998a1..1c40091a 100644
--- a/modules/gallery/libraries/MY_Kohana_Exception.php
+++ b/modules/gallery/libraries/MY_Kohana_Exception.php
@@ -28,4 +28,11 @@ class Kohana_Exception extends Kohana_Exception_Core {
       $e->getFile(), $e->getLine(),
       $e->getTraceAsString());
   }
+
+  public static function handle(Exception $e) {
+    if ($e instanceof ORM_Validation_Exception) {
+      Kohana_Log::add("error", "Validation errors: " . print_r($e->validation->errors(), 1));
+    }
+    return parent::handle($e);
+  }
 }
\ No newline at end of file
-- 
cgit v1.2.3


From 69897b4c66e22607162ba8a1ae8c95c8f616f03a Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 30 Jan 2010 16:20:44 -0800
Subject: Fix the valid_admin code -- it was considering all non-admins
 invalid. Fixes ticket #997 (highest prime under 1000!)

---
 modules/user/models/user.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/user/models/user.php b/modules/user/models/user.php
index 0cd634ea..baac9315 100644
--- a/modules/user/models/user.php
+++ b/modules/user/models/user.php
@@ -148,7 +148,8 @@ class User_Model extends ORM implements User_Definition {
    * Validate the admin bit.
    */
   public function valid_admin(Validation $v, $field) {
-    if ($this->id == identity::active_user()->id && !$this->admin) {
+    $active = identity::active_user();
+    if ($this->id == $active->id && $active->admin && !$this->admin) {
       $v->add_error("admin", "locked");
     }
   }
-- 
cgit v1.2.3


From 86fd81ef2661718914e1d4eb63108a864b6ac14c Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 30 Jan 2010 17:41:48 -0800
Subject: Make url::merge() function use the same exact definition as
 url_Core::merge()

---
 modules/gallery/helpers/MY_url.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/gallery/helpers/MY_url.php b/modules/gallery/helpers/MY_url.php
index 8a7909b6..323cae37 100644
--- a/modules/gallery/helpers/MY_url.php
+++ b/modules/gallery/helpers/MY_url.php
@@ -93,8 +93,8 @@ class url extends url_Core {
   /**
    * Just like url::merge except that it escapes any XSS in the path.
    */
-  static function merge($params) {
-    return htmlspecialchars(parent::merge($params));
+  static function merge(array $arguments) {
+    return htmlspecialchars(parent::merge($arguments));
   }
 
   /**
-- 
cgit v1.2.3


From 2bfcec9620814a6f3d0163a174d7ba90efef369d Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 30 Jan 2010 19:48:57 -0800
Subject: Prevent brute force login attacks by reducing login attempts to 1 per
 minute after there have been 5 consecutive failed login attempts.

Fix for ticket #589.
---
 modules/gallery/controllers/login.php         |  7 ++---
 modules/gallery/helpers/auth.php              | 45 ++++++++++++++++++++++++++-
 modules/gallery/helpers/gallery_event.php     |  5 +++
 modules/gallery/helpers/gallery_installer.php | 22 ++++++++++++-
 modules/gallery/models/failed_login.php       | 20 ++++++++++++
 modules/gallery/module.info                   |  3 +-
 6 files changed, 94 insertions(+), 8 deletions(-)
 create mode 100644 modules/gallery/models/failed_login.php

diff --git a/modules/gallery/controllers/login.php b/modules/gallery/controllers/login.php
index cfe86cfb..1426f0d8 100644
--- a/modules/gallery/controllers/login.php
+++ b/modules/gallery/controllers/login.php
@@ -62,11 +62,10 @@ class Login_Controller extends Controller {
     if ($valid) {
       $user = identity::lookup_user_by_name($form->login->inputs["name"]->value);
       if (empty($user) || !identity::is_correct_password($user, $form->login->password->value)) {
-        log::warning(
-          "user",
-          t("Failed login for %name",
-            array("name" => $form->login->inputs["name"]->value)));
         $form->login->inputs["name"]->add_error("invalid_login", 1);
+        $name = $form->login->inputs["name"]->value;
+        log::warning("user", t("Failed login for %name", array("name" => $name)));
+        module::event("user_login_failed", $name);
         $valid = false;
       }
     }
diff --git a/modules/gallery/helpers/auth.php b/modules/gallery/helpers/auth.php
index f7d4f7e8..e112f127 100644
--- a/modules/gallery/helpers/auth.php
+++ b/modules/gallery/helpers/auth.php
@@ -22,7 +22,10 @@ class auth_Core {
     $form = new Forge($url, "", "post", array("id" => "g-login-form"));
     $form->set_attr('class', "g-narrow");
     $group = $form->group("login")->label(t("Login"));
-    $group->input("name")->label(t("Username"))->id("g-username")->class(null);
+    $group->input("name")->label(t("Username"))->id("g-username")->class(null)
+      ->callback("auth::validate_too_many_failed_logins")
+      ->error_messages(
+        "too_many_failed_logins", t("Too many failed login attempts.  Try again later"));
     $group->password("password")->label(t("Password"))->id("g-password")->class(null);
     $group->inputs["name"]->error_messages("invalid_login", t("Invalid name or password"));
     $group->submit("")->value(t("Login"));
@@ -55,4 +58,44 @@ class auth_Core {
                 array("url" => user_profile::url($user->id),
                       "user_name" => html::clean($user->name))));
   }
+
+  /**
+   * After there have been 5 failed login attempts, any failure leads to getting locked out for a
+   * minute.
+   */
+  static function validate_too_many_failed_logins($name_input) {
+    $failed_login = ORM::factory("failed_login")
+      ->where("name", "=", $name_input->value)
+      ->find();
+    if ($failed_login->loaded() &&
+        $failed_login->count > 5 &&
+        (time() - $failed_login->time < 60)) {
+      $name_input->add_error("too_many_failed_logins", 1);
+    }
+  }
+
+  /**
+   * Record a failed login for this user
+   */
+  static function record_failed_login($name) {
+    $failed_login = ORM::factory("failed_login")
+      ->where("name", "=", $name)
+      ->find();
+    if (!$failed_login->loaded()) {
+      $failed_login->name = $name;
+    }
+    $failed_login->time = time();
+    $failed_login->count++;
+    $failed_login->save();
+  }
+
+  /**
+   * Clear any failed logins for this user
+   */
+  static function record_successful_login($user) {
+    db::build()
+      ->delete("failed_logins")
+      ->where("name", "=", $user->name)
+      ->execute();
+  }
 }
\ No newline at end of file
diff --git a/modules/gallery/helpers/gallery_event.php b/modules/gallery/helpers/gallery_event.php
index 80452276..6479e2c3 100644
--- a/modules/gallery/helpers/gallery_event.php
+++ b/modules/gallery/helpers/gallery_event.php
@@ -110,6 +110,11 @@ class gallery_event_Core {
       graphics::choose_default_toolkit();
       module::clear_var("gallery", "choose_default_tookit");
     }
+    auth::record_successful_login($user);
+  }
+
+  static function user_login_failed($name) {
+    auth::record_failed_login($name);
   }
 
   static function item_index_data($item, $data) {
diff --git a/modules/gallery/helpers/gallery_installer.php b/modules/gallery/helpers/gallery_installer.php
index d2378d64..cf701ed4 100644
--- a/modules/gallery/helpers/gallery_installer.php
+++ b/modules/gallery/helpers/gallery_installer.php
@@ -42,6 +42,14 @@ class gallery_installer {
                 KEY (`tags`))
                 DEFAULT CHARSET=utf8;");
 
+    $db->query("CREATE TABLE {failed_logins} (
+                `id` int(9) NOT NULL auto_increment,
+                `count` int(9) NOT NULL,
+                `name` varchar(255) NOT NULL,
+                `time` int(9) NOT NULL,
+                PRIMARY KEY (`id`))
+                DEFAULT CHARSET=utf8;");
+
     $db->query("CREATE TABLE {graphics_rules} (
                  `id` int(9) NOT NULL auto_increment,
                  `active` BOOLEAN default 0,
@@ -276,7 +284,7 @@ class gallery_installer {
     // @todo this string needs to be picked up by l10n_scanner
     module::set_var("gallery", "credits", "Powered by <a href=\"%url\">Gallery %version</a>");
     module::set_var("gallery", "simultaneous_upload_limit", 5);
-    module::set_version("gallery", 22);
+    module::set_version("gallery", 23);
   }
 
   static function upgrade($version) {
@@ -485,6 +493,17 @@ class gallery_installer {
       }
       module::set_version("gallery", $version = 23);
     }
+
+    if ($version = 23) {
+      $db->query("CREATE TABLE {failed_logins} (
+                  `id` int(9) NOT NULL auto_increment,
+                  `count` int(9) NOT NULL,
+                  `name` varchar(255) NOT NULL,
+                  `time` int(9) NOT NULL,
+                  PRIMARY KEY (`id`))
+                  DEFAULT CHARSET=utf8;");
+      module::set_version("gallery", $version = 24);
+    }
   }
 
   static function uninstall() {
@@ -493,6 +512,7 @@ class gallery_installer {
     $db->query("DROP TABLE IF EXISTS {access_intents}");
     $db->query("DROP TABLE IF EXISTS {graphics_rules}");
     $db->query("DROP TABLE IF EXISTS {incoming_translations}");
+    $db->query("DROP TABLE IF EXISTS {failed_logins}");
     $db->query("DROP TABLE IF EXISTS {items}");
     $db->query("DROP TABLE IF EXISTS {logs}");
     $db->query("DROP TABLE IF EXISTS {modules}");
diff --git a/modules/gallery/models/failed_login.php b/modules/gallery/models/failed_login.php
new file mode 100644
index 00000000..0b84c295
--- /dev/null
+++ b/modules/gallery/models/failed_login.php
@@ -0,0 +1,20 @@
+<?php defined("SYSPATH") or die("No direct script access.");
+/**
+ * Gallery - a web based photo album viewer and editor
+ * Copyright (C) 2000-2009 Bharat Mediratta
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or (at
+ * your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+class Failed_Login_Model extends ORM {}
diff --git a/modules/gallery/module.info b/modules/gallery/module.info
index ee169cf1..5d0dd3c5 100644
--- a/modules/gallery/module.info
+++ b/modules/gallery/module.info
@@ -1,4 +1,3 @@
 name = "Gallery 3"
 description = "Gallery core application"
-version = 23
-
+version = 24
-- 
cgit v1.2.3


From c8a8097ef2ebbb78d7d20b99f1ea2af3da946bca Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 30 Jan 2010 20:40:28 -0800
Subject: Gallery module version 23, with the failed_logins table.

---
 installer/install.sql | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/installer/install.sql b/installer/install.sql
index a5eec229..e64a961e 100644
--- a/installer/install.sql
+++ b/installer/install.sql
@@ -74,6 +74,17 @@ CREATE TABLE {comments} (
   PRIMARY KEY  (`id`)
 ) DEFAULT CHARSET=utf8;
 SET character_set_client = @saved_cs_client;
+DROP TABLE IF EXISTS {failed_logins};
+SET @saved_cs_client     = @@character_set_client;
+SET character_set_client = utf8;
+CREATE TABLE {failed_logins} (
+  `id` int(9) NOT NULL auto_increment,
+  `count` int(9) NOT NULL,
+  `name` varchar(255) NOT NULL,
+  `time` int(9) NOT NULL,
+  PRIMARY KEY  (`id`)
+) DEFAULT CHARSET=utf8;
+SET character_set_client = @saved_cs_client;
 DROP TABLE IF EXISTS {graphics_rules};
 SET @saved_cs_client     = @@character_set_client;
 SET character_set_client = utf8;
@@ -228,7 +239,7 @@ CREATE TABLE {modules} (
   UNIQUE KEY `name` (`name`)
 ) AUTO_INCREMENT=10 DEFAULT CHARSET=utf8;
 SET character_set_client = @saved_cs_client;
-INSERT INTO {modules} VALUES (1,1,'gallery',22);
+INSERT INTO {modules} VALUES (1,1,'gallery',23);
 INSERT INTO {modules} VALUES (2,1,'user',2);
 INSERT INTO {modules} VALUES (3,1,'comment',2);
 INSERT INTO {modules} VALUES (4,1,'organize',1);
-- 
cgit v1.2.3


From 79a1365991557d64776110b0a3a99ea42b1a70fe Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 30 Jan 2010 20:43:53 -0800
Subject: Don't override the password in the database if it's empty in the
 form. Fixes ticket #995.

---
 modules/user/controllers/admin_users.php | 4 +++-
 modules/user/controllers/users.php       | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/modules/user/controllers/admin_users.php b/modules/user/controllers/admin_users.php
index 1b0e48a4..c11b0596 100644
--- a/modules/user/controllers/admin_users.php
+++ b/modules/user/controllers/admin_users.php
@@ -112,7 +112,9 @@ class Admin_Users_Controller extends Admin_Controller {
       $valid = $form->validate();
       $user->name = $form->edit_user->inputs["name"]->value;
       $user->full_name = $form->edit_user->full_name->value;
-      $user->password = $form->edit_user->password->value;
+      if ($form->edit_user->password->value) {
+        $user->password = $form->edit_user->password->value;
+      }
       $user->email = $form->edit_user->email->value;
       $user->url = $form->edit_user->url->value;
       $user->locale = $form->edit_user->locale->value;
diff --git a/modules/user/controllers/users.php b/modules/user/controllers/users.php
index ede1f0de..d0c67dd1 100644
--- a/modules/user/controllers/users.php
+++ b/modules/user/controllers/users.php
@@ -29,7 +29,9 @@ class Users_Controller extends Controller {
     try {
       $valid = $form->validate();
       $user->full_name = $form->edit_user->full_name->value;
-      $user->password = $form->edit_user->password->value;
+      if ($form->edit_user->password->value) {
+        $user->password = $form->edit_user->password->value;
+      }
       $user->email = $form->edit_user->email->value;
       $user->url = $form->edit_user->url->value;
 
-- 
cgit v1.2.3


From c2a7a6a4e7b492c649462c1bb4e60c033819803e Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 30 Jan 2010 21:07:03 -0800
Subject: Lock down web access to var/uploads, var/tmp and var/logs using
 .htaccess

Fixes ticket #587.
---
 modules/gallery/helpers/gallery_installer.php | 22 ++++++++++++++++++++--
 modules/gallery/module.info                   |  2 +-
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/modules/gallery/helpers/gallery_installer.php b/modules/gallery/helpers/gallery_installer.php
index cf701ed4..bffef8e6 100644
--- a/modules/gallery/helpers/gallery_installer.php
+++ b/modules/gallery/helpers/gallery_installer.php
@@ -204,6 +204,9 @@ class gallery_installer {
 
     foreach (array("albums", "logs", "modules", "resizes", "thumbs", "tmp", "uploads") as $dir) {
       @mkdir(VARPATH . $dir);
+      if (in_array($dir, array("logs", "tmp", "uploads"))) {
+        self::_protect_directory(VARPATH . $dir);
+      }
     }
 
     access::register_permission("view", "View");
@@ -284,7 +287,7 @@ class gallery_installer {
     // @todo this string needs to be picked up by l10n_scanner
     module::set_var("gallery", "credits", "Powered by <a href=\"%url\">Gallery %version</a>");
     module::set_var("gallery", "simultaneous_upload_limit", 5);
-    module::set_version("gallery", 23);
+    module::set_version("gallery", 25);
   }
 
   static function upgrade($version) {
@@ -494,7 +497,7 @@ class gallery_installer {
       module::set_version("gallery", $version = 23);
     }
 
-    if ($version = 23) {
+    if ($version == 23) {
       $db->query("CREATE TABLE {failed_logins} (
                   `id` int(9) NOT NULL auto_increment,
                   `count` int(9) NOT NULL,
@@ -504,6 +507,13 @@ class gallery_installer {
                   DEFAULT CHARSET=utf8;");
       module::set_version("gallery", $version = 24);
     }
+
+    if ($version == 24) {
+      foreach (array("logs", "tmp", "uploads") as $dir) {
+        self::_protect_directory(VARPATH . $dir);
+      }
+      module::set_version("gallery", $version = 25);
+    }
   }
 
   static function uninstall() {
@@ -528,4 +538,12 @@ class gallery_installer {
       system("/bin/rm -rf " . VARPATH . $entry);
     }
   }
+
+  static function _protect_directory($dir) {
+    $fp = @fopen("$dir/.htaccess", "w+");
+    fwrite($fp, "DirectoryIndex .htaccess\nSetHandler Gallery_Security_Do_Not_Remove\n" .
+           "Options None\n<IfModule mod_rewrite.c>\nRewriteEngine off\n</IfModule>\n" .
+           "Order allow,deny\nDeny from all\n");
+    fclose($fp);
+  }
 }
diff --git a/modules/gallery/module.info b/modules/gallery/module.info
index 5d0dd3c5..50a1505f 100644
--- a/modules/gallery/module.info
+++ b/modules/gallery/module.info
@@ -1,3 +1,3 @@
 name = "Gallery 3"
 description = "Gallery core application"
-version = 24
+version = 25
-- 
cgit v1.2.3


From cb92e58d40bfa866c07b10fe189bd653074a9917 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 30 Jan 2010 21:16:47 -0800
Subject: Update install.sql -- gallery version jumps from 23 to 25 due to a
 mistake in the version 24 upgrade code.

Update packager to serialize files so that we can serialize the new
.htaccess files

Update init_var.php to include the newly serialized .htaccess files.

Fixes ticket #587.
---
 installer/init_var.php                   | 3 +++
 installer/install.sql                    | 2 +-
 modules/gallery/controllers/packager.php | 9 ++++++---
 3 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/installer/init_var.php b/installer/init_var.php
index c010888c..353665a3 100755
--- a/installer/init_var.php
+++ b/installer/init_var.php
@@ -7,3 +7,6 @@
 !file_exists(VARPATH . "thumbs") && mkdir(VARPATH . "thumbs");
 !file_exists(VARPATH . "tmp") && mkdir(VARPATH . "tmp");
 !file_exists(VARPATH . "uploads") && mkdir(VARPATH . "uploads");
+file_put_contents(VARPATH . "logs/.htaccess", base64_decode("RGlyZWN0b3J5SW5kZXggLmh0YWNjZXNzClNldEhhbmRsZXIgR2FsbGVyeV9TZWN1cml0eV9Eb19Ob3RfUmVtb3ZlCk9wdGlvbnMgTm9uZQo8SWZNb2R1bGUgbW9kX3Jld3JpdGUuYz4KUmV3cml0ZUVuZ2luZSBvZmYKPC9JZk1vZHVsZT4KT3JkZXIgYWxsb3csZGVueQpEZW55IGZyb20gYWxsCg=="));
+file_put_contents(VARPATH . "tmp/.htaccess", base64_decode("RGlyZWN0b3J5SW5kZXggLmh0YWNjZXNzClNldEhhbmRsZXIgR2FsbGVyeV9TZWN1cml0eV9Eb19Ob3RfUmVtb3ZlCk9wdGlvbnMgTm9uZQo8SWZNb2R1bGUgbW9kX3Jld3JpdGUuYz4KUmV3cml0ZUVuZ2luZSBvZmYKPC9JZk1vZHVsZT4KT3JkZXIgYWxsb3csZGVueQpEZW55IGZyb20gYWxsCg=="));
+file_put_contents(VARPATH . "uploads/.htaccess", base64_decode("RGlyZWN0b3J5SW5kZXggLmh0YWNjZXNzClNldEhhbmRsZXIgR2FsbGVyeV9TZWN1cml0eV9Eb19Ob3RfUmVtb3ZlCk9wdGlvbnMgTm9uZQo8SWZNb2R1bGUgbW9kX3Jld3JpdGUuYz4KUmV3cml0ZUVuZ2luZSBvZmYKPC9JZk1vZHVsZT4KT3JkZXIgYWxsb3csZGVueQpEZW55IGZyb20gYWxsCg=="));
diff --git a/installer/install.sql b/installer/install.sql
index e64a961e..20b632fa 100644
--- a/installer/install.sql
+++ b/installer/install.sql
@@ -239,7 +239,7 @@ CREATE TABLE {modules} (
   UNIQUE KEY `name` (`name`)
 ) AUTO_INCREMENT=10 DEFAULT CHARSET=utf8;
 SET character_set_client = @saved_cs_client;
-INSERT INTO {modules} VALUES (1,1,'gallery',23);
+INSERT INTO {modules} VALUES (1,1,'gallery',25);
 INSERT INTO {modules} VALUES (2,1,'user',2);
 INSERT INTO {modules} VALUES (3,1,'comment',2);
 INSERT INTO {modules} VALUES (4,1,'organize',1);
diff --git a/modules/gallery/controllers/packager.php b/modules/gallery/controllers/packager.php
index cb64f1bf..66626483 100644
--- a/modules/gallery/controllers/packager.php
+++ b/modules/gallery/controllers/packager.php
@@ -164,7 +164,7 @@ class Packager_Controller extends Controller {
     foreach($objects as $name => $file){
       if ($file->getBasename() == "database.php") {
         continue;
-      } else if (basename($file->getPath()) == "logs") {
+      } else if (basename($file->getPath()) == "logs" && $file->getBasename() != ".htaccess") {
         continue;
       }
 
@@ -172,8 +172,8 @@ class Packager_Controller extends Controller {
         $paths[] = "VARPATH . \"" . substr($name, strlen(VARPATH)) . "\"";
       } else {
         // @todo: serialize non-directories
-        print "IGNORING FILE: $name\n";
-        return;
+        $files["VARPATH . \"" . substr($name, strlen(VARPATH)) . "\""] =
+          base64_encode(file_get_contents($name));
       }
     }
     // Sort the paths so that the var file is stable
@@ -185,6 +185,9 @@ class Packager_Controller extends Controller {
     foreach ($paths as $path) {
       fwrite($fd, "!file_exists($path) && mkdir($path);\n");
     }
+    foreach ($files as $file => $contents) {
+      fwrite($fd, "file_put_contents($file, base64_decode(\"$contents\"));\n");
+    }
     fclose($fd);
   }
 }
\ No newline at end of file
-- 
cgit v1.2.3


From 1470b99d1facd07fcb46c0c4e46896d339f5a75a Mon Sep 17 00:00:00 2001
From: Andy Staudacher <andy.st@gmail.com>
Date: Sat, 30 Jan 2010 21:42:57 -0800
Subject: Protect REST login controller from brute force attacks too. And make
 the REST auth token less predictable by using a better source for randomness.

---
 modules/gallery/helpers/auth.php  | 9 +++++++--
 modules/rest/controllers/rest.php | 7 +++++++
 modules/rest/helpers/rest.php     | 2 +-
 3 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/modules/gallery/helpers/auth.php b/modules/gallery/helpers/auth.php
index e112f127..8c7a0b6d 100644
--- a/modules/gallery/helpers/auth.php
+++ b/modules/gallery/helpers/auth.php
@@ -64,14 +64,19 @@ class auth_Core {
    * minute.
    */
   static function validate_too_many_failed_logins($name_input) {
+    $name = is_object($name_input) ? $name_input->value : $name_input;
     $failed_login = ORM::factory("failed_login")
-      ->where("name", "=", $name_input->value)
+      ->where("name", "=", $name)
       ->find();
     if ($failed_login->loaded() &&
         $failed_login->count > 5 &&
         (time() - $failed_login->time < 60)) {
-      $name_input->add_error("too_many_failed_logins", 1);
+      if (is_object($name_input)) {
+        $name_input->add_error("too_many_failed_logins", 1);
+      }
+      return false;
     }
+    return true;
   }
 
   /**
diff --git a/modules/rest/controllers/rest.php b/modules/rest/controllers/rest.php
index ba996b84..64a548d0 100644
--- a/modules/rest/controllers/rest.php
+++ b/modules/rest/controllers/rest.php
@@ -22,11 +22,18 @@ class Rest_Controller extends Controller {
     $username = Input::instance()->post("user");
     $password = Input::instance()->post("password");
 
+    if (empty($username) || !auth::validate_too_many_failed_logins($username)) {
+      throw new Rest_Exception("Forbidden", 403);
+    }
+
     $user = identity::lookup_user_by_name($username);
     if (empty($user) || !identity::is_correct_password($user, $password)) {
+      module::event("user_login_failed", $username);
       throw new Rest_Exception("Forbidden", 403);
     }
 
+    auth::login($user);
+
     $key = rest::get_access_token($user->id);
     rest::reply($key->access_key);
  }
diff --git a/modules/rest/helpers/rest.php b/modules/rest/helpers/rest.php
index 3883794a..b3f80a55 100644
--- a/modules/rest/helpers/rest.php
+++ b/modules/rest/helpers/rest.php
@@ -64,7 +64,7 @@ class rest_Core {
 
     if (!$key->loaded()) {
       $key->user_id = $user_id;
-      $key->access_key = md5(rand());
+      $key->access_key = md5(md5(uniqid(mt_rand(), true) . access::private_key()));
       $key->save();
     }
     return $key;
-- 
cgit v1.2.3


From d92ee7954efbf531b40ddd484f76cdfe16c0e53f Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 30 Jan 2010 23:15:18 -0800
Subject: Refactory auth::too_many_failed_logins() out of
 auth::validate_too_many_failed_logins() to conceptually separate the two.

---
 modules/gallery/helpers/auth.php  | 19 +++++++++----------
 modules/rest/controllers/rest.php |  2 +-
 2 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/modules/gallery/helpers/auth.php b/modules/gallery/helpers/auth.php
index 8c7a0b6d..16f8915a 100644
--- a/modules/gallery/helpers/auth.php
+++ b/modules/gallery/helpers/auth.php
@@ -63,20 +63,19 @@ class auth_Core {
    * After there have been 5 failed login attempts, any failure leads to getting locked out for a
    * minute.
    */
-  static function validate_too_many_failed_logins($name_input) {
-    $name = is_object($name_input) ? $name_input->value : $name_input;
+  static function too_many_failed_logins($name) {
     $failed_login = ORM::factory("failed_login")
       ->where("name", "=", $name)
       ->find();
-    if ($failed_login->loaded() &&
-        $failed_login->count > 5 &&
-        (time() - $failed_login->time < 60)) {
-      if (is_object($name_input)) {
-        $name_input->add_error("too_many_failed_logins", 1);
-      }
-      return false;
+    return ($failed_login->loaded() &&
+            $failed_login->count > 5 &&
+            (time() - $failed_login->time < 60));
+  }
+
+  static function validate_too_many_failed_logins($name_input) {
+    if (self::too_many_failed_logins($name_input->value)) {
+      $name_input->add_error("too_many_failed_logins", 1);
     }
-    return true;
   }
 
   /**
diff --git a/modules/rest/controllers/rest.php b/modules/rest/controllers/rest.php
index 64a548d0..9141d6d4 100644
--- a/modules/rest/controllers/rest.php
+++ b/modules/rest/controllers/rest.php
@@ -22,7 +22,7 @@ class Rest_Controller extends Controller {
     $username = Input::instance()->post("user");
     $password = Input::instance()->post("password");
 
-    if (empty($username) || !auth::validate_too_many_failed_logins($username)) {
+    if (empty($username) || auth::too_many_failed_logins($username)) {
       throw new Rest_Exception("Forbidden", 403);
     }
 
-- 
cgit v1.2.3


From 69636955695476622b7f3019922afff14ea66380 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 30 Jan 2010 23:22:53 -0800
Subject: Verified

---
 modules/gallery/tests/xss_data.txt | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/modules/gallery/tests/xss_data.txt b/modules/gallery/tests/xss_data.txt
index c2769647..65b45a08 100644
--- a/modules/gallery/tests/xss_data.txt
+++ b/modules/gallery/tests/xss_data.txt
@@ -38,8 +38,7 @@ modules/comment/views/user_profile_comments.html.php         5   DIRTY_ATTR $com
 modules/comment/views/user_profile_comments.html.php         10  DIRTY_JS $comment->item()->url()
 modules/comment/views/user_profile_comments.html.php         11  DIRTY    $comment->item()->thumb_img(array(),50)
 modules/digibug/views/digibug_form.html.php                  4   DIRTY    form::open("http://www.digibug.com/dapi/order.php")
-modules/digibug/views/digibug_form.html.php                  5   DIRTY    form::hidden($order_parms)
-modules/digibug/views/digibug_form.html.php                  6   DIRTY    form::close()
+modules/digibug/views/digibug_form.html.php                  6   DIRTY    form::hidden($key,$value)
 modules/exif/views/exif_dialog.html.php                      14  DIRTY    $details[$i]["caption"]
 modules/exif/views/exif_dialog.html.php                      21  DIRTY    $details[$i]["caption"]
 modules/g2_import/views/admin_g2_import.html.php             30  DIRTY    $form
@@ -125,10 +124,9 @@ modules/gallery/views/form_uploadify.html.php                30  DIRTY_JS url::f
 modules/gallery/views/form_uploadify.html.php                31  DIRTY_JS url::site("simple_uploader/add_photo/{$album->id}")
 modules/gallery/views/form_uploadify.html.php                35  DIRTY_JS url::file("lib/uploadify/cancel.png")
 modules/gallery/views/form_uploadify.html.php                36  DIRTY_JS $simultaneous_upload_limit
-modules/gallery/views/in_place_edit.html.php                 2   DIRTY    form::open($action,array("method"=>"post","id"=>"g-in-place-edit-form","class"=>"g-short-form"),$hidden)
-modules/gallery/views/in_place_edit.html.php                 5   DIRTY    form::input("input",$form["input"]," class=\"textbox\"")
-modules/gallery/views/in_place_edit.html.php                 12  DIRTY    form::close()
-modules/gallery/views/in_place_edit.html.php                 14  DIRTY    $errors["input"]
+modules/gallery/views/in_place_edit.html.php                 2   DIRTY    form::open($action,array("method"=>"post","id"=>"g-in-place-edit-form","class"=>"g-short-form"))
+modules/gallery/views/in_place_edit.html.php                 3   DIRTY    access::csrf_form_field()
+modules/gallery/views/in_place_edit.html.php                 6   DIRTY    form::input("input",$form["input"]," class=\"textbox\"")
 modules/gallery/views/kohana_error_page.php                  102 DIRTY    $message
 modules/gallery/views/kohana_error_page.php                  116 DIRTY    $trace
 modules/gallery/views/kohana_profiler.php                    32  DIRTY    $profile->render();
@@ -219,8 +217,8 @@ modules/gallery/views/upgrader.html.php                      77  DIRTY    $modul
 modules/gallery/views/upgrader.html.php                      99  DIRTY_ATTR $done?"muted":""
 modules/gallery/views/upgrader.html.php                      102 DIRTY_ATTR $done?"muted":""
 modules/gallery/views/user_languages_block.html.php          2   DIRTY    form::dropdown("g-select-session-locale",$installed_locales,$selected)
-modules/gallery/views/user_profile.html.php                  35  DIRTY_ATTR $user->avatar_url(40,$theme->url(,true))
-modules/gallery/views/user_profile.html.php                  46  DIRTY    $info->view
+modules/gallery/views/user_profile.html.php                  36  DIRTY_ATTR $user->avatar_url(40,$theme->url(,true))
+modules/gallery/views/user_profile.html.php                  47  DIRTY    $info->view
 modules/image_block/views/image_block_block.html.php         3   DIRTY_JS $item->url()
 modules/image_block/views/image_block_block.html.php         4   DIRTY    $item->thumb_img(array("class"=>"g-thumbnail"))
 modules/info/views/info_block.html.php                       22  DIRTY    date("M j, Y H:i:s",$item->captured)
-- 
cgit v1.2.3


From d29028c4ea9002ac036a89a4478fb4640c86fedb Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 30 Jan 2010 23:36:11 -0800
Subject: Add Item_Model::as_restful_array() for convenience.

---
 modules/gallery/models/item.php           | 17 +++++++++++++++++
 modules/gallery/tests/Item_Model_Test.php | 12 ++++++++++++
 2 files changed, 29 insertions(+)

diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php
index ae6e4cc9..fd121a5a 100644
--- a/modules/gallery/models/item.php
+++ b/modules/gallery/models/item.php
@@ -914,4 +914,21 @@ class Item_Model extends ORM_MPTT {
       $v->add_error($field, "read_only");
     }
   }
+
+  /**
+   * Same as ORM::as_array() but convert id fields into their RESTful form.
+   */
+  public function as_restful_array() {
+    // Convert item ids to rest URLs for consistency
+    $data = $this->as_array();
+    if ($tmp = $this->parent()) {
+      $data["parent"] = rest::url("item", $tmp);
+    }
+    unset($data["parent_id"]);
+    if ($tmp = $this->album_cover()) {
+      $data["album_cover"] = rest::url("item", $tmp);
+    }
+    unset($data["album_cover_item_id"]);
+    return $data;
+  }
 }
diff --git a/modules/gallery/tests/Item_Model_Test.php b/modules/gallery/tests/Item_Model_Test.php
index eb9ecc99..9f632fb5 100644
--- a/modules/gallery/tests/Item_Model_Test.php
+++ b/modules/gallery/tests/Item_Model_Test.php
@@ -346,4 +346,16 @@ class Item_Model_Test extends Gallery_Unit_Test_Case {
     }
     $this->assert_true(false, "Shouldn't get here");
   }
+
+  public function as_restful_array_test() {
+    $album = test::random_album();
+    $photo = test::random_photo($album);
+    $album->reload();
+
+    $result = $album->as_restful_array();
+    $this->assert_same(rest::url("item", item::root()), $result["parent"]);
+    $this->assert_same(rest::url("item", $photo), $result["album_cover"]);
+    $this->assert_true(!array_key_exists("parent_id", $result));
+    $this->assert_true(!array_key_exists("album_cover_item_id", $result));
+  }
 }
-- 
cgit v1.2.3


From a79d20a36135d50f77a7f11046b1d7ee392d46c7 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 30 Jan 2010 23:36:41 -0800
Subject: Use Item_Model::as_restful_array() to simplify tests.

---
 modules/gallery/helpers/item_rest.php           | 13 +------------
 modules/gallery/tests/Item_Rest_Helper_Test.php | 10 +++++-----
 2 files changed, 6 insertions(+), 17 deletions(-)

diff --git a/modules/gallery/helpers/item_rest.php b/modules/gallery/helpers/item_rest.php
index f5056bc1..c0fc422a 100644
--- a/modules/gallery/helpers/item_rest.php
+++ b/modules/gallery/helpers/item_rest.php
@@ -75,20 +75,9 @@ class item_rest_Core {
       $members[] = rest::url("item", $child);
     }
 
-    // Convert item ids to rest URLs for consistency
-    $entity = $item->as_array();
-    if ($tmp = $item->parent()) {
-      $entity["parent"] = rest::url("item", $tmp);
-    }
-    unset($entity["parent_id"]);
-    if ($tmp = $item->album_cover()) {
-      $entity["album_cover"] = rest::url("item", $tmp);
-    }
-    unset($entity["album_cover_id"]);
-
     return array(
       "url" => $request->url,
-      "entity" => $entity,
+      "entity" => $item->as_restful_array(),
       "members" => $members,
       "relationships" => rest::relationships("item", $item));
   }
diff --git a/modules/gallery/tests/Item_Rest_Helper_Test.php b/modules/gallery/tests/Item_Rest_Helper_Test.php
index d91e0f58..088b1cbd 100644
--- a/modules/gallery/tests/Item_Rest_Helper_Test.php
+++ b/modules/gallery/tests/Item_Rest_Helper_Test.php
@@ -36,7 +36,7 @@ class Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $request->params = new stdClass();
     $this->assert_equal_array(
       array("url" => rest::url("item", $album1),
-            "entity" => $album1->as_array(),
+            "entity" => $album1->as_restful_array(),
             "members" => array(
               rest::url("item", $photo1),
               rest::url("item", $album2)),
@@ -50,7 +50,7 @@ class Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $request->params->scope = "direct";
     $this->assert_equal_array(
       array("url" => rest::url("item", $album1),
-            "entity" => $album1->as_array(),
+            "entity" => $album1->as_restful_array(),
             "members" => array(
               rest::url("item", $photo1),
               rest::url("item", $album2)),
@@ -64,7 +64,7 @@ class Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $request->params->scope = "all";
     $this->assert_equal_array(
       array("url" => rest::url("item", $album1),
-            "entity" => $album1->as_array(),
+            "entity" => $album1->as_restful_array(),
             "members" => array(
               rest::url("item", $photo1),
               rest::url("item", $album2),
@@ -88,7 +88,7 @@ class Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $request->params->name = "foo";
     $this->assert_equal_array(
       array("url" => rest::url("item", $album1),
-            "entity" => $album1->as_array(),
+            "entity" => $album1->as_restful_array(),
             "members" => array(
               rest::url("item", $photo2)),
             "relationships" => array(
@@ -108,7 +108,7 @@ class Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $request->params->type = "album";
     $this->assert_equal_array(
       array("url" => rest::url("item", $album1),
-            "entity" => $album1->as_array(),
+            "entity" => $album1->as_restful_array(),
             "members" => array(
               rest::url("item", $album2)),
             "relationships" => array(
-- 
cgit v1.2.3


From 359f6108b921938aa4445584b1e16c757467ae79 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 30 Jan 2010 23:42:32 -0800
Subject: Remove edit permissions across the board.

---
 modules/tag/tests/Tags_Rest_Helper_Test.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/tag/tests/Tags_Rest_Helper_Test.php b/modules/tag/tests/Tags_Rest_Helper_Test.php
index 0254adc8..a1713811 100644
--- a/modules/tag/tests/Tags_Rest_Helper_Test.php
+++ b/modules/tag/tests/Tags_Rest_Helper_Test.php
@@ -50,7 +50,8 @@ class Tags_Rest_Helper_Test extends Gallery_Unit_Test_Case {
   }
 
   public function post_fails_without_permissions_test() {
-    access::deny(identity::everybody(), "edit", item::root());
+    // We have to remove edit permissions from everywhere
+    Database::instance()->query("UPDATE {access_caches} SET edit_1=0");
     identity::set_active_user(identity::guest());
 
     try {
-- 
cgit v1.2.3


From dad537effedc51d7544e32a1b7b0ca70896d43af Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 31 Jan 2010 11:24:00 -0800
Subject: Update the timezone field to match the setting in
 system/config/locale.php.  This fixes the "date_default_timezone_set()
 [function.date-default-timezone-set]: Timezone ID '' is invalid" error.

---
 modules/gallery/config/locale.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/gallery/config/locale.php b/modules/gallery/config/locale.php
index 4789dc2b..2d401758 100644
--- a/modules/gallery/config/locale.php
+++ b/modules/gallery/config/locale.php
@@ -32,7 +32,7 @@ $config['language'] = array('en_US', 'English_United States');
  * Locale timezone. Defaults to use the server timezone.
  * @see http://php.net/timezones
  */
-$config['timezone'] = '';
+$config['timezone'] = ini_get('date.timezone');
 
 // i18n settings
 
-- 
cgit v1.2.3


From 4cd5c4cebbe80f90dd781336f9206be10113575b Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 31 Jan 2010 11:27:54 -0800
Subject: Second attempt to fix the timezone issue.  If the timezone is not set
 in phpinfo(), then force it to America/Los_Angeles for now.

---
 modules/gallery/config/locale.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/gallery/config/locale.php b/modules/gallery/config/locale.php
index 2d401758..f8241444 100644
--- a/modules/gallery/config/locale.php
+++ b/modules/gallery/config/locale.php
@@ -33,6 +33,10 @@ $config['language'] = array('en_US', 'English_United States');
  * @see http://php.net/timezones
  */
 $config['timezone'] = ini_get('date.timezone');
+if (empty($config['timezone'])) {
+  // This is a required field.  Pick something as a default.
+  $config['timezone'] = "America/Los_Angeles";
+}
 
 // i18n settings
 
-- 
cgit v1.2.3


From ee35b0a9fe16b862e6d1080fec45b539e1b41375 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 31 Jan 2010 13:10:34 -0800
Subject: Elide data that isn't useful from the REST array.

---
 modules/gallery/models/item.php | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php
index fd121a5a..083fd06b 100644
--- a/modules/gallery/models/item.php
+++ b/modules/gallery/models/item.php
@@ -929,6 +929,11 @@ class Item_Model extends ORM_MPTT {
       $data["album_cover"] = rest::url("item", $tmp);
     }
     unset($data["album_cover_item_id"]);
+
+    // Elide some internal-only data that is going to cause confusion in the client.
+    foreach (array("relative_path_cache", "relative_url_cache", "left_ptr", "right_ptr") as $key) {
+      unset($data[$key]);
+    }
     return $data;
   }
 }
-- 
cgit v1.2.3


From c5471a76a23897fcb40b3c4661ba898116dabaa7 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 31 Jan 2010 13:27:05 -0800
Subject: htaccess_works() can't use var/tmp anymore because that's locked
 down. So just create var/security_test and delete it when we're done.

---
 modules/gallery/helpers/access.php | 33 +++++++++++++++++++--------------
 1 file changed, 19 insertions(+), 14 deletions(-)

diff --git a/modules/gallery/helpers/access.php b/modules/gallery/helpers/access.php
index 10fa8666..29b981e8 100644
--- a/modules/gallery/helpers/access.php
+++ b/modules/gallery/helpers/access.php
@@ -663,23 +663,28 @@ class access_Core {
    * working and our permission system works.
    */
   static function htaccess_works() {
-    $success_url = url::file("var/tmp/security_test/success");
+    $success_url = url::file("var/security_test/success");
 
-    @mkdir(VARPATH . "tmp/security_test");
-    if ($fp = @fopen(VARPATH . "tmp/security_test/.htaccess", "w+")) {
-      fwrite($fp, "RewriteEngine On\n");
-      fwrite($fp, "RewriteRule verify $success_url [L]\n");
-      fclose($fp);
-    }
+    @mkdir(VARPATH . "security_test");
+    try {
+      if ($fp = @fopen(VARPATH . "security_test/.htaccess", "w+")) {
+        fwrite($fp, "RewriteEngine On\n");
+        fwrite($fp, "RewriteRule verify $success_url [L]\n");
+        fclose($fp);
+      }
 
-    if ($fp = @fopen(VARPATH . "tmp/security_test/success", "w+")) {
-      fwrite($fp, "success");
-      fclose($fp);
-    }
+      if ($fp = @fopen(VARPATH . "security_test/success", "w+")) {
+        fwrite($fp, "success");
+        fclose($fp);
+      }
 
-    list ($response) = remote::do_request(url::abs_file("var/tmp/security_test/verify"));
-    $works = $response == "HTTP/1.1 200 OK";
-    @dir::unlink(VARPATH . "tmp/security_test");
+      list ($response) = remote::do_request(url::abs_file("var/security_test/verify"));
+      $works = $response == "HTTP/1.1 200 OK";
+    } catch (Exception $e) {
+      @dir::unlink(VARPATH . "security_test");
+      throw $e;
+    }
+    @dir::unlink(VARPATH . "security_test");
 
     return $works;
   }
-- 
cgit v1.2.3


From 94ab9fdfeec6f3e2c8ab1a694d4fe9cfe9d8e45c Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 31 Jan 2010 14:02:00 -0800
Subject: Add a comment about error_reporting()

---
 index.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/index.php b/index.php
index 8bfbbb54..1816d7fa 100644
--- a/index.php
+++ b/index.php
@@ -27,7 +27,8 @@ version_compare(PHP_VERSION, "5.2.3", "<") and
 // Gallery requires short_tags to be on
 !ini_get("short_open_tag") and exit("Gallery requires short_open_tag to be on.");
 
-// Set the error reporting level.  Use E_ALL unless you have a special need.
+// Suppress errors.  For information on how to debug Gallery 3, see:
+// http://codex.gallery2.org/Gallery3:FAQ#How_do_I_see_debug_information.3F
 error_reporting(0);
 
 // Disabling display_errors will  effectively disable Kohana error display
-- 
cgit v1.2.3


From 225359637917aa8d3d416da78e38c45d48b6a5f0 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 31 Jan 2010 15:03:53 -0800
Subject: Remove debug code.

---
 modules/server_add/controllers/server_add.php | 1 -
 1 file changed, 1 deletion(-)

diff --git a/modules/server_add/controllers/server_add.php b/modules/server_add/controllers/server_add.php
index 2a948653..f68335df 100644
--- a/modules/server_add/controllers/server_add.php
+++ b/modules/server_add/controllers/server_add.php
@@ -42,7 +42,6 @@ class Server_Add_Controller extends Admin_Controller {
 
     // Make a tree with the parents back up to the authorized path, and all the children under the
     // current path.
-    Kohana_Log::add("error", $path);
     if (server_add::is_valid_path($path)) {
       $tree->parents[] = $path;
       while (server_add::is_valid_path(dirname($tree->parents[0]))) {
-- 
cgit v1.2.3


From c6676dd455d070aaded25f048269eee07248100a Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 31 Jan 2010 15:23:37 -0800
Subject: Remove obsolete call to _force_block_adder() which has been broken
 for over a year.

---
 modules/gallery/controllers/admin_dashboard.php | 2 --
 1 file changed, 2 deletions(-)

diff --git a/modules/gallery/controllers/admin_dashboard.php b/modules/gallery/controllers/admin_dashboard.php
index 5f2cb41d..42a3c081 100644
--- a/modules/gallery/controllers/admin_dashboard.php
+++ b/modules/gallery/controllers/admin_dashboard.php
@@ -91,7 +91,5 @@ class Admin_Dashboard_Controller extends Admin_Controller {
       }
       block_manager::set_active($location, $new_blocks);
     }
-
-    $this->_force_block_adder();
   }
 }
-- 
cgit v1.2.3


From c050acf30a7351bf0ef5b8ee206704c073e881c7 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 31 Jan 2010 16:07:41 -0800
Subject: Fix lots of warnings that pop up when we're in E_STRICT mode. 
 They're mostly issues around uninitialized variables, calling non-static
 functions in a static context, calling Session functions directly instead of
 on its singleton, passing non-variables by reference, and subclasses not
 using the same interface as the parent class.

---
 modules/comment/controllers/admin_comments.php          |  1 +
 modules/comment/helpers/comment_rss.php                 |  1 +
 modules/comment/models/comment.php                      |  3 ++-
 modules/digibug/controllers/digibug.php                 |  2 +-
 modules/forge/libraries/Form_Group.php                  |  2 +-
 modules/g2_import/controllers/admin_g2_import.php       |  5 +++++
 modules/g2_import/helpers/g2_import.php                 | 11 +++++++++++
 modules/g2_import/helpers/g2_import_task.php            | 10 ++++++++--
 modules/g2_import/views/admin_g2_import.html.php        |  2 +-
 modules/gallery/controllers/admin_modules.php           |  1 +
 modules/gallery/controllers/combined.php                |  2 +-
 modules/gallery/controllers/file_proxy.php              |  2 +-
 modules/gallery/helpers/gallery_block.php               |  2 +-
 modules/gallery/helpers/gallery_rss.php                 |  1 +
 modules/gallery/helpers/gallery_task.php                | 11 ++++++++---
 modules/gallery/helpers/graphics.php                    |  3 +++
 modules/gallery/helpers/l10n_client.php                 |  1 +
 modules/gallery/helpers/module.php                      |  3 ++-
 modules/gallery/libraries/Form_Script.php               |  4 ++--
 modules/gallery/libraries/MY_Database.php               |  2 +-
 modules/gallery/libraries/MY_View.php                   |  2 +-
 modules/gallery/libraries/ORM_MPTT.php                  |  2 +-
 modules/gallery/models/item.php                         |  2 +-
 modules/gallery/models/task.php                         |  4 ++--
 modules/gallery/tests/Database_Test.php                 |  8 ++++----
 modules/gallery/tests/Item_Rest_Helper_Test.php         | 17 +++++++++++++++++
 .../gallery_unit_test/controllers/gallery_unit_test.php |  6 +++++-
 modules/rest/controllers/rest.php                       |  1 +
 modules/rest/helpers/rest.php                           |  2 +-
 modules/rest/tests/Rest_Controller_Test.php             |  8 ++++----
 modules/search/helpers/search.php                       |  3 ++-
 modules/tag/helpers/tag_rss.php                         |  2 ++
 modules/tag/helpers/tags_rest.php                       |  1 -
 modules/tag/models/tag.php                              |  2 +-
 modules/tag/tests/Tag_Item_Rest_Helper_Test.php         |  4 +++-
 modules/tag/tests/Tag_Rest_Helper_Test.php              |  8 ++++++++
 modules/tag/tests/Tags_Rest_Helper_Test.php             |  4 ++++
 modules/user/controllers/admin_users.php                |  2 +-
 38 files changed, 111 insertions(+), 36 deletions(-)

diff --git a/modules/comment/controllers/admin_comments.php b/modules/comment/controllers/admin_comments.php
index b7dc5fb3..3dd45919 100644
--- a/modules/comment/controllers/admin_comments.php
+++ b/modules/comment/controllers/admin_comments.php
@@ -92,6 +92,7 @@ class Admin_Comments_Controller extends Admin_Controller {
   }
 
   private function _counts() {
+    $counts = new stdClass();
     $counts->unpublished = 0;
     $counts->published = 0;
     $counts->spam = 0;
diff --git a/modules/comment/helpers/comment_rss.php b/modules/comment/helpers/comment_rss.php
index 77044884..79fa07df 100644
--- a/modules/comment/helpers/comment_rss.php
+++ b/modules/comment/helpers/comment_rss.php
@@ -42,6 +42,7 @@ class comment_rss_Core {
       $comments->where("item_id", "=", $id);
     }
 
+    $feed = new stdClass();
     $feed->view = "comment.mrss";
     $feed->children = array();
     foreach ($comments->find_all($limit, $offset) as $comment) {
diff --git a/modules/comment/models/comment.php b/modules/comment/models/comment.php
index add15ce8..d9d05995 100644
--- a/modules/comment/models/comment.php
+++ b/modules/comment/models/comment.php
@@ -116,7 +116,8 @@ class Comment_Model extends ORM {
 
     // We only notify on the related items if we're making a visible change.
     if ($visible_change) {
-      module::event("item_related_update", $this->item());
+      $item = $this->item();
+      module::event("item_related_update", $item);
     }
 
     return $this;
diff --git a/modules/digibug/controllers/digibug.php b/modules/digibug/controllers/digibug.php
index e3b06196..c98ae20c 100644
--- a/modules/digibug/controllers/digibug.php
+++ b/modules/digibug/controllers/digibug.php
@@ -91,7 +91,7 @@ class Digibug_Controller extends Controller {
     }
 
     // We don't need to save the session for this request
-    Session::abort_save();
+    Session::instance()->abort_save();
 
     if (!TEST_MODE) {
       // Dump out the image
diff --git a/modules/forge/libraries/Form_Group.php b/modules/forge/libraries/Form_Group.php
index e0601321..0a04912b 100644
--- a/modules/forge/libraries/Form_Group.php
+++ b/modules/forge/libraries/Form_Group.php
@@ -80,7 +80,7 @@ class Form_Group_Core extends Forge {
 		}
 	}
 
-	public function render()
+	public function render($template = 'forge_template', $custom = FALSE)
 	{
 		// No Sir, we don't want any html today thank you
 		return;
diff --git a/modules/g2_import/controllers/admin_g2_import.php b/modules/g2_import/controllers/admin_g2_import.php
index 1c65f482..6dd155b9 100644
--- a/modules/g2_import/controllers/admin_g2_import.php
+++ b/modules/g2_import/controllers/admin_g2_import.php
@@ -19,6 +19,7 @@
  */
 class Admin_g2_import_Controller extends Admin_Controller {
   public function index() {
+    g2_import::lower_error_reporting();
     if (g2_import::is_configured()) {
       g2_import::init();
     }
@@ -31,6 +32,7 @@ class Admin_g2_import_Controller extends Admin_Controller {
     $view = new Admin_View("admin.html");
     $view->content = new View("admin_g2_import.html");
     $view->content->form = $this->_get_import_form();
+    $view->content->version = g2_import::version();
 
     if (g2_import::is_initialized()) {
       $view->content->g2_stats = $g2_stats;
@@ -38,11 +40,13 @@ class Admin_g2_import_Controller extends Admin_Controller {
       $view->content->thumb_size = module::get_var("gallery", "thumb_size");
       $view->content->resize_size = module::get_var("gallery", "resize_size");
     }
+    g2_import::restore_error_reporting();
     print $view;
   }
 
   public function save() {
     access::verify_csrf();
+    g2_import::lower_error_reporting();
 
     $form = $this->_get_import_form();
     if ($form->validate()) {
@@ -63,6 +67,7 @@ class Admin_g2_import_Controller extends Admin_Controller {
     $view = new Admin_View("admin.html");
     $view->content = new View("admin_g2_import.html");
     $view->content->form = $form;
+    g2_import::restore_error_reporting();
     print $view;
   }
 
diff --git a/modules/g2_import/helpers/g2_import.php b/modules/g2_import/helpers/g2_import.php
index fa95e547..0fcc0539 100644
--- a/modules/g2_import/helpers/g2_import.php
+++ b/modules/g2_import/helpers/g2_import.php
@@ -24,6 +24,7 @@ class g2_import_Core {
   public static $g2_base_url = null;
 
   private static $current_g2_item = null;
+  private static $error_reporting = null;
 
   static function is_configured() {
     return module::get_var("g2_import", "embed_path");
@@ -931,6 +932,16 @@ class g2_import_Core {
             "useAuthToken" => false));
     return str_replace(self::$g2_base_url, "", $url);
   }
+
+  static function lower_error_reporting() {
+    // Gallery 2 was not designed to run in E_STRICT mode and will barf out errors.  So dial down
+    // the error reporting when we make G2 calls.
+    self::$error_reporting = error_reporting(error_reporting() & ~E_STRICT);
+  }
+
+  static function restore_error_reporting() {
+    error_reporting(self::$error_reporting);
+  }
 }
 
 /**
diff --git a/modules/g2_import/helpers/g2_import_task.php b/modules/g2_import/helpers/g2_import_task.php
index e80b88b9..21ba4c3a 100644
--- a/modules/g2_import/helpers/g2_import_task.php
+++ b/modules/g2_import/helpers/g2_import_task.php
@@ -19,17 +19,19 @@
  */
 class g2_import_task_Core {
   static function available_tasks() {
+    g2_import::lower_error_reporting();
     if (g2_import::is_configured()) {
       g2_import::init();
     }
-
+    $version = g2_import::version();
+    g2_import::restore_error_reporting();
 
     if (class_exists("GalleryCoreApi")) {
       return array(Task_Definition::factory()
                    ->callback("g2_import_task::import")
                    ->name(t("Import from Gallery 2"))
                    ->description(
-                     t("Gallery %version detected", array("version" => g2_import::version())))
+                     t("Gallery %version detected", array("version" => $version)))
                    ->severity(log::SUCCESS));
     }
 
@@ -37,6 +39,8 @@ class g2_import_task_Core {
   }
 
   static function import($task) {
+    g2_import::lower_error_reporting();
+
     $start = microtime(true);
     g2_import::init();
 
@@ -207,5 +211,7 @@ class g2_import_task_Core {
     $task->set("mode", $mode);
     $task->set("queue", $queue);
     $task->set("done", $done);
+
+    g2_import::restore_error_reporting();
   }
 }
diff --git a/modules/g2_import/views/admin_g2_import.html.php b/modules/g2_import/views/admin_g2_import.html.php
index 0875e7f7..6a5214a3 100644
--- a/modules/g2_import/views/admin_g2_import.html.php
+++ b/modules/g2_import/views/admin_g2_import.html.php
@@ -34,7 +34,7 @@
       <h2> <?= t("Import") ?> </h2>
       <ul id="g-action-status" class="g-message-block">
         <li class="g-success">
-          <?= t("Gallery version %version detected", array("version" => g2_import::version())) ?>
+          <?= t("Gallery version %version detected", array("version" => $version)) ?>
         </li>
         <? if ($g2_sizes["thumb"]["size"] && $thumb_size != $g2_sizes["thumb"]["size"]): ?>
         <li class="g-warning">
diff --git a/modules/gallery/controllers/admin_modules.php b/modules/gallery/controllers/admin_modules.php
index 84fee25d..081b3f12 100644
--- a/modules/gallery/controllers/admin_modules.php
+++ b/modules/gallery/controllers/admin_modules.php
@@ -67,6 +67,7 @@ class Admin_Modules_Controller extends Admin_Controller {
   }
 
   private function _do_save() {
+    $changes = new stdClass();
     $changes->activate = array();
     $changes->deactivate = array();
     $activated_names = array();
diff --git a/modules/gallery/controllers/combined.php b/modules/gallery/controllers/combined.php
index e90a2f1a..7f3a3c7d 100644
--- a/modules/gallery/controllers/combined.php
+++ b/modules/gallery/controllers/combined.php
@@ -41,7 +41,7 @@ class Combined_Controller extends Controller {
     $input = Input::instance();
 
     // We don't need to save the session for this request
-    Session::abort_save();
+    Session::instance()->abort_save();
 
     // Our data is immutable, so if they already have a copy then it needs no updating.
     if ($input->server("HTTP_IF_MODIFIED_SINCE")) {
diff --git a/modules/gallery/controllers/file_proxy.php b/modules/gallery/controllers/file_proxy.php
index 646edf17..33952366 100644
--- a/modules/gallery/controllers/file_proxy.php
+++ b/modules/gallery/controllers/file_proxy.php
@@ -121,7 +121,7 @@ class File_Proxy_Controller extends Controller {
     expires::check(2592000, $item->updated);
 
     // We don't need to save the session for this request
-    Session::abort_save();
+    Session::instance()->abort_save();
 
     expires::set(2592000, $item->updated);  // 30 days
 
diff --git a/modules/gallery/helpers/gallery_block.php b/modules/gallery/helpers/gallery_block.php
index 9d4e81b6..be0f11b8 100644
--- a/modules/gallery/helpers/gallery_block.php
+++ b/modules/gallery/helpers/gallery_block.php
@@ -72,7 +72,7 @@ class gallery_block_Core {
       $block->content = new View("admin_block_platform.html");
       if (is_readable("/proc/loadavg")) {
         $block->content->load_average =
-          join(" ", array_slice(explode(" ", array_shift(file("/proc/loadavg"))), 0, 3));
+          join(" ", array_slice(explode(" ", current(file("/proc/loadavg"))), 0, 3));
       } else {
         $block->content->load_average = t("Unavailable");
       }
diff --git a/modules/gallery/helpers/gallery_rss.php b/modules/gallery/helpers/gallery_rss.php
index d422636f..c1790d28 100644
--- a/modules/gallery/helpers/gallery_rss.php
+++ b/modules/gallery/helpers/gallery_rss.php
@@ -25,6 +25,7 @@ class gallery_rss_Core {
   }
 
   static function feed($feed_id, $offset, $limit, $id) {
+    $feed = new stdClass();
     switch ($feed_id) {
     case "latest":
       $feed->children = ORM::factory("item")
diff --git a/modules/gallery/helpers/gallery_task.php b/modules/gallery/helpers/gallery_task.php
index c75e050a..b2f18d7c 100644
--- a/modules/gallery/helpers/gallery_task.php
+++ b/modules/gallery/helpers/gallery_task.php
@@ -111,6 +111,7 @@ class gallery_task_Core {
         site_status::clear("graphics_dirty");
       }
     } catch (Exception $e) {
+      Kohana_Log::add("error",(string)$e);
       $task->done = true;
       $task->state = "error";
       $task->status = $e->getMessage();
@@ -214,6 +215,7 @@ class gallery_task_Core {
         Cache::instance()->delete("update_l10n_cache:{$task->id}");
       }
     } catch (Exception $e) {
+      Kohana_Log::add("error",(string)$e);
       $task->done = true;
       $task->state = "error";
       $task->status = $e->getMessage();
@@ -233,10 +235,10 @@ class gallery_task_Core {
     try {
       $start = microtime(true);
       $data = Cache::instance()->get("file_cleanup_cache:{$task->id}");
-      if ($data) {
-        $files = unserialize($data);
-      }
+      $files = $data ? unserialize($data) : array();
       $i = 0;
+      $current = 0;
+      $total = 0;
 
       switch ($task->get("mode", "init")) {
       case "init":  // 0%
@@ -262,6 +264,7 @@ class gallery_task_Core {
         if (count($files) == 0) {
           break;
         }
+
       case "delete_files":
         $current = $task->get("current");
         $total = $task->get("total");
@@ -279,8 +282,10 @@ class gallery_task_Core {
       if ($total == $current) {
         $task->done = true;
         $task->state = "success";
+        $task->percent_complete = 100;
       }
     } catch (Exception $e) {
+      Kohana_Log::add("error",(string)$e);
       $task->done = true;
       $task->state = "error";
       $task->status = $e->getMessage();
diff --git a/modules/gallery/helpers/graphics.php b/modules/gallery/helpers/graphics.php
index 5a290905..c85c7750 100644
--- a/modules/gallery/helpers/graphics.php
+++ b/modules/gallery/helpers/graphics.php
@@ -262,6 +262,9 @@ class graphics_Core {
    */
   static function detect_toolkits() {
     $toolkits = new stdClass();
+    $toolkits->gd = new stdClass();
+    $toolkits->imagemagick = new stdClass();
+    $toolkits->graphicsmagick = new stdClass();
 
     // GD is special, it doesn't use exec()
     $gd = function_exists("gd_info") ? gd_info() : array();
diff --git a/modules/gallery/helpers/l10n_client.php b/modules/gallery/helpers/l10n_client.php
index 086245e8..c27e4e5b 100644
--- a/modules/gallery/helpers/l10n_client.php
+++ b/modules/gallery/helpers/l10n_client.php
@@ -77,6 +77,7 @@ class l10n_client_Core {
    *     translations for.
    */
   static function fetch_updates(&$num_fetched) {
+    $request = new stdClass();
     $request->locales = array();
     $request->messages = new stdClass();
 
diff --git a/modules/gallery/helpers/module.php b/modules/gallery/helpers/module.php
index 95e426c4..9523d1d2 100644
--- a/modules/gallery/helpers/module.php
+++ b/modules/gallery/helpers/module.php
@@ -430,7 +430,8 @@ class module_Core {
             // This could happen if there's a race condition
             continue;
           }
-          self::$var_cache->{$row->module_name}->{$row->name} = $row->value;
+          // Mute the "Creating default object from empty value" warning below
+          @self::$var_cache->{$row->module_name}->{$row->name} = $row->value;
         }
         $cache = ORM::factory("var");
         $cache->module_name = "gallery";
diff --git a/modules/gallery/libraries/Form_Script.php b/modules/gallery/libraries/Form_Script.php
index e841408d..1f965767 100644
--- a/modules/gallery/libraries/Form_Script.php
+++ b/modules/gallery/libraries/Form_Script.php
@@ -50,7 +50,7 @@ class Form_Script_Core extends Forge {
     return $this;
   }
 
-  public function render() {
+  public function render($template="forge_template", $custom=false) {
     $script = array();
     if (!empty($this->data["url"])) {
       $script[] = html::script($this->data["url"]);
@@ -63,4 +63,4 @@ class Form_Script_Core extends Forge {
     return implode("\n", $script);
   }
 
-} // End Form Script
\ No newline at end of file
+}
\ No newline at end of file
diff --git a/modules/gallery/libraries/MY_Database.php b/modules/gallery/libraries/MY_Database.php
index 61f23fb0..e2ef68cd 100644
--- a/modules/gallery/libraries/MY_Database.php
+++ b/modules/gallery/libraries/MY_Database.php
@@ -38,7 +38,7 @@ abstract class Database extends Database_Core {
    * Parse the query string and convert any strings of the form `\([a-zA-Z0-9_]*?)\]
    * table prefix . $1
    */
-  public function query($sql = '') {
+  public function query($sql) {
     if (!empty($sql)) {
       $sql = $this->add_table_prefixes($sql);
     }
diff --git a/modules/gallery/libraries/MY_View.php b/modules/gallery/libraries/MY_View.php
index cec59ec1..83e0d0be 100644
--- a/modules/gallery/libraries/MY_View.php
+++ b/modules/gallery/libraries/MY_View.php
@@ -27,7 +27,7 @@ class View extends View_Core {
     View::$global_data[$key] = $value;
   }
 
-  public function is_set($key) {
+  public function is_set($key=null) {
     return parent::is_set($key) ? true : array_key_exists($key, View::$global_data);
   }
 
diff --git a/modules/gallery/libraries/ORM_MPTT.php b/modules/gallery/libraries/ORM_MPTT.php
index 83f9b51e..3668d42d 100644
--- a/modules/gallery/libraries/ORM_MPTT.php
+++ b/modules/gallery/libraries/ORM_MPTT.php
@@ -85,7 +85,7 @@ class ORM_MPTT_Core extends ORM {
   /**
    * Delete this node and all of its children.
    */
-  public function delete() {
+  public function delete($ignored_id=null) {
     $children = $this->children();
     if ($children) {
       foreach ($this->children() as $item) {
diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php
index 083fd06b..dbd56fa2 100644
--- a/modules/gallery/models/item.php
+++ b/modules/gallery/models/item.php
@@ -70,7 +70,7 @@ class Item_Model extends ORM_MPTT {
     return $this->type == 'movie';
   }
 
-  public function delete() {
+  public function delete($ignored_id=null) {
     if ($this->id == 1) {
       $v = new Validation(array("id"));
       $v->add_error("id", "cant_delete_root_album");
diff --git a/modules/gallery/models/task.php b/modules/gallery/models/task.php
index f40be492..24d909cb 100644
--- a/modules/gallery/models/task.php
+++ b/modules/gallery/models/task.php
@@ -27,7 +27,7 @@ class Task_Model extends ORM {
     }
   }
 
-  public function set($key, $value) {
+  public function set($key, $value=null) {
     $context = unserialize($this->context);
     $context[$key] = $value;
     $this->context = serialize($context);
@@ -40,7 +40,7 @@ class Task_Model extends ORM {
     return parent::save();
   }
 
-  public function delete() {
+  public function delete($ignored_id=null) {
     Cache::instance()->delete($this->_cache_key());
     return parent::delete();
   }
diff --git a/modules/gallery/tests/Database_Test.php b/modules/gallery/tests/Database_Test.php
index e58f73eb..861f7bba 100644
--- a/modules/gallery/tests/Database_Test.php
+++ b/modules/gallery/tests/Database_Test.php
@@ -168,12 +168,12 @@ class Database_Mock extends Database {
     return array("test");
   }
 
-  public function quote_column($val) {
-    return "[$val]";
+  public function quote_column($val, $alias=null) {
+    return $alias ? "[$val,$alias]" : "[$val]";
   }
 
-  public function quote_table($val) {
-    return "[$val]";
+  public function quote_table($val, $alias=null) {
+    return $alias ? "[$val,$alias]" : "[$val]";
   }
 
   public function quote($val) {
diff --git a/modules/gallery/tests/Item_Rest_Helper_Test.php b/modules/gallery/tests/Item_Rest_Helper_Test.php
index 088b1cbd..6d1dd864 100644
--- a/modules/gallery/tests/Item_Rest_Helper_Test.php
+++ b/modules/gallery/tests/Item_Rest_Helper_Test.php
@@ -32,6 +32,7 @@ class Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $album1->reload();
 
     // No scope is the same as "direct"
+    $request = new stdClass();
     $request->url = rest::url("item", $album1);
     $request->params = new stdClass();
     $this->assert_equal_array(
@@ -84,7 +85,9 @@ class Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $photo2->save();
     $album1->reload();
 
+    $request = new stdClass();
     $request->url = rest::url("item", $album1);
+    $request->params = new stdClass();
     $request->params->name = "foo";
     $this->assert_equal_array(
       array("url" => rest::url("item", $album1),
@@ -104,7 +107,9 @@ class Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $album2 = test::random_album($album1);
     $album1->reload();
 
+    $request = new stdClass();
     $request->url = rest::url("item", $album1);
+    $request->params = new stdClass();
     $request->params->type = "album";
     $this->assert_equal_array(
       array("url" => rest::url("item", $album1),
@@ -122,7 +127,9 @@ class Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $album1 = test::random_album();
     access::allow(identity::everybody(), "edit", $album1);
 
+    $request = new stdClass();
     $request->url = rest::url("item", $album1);
+    $request->params = new stdClass();
     $request->params->title = "my new title";
 
     item_rest::put($request);
@@ -133,7 +140,9 @@ class Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $album1 = test::random_album();
     access::allow(identity::everybody(), "edit", $album1);
 
+    $request = new stdClass();
     $request->url = rest::url("item", $album1);
+    $request->params = new stdClass();
     $request->params->title = "my new title";
     $request->params->slug = "not url safe";
 
@@ -150,7 +159,9 @@ class Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $album1 = test::random_album();
     access::allow(identity::everybody(), "edit", $album1);
 
+    $request = new stdClass();
     $request->url = rest::url("item", $album1);
+    $request->params = new stdClass();
     $request->params->type = "album";
     $request->params->name = "my album";
     $request->params->title = "my album";
@@ -165,7 +176,9 @@ class Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $album1 = test::random_album();
     access::allow(identity::everybody(), "edit", $album1);
 
+    $request = new stdClass();
     $request->url = rest::url("item", $album1);
+    $request->params = new stdClass();
     $request->params->type = "album";
     $request->params->name = "my album";
     $request->params->title = "my album";
@@ -185,7 +198,9 @@ class Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $album1 = test::random_album();
     access::allow(identity::everybody(), "edit", $album1);
 
+    $request = new stdClass();
     $request->url = rest::url("item", $album1);
+    $request->params = new stdClass();
     $request->params->type = "photo";
     $request->params->name = "my photo.jpg";
     $request->file = MODPATH . "gallery/tests/test.jpg";
@@ -200,6 +215,7 @@ class Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $album1 = test::random_album();
     access::allow(identity::everybody(), "edit", $album1);
 
+    $request = new stdClass();
     $request->url = rest::url("item", $album1);
     item_rest::delete($request);
 
@@ -212,6 +228,7 @@ class Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     access::deny(identity::everybody(), "edit", $album1);
     identity::set_active_user(identity::guest());
 
+    $request = new stdClass();
     $request->url = rest::url("item", $album1);
     try {
       item_rest::delete($request);
diff --git a/modules/gallery_unit_test/controllers/gallery_unit_test.php b/modules/gallery_unit_test/controllers/gallery_unit_test.php
index e05fcbaa..2690ad24 100644
--- a/modules/gallery_unit_test/controllers/gallery_unit_test.php
+++ b/modules/gallery_unit_test/controllers/gallery_unit_test.php
@@ -18,11 +18,15 @@
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
 class Gallery_Unit_Test_Controller extends Controller {
-  function Index() {
+  function index() {
     if (!TEST_MODE) {
       throw new Kohana_404_Exception();
     }
 
+    // Force strict behavior to flush out bugs early
+    ini_set("display_errors", true);
+    error_reporting(-1);
+
     // Jump through some hoops to satisfy the way that we check for the site_domain in
     // config.php.  We structure this such that the code in config will leave us with a
     // site_domain of "." (for historical reasons)
diff --git a/modules/rest/controllers/rest.php b/modules/rest/controllers/rest.php
index 9141d6d4..374ae0d2 100644
--- a/modules/rest/controllers/rest.php
+++ b/modules/rest/controllers/rest.php
@@ -40,6 +40,7 @@ class Rest_Controller extends Controller {
 
   public function __call($function, $args) {
     $input = Input::instance();
+    $request = new stdClass();
     switch ($method = strtolower($input->server("REQUEST_METHOD"))) {
     case "get":
       $request->params = (object) $input->get();
diff --git a/modules/rest/helpers/rest.php b/modules/rest/helpers/rest.php
index b3f80a55..a61aba2f 100644
--- a/modules/rest/helpers/rest.php
+++ b/modules/rest/helpers/rest.php
@@ -19,7 +19,7 @@
  */
 class rest_Core {
   static function reply($data=array()) {
-    Session::abort_save();
+    Session::instance()->abort_save();
 
     if ($data) {
       if (Input::instance()->get("output") == "html") {
diff --git a/modules/rest/tests/Rest_Controller_Test.php b/modules/rest/tests/Rest_Controller_Test.php
index 5e624112..9f73bed9 100644
--- a/modules/rest/tests/Rest_Controller_Test.php
+++ b/modules/rest/tests/Rest_Controller_Test.php
@@ -138,8 +138,8 @@ class Rest_Controller_Test extends Gallery_Unit_Test_Case {
 }
 
 class mock_rest {
-  function get($request)    { return $request; }
-  function post($request)   { return $request; }
-  function put($request)    { return $request; }
-  function delete($request) { return $request; }
+  static function get($request)    { return $request; }
+  static function post($request)   { return $request; }
+  static function put($request)    { return $request; }
+  static function delete($request) { return $request; }
 }
\ No newline at end of file
diff --git a/modules/search/helpers/search.php b/modules/search/helpers/search.php
index b2497eae..9018ffa2 100644
--- a/modules/search/helpers/search.php
+++ b/modules/search/helpers/search.php
@@ -65,7 +65,8 @@ class search_Core {
       $record->item_id = $item->id;
     }
 
-    module::event("item_index_data", $record->item(), $data);
+    $item = $record->item();
+    module::event("item_index_data", $item, $data);
     $record->data = join(" ", (array)$data);
     $record->dirty = 0;
     $record->save();
diff --git a/modules/tag/helpers/tag_rss.php b/modules/tag/helpers/tag_rss.php
index f09a4530..5d42caab 100644
--- a/modules/tag/helpers/tag_rss.php
+++ b/modules/tag/helpers/tag_rss.php
@@ -34,6 +34,8 @@ class tag_rss_Core {
       if (!$tag->loaded()) {
         throw new Kohana_404_Exception();
       }
+
+      $feed = new stdClass();
       $feed->children = $tag->items($limit, $offset, "photo");
       $feed->max_pages = ceil($tag->count / $limit);
       $feed->title = $tag->name;
diff --git a/modules/tag/helpers/tags_rest.php b/modules/tag/helpers/tags_rest.php
index ac0eb81d..f28be7b5 100644
--- a/modules/tag/helpers/tags_rest.php
+++ b/modules/tag/helpers/tags_rest.php
@@ -35,7 +35,6 @@ class tags_rest_Core {
         $query->or_where("edit_{$group->id}", "=", access::ALLOW);
       }
       $has_any_edit_perm = $query->close()->count_records();
-
       if (!$has_any_edit_perm) {
         access::forbidden();
       }
diff --git a/modules/tag/models/tag.php b/modules/tag/models/tag.php
index 2b33c30d..38a8ed69 100644
--- a/modules/tag/models/tag.php
+++ b/modules/tag/models/tag.php
@@ -95,7 +95,7 @@ class Tag_Model extends ORM {
    * Overload ORM::delete() to trigger an item_related_update event for all items that are
    * related to this tag.
    */
-  public function delete() {
+  public function delete($ignored_id=null) {
     $related_item_ids = array();
     foreach (db::build()
              ->select("item_id")
diff --git a/modules/tag/tests/Tag_Item_Rest_Helper_Test.php b/modules/tag/tests/Tag_Item_Rest_Helper_Test.php
index 69c580f1..cb368790 100644
--- a/modules/tag/tests/Tag_Item_Rest_Helper_Test.php
+++ b/modules/tag/tests/Tag_Item_Rest_Helper_Test.php
@@ -28,6 +28,7 @@ class Tag_Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
   public function get_test() {
     $tag = tag::add(item::root(), "tag1")->reload();
 
+    $request = new stdClass();
     $request->url = rest::url("tag_item", $tag, item::root());
     $this->assert_equal_array(
       array("url" => rest::url("tag_item", $tag, item::root()),
@@ -38,6 +39,7 @@ class Tag_Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
   }
 
   public function get_with_invalid_url_test() {
+    $request = new stdClass();
     $request->url = "bogus";
     try {
       tag_item_rest::get($request);
@@ -50,6 +52,7 @@ class Tag_Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
   public function delete_test() {
     $tag = tag::add(item::root(), "tag1")->reload();
 
+    $request = new stdClass();
     $request->url = rest::url("tag_item", $tag, item::root());
     tag_item_rest::delete($request);
 
@@ -60,7 +63,6 @@ class Tag_Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $album = test::random_album();
     $tag = tag::add($album, "tag1")->reload();
 
-
     $tuple = rest::resolve(rest::url("tag_item", $tag, $album));
     $this->assert_equal_array($tag->as_array(), $tuple[0]->as_array());
     $this->assert_equal_array($album->as_array(), $tuple[1]->as_array());
diff --git a/modules/tag/tests/Tag_Rest_Helper_Test.php b/modules/tag/tests/Tag_Rest_Helper_Test.php
index d3cae0fb..838de975 100644
--- a/modules/tag/tests/Tag_Rest_Helper_Test.php
+++ b/modules/tag/tests/Tag_Rest_Helper_Test.php
@@ -28,6 +28,7 @@ class Tag_Rest_Helper_Test extends Gallery_Unit_Test_Case {
   public function get_test() {
     $tag = tag::add(item::root(), "tag1")->reload();
 
+    $request = new stdClass();
     $request->url = rest::url("tag", $tag);
     $this->assert_equal_array(
       array("url" => rest::url("tag", $tag),
@@ -41,6 +42,7 @@ class Tag_Rest_Helper_Test extends Gallery_Unit_Test_Case {
   }
 
   public function get_with_invalid_url_test() {
+    $request = new stdClass();
     $request->url = "bogus";
     try {
       tag_rest::get($request);
@@ -53,6 +55,7 @@ class Tag_Rest_Helper_Test extends Gallery_Unit_Test_Case {
   public function get_with_no_relationships_test() {
     $tag = test::random_tag();
 
+    $request = new stdClass();
     $request->url = rest::url("tag", $tag);
     $this->assert_equal_array(
       array("url" => rest::url("tag", $tag),
@@ -72,7 +75,9 @@ class Tag_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     access::allow(identity::everybody(), "edit", $album);
 
     // Add the album to the tag
+    $request = new stdClass();
     $request->url = rest::url("tag", $tag);
+    $request->params = new stdClass();
     $request->params->url = rest::url("item", $album);
     $this->assert_equal_array(
       array("url" => rest::url("tag_item", $tag, $album)),
@@ -93,7 +98,9 @@ class Tag_Rest_Helper_Test extends Gallery_Unit_Test_Case {
 
   public function put_test() {
     $tag = test::random_tag();
+    $request = new stdClass();
     $request->url = rest::url("tag", $tag);
+    $request->params = new stdClass();
     $request->params->name = "new name";
 
     tag_rest::put($request);
@@ -102,6 +109,7 @@ class Tag_Rest_Helper_Test extends Gallery_Unit_Test_Case {
 
   public function delete_tag_test() {
     $tag = test::random_tag();
+    $request = new stdClass();
     $request->url = rest::url("tag", $tag);
     tag_rest::delete($request);
 
diff --git a/modules/tag/tests/Tags_Rest_Helper_Test.php b/modules/tag/tests/Tags_Rest_Helper_Test.php
index a1713811..cdf7bfdf 100644
--- a/modules/tag/tests/Tags_Rest_Helper_Test.php
+++ b/modules/tag/tests/Tags_Rest_Helper_Test.php
@@ -43,6 +43,8 @@ class Tags_Rest_Helper_Test extends Gallery_Unit_Test_Case {
   public function post_test() {
     access::allow(identity::everybody(), "edit", item::root());
 
+    $request = new stdClass();
+    $request->params = new stdClass();
     $request->params->name = "test tag";
     $this->assert_equal(
       array("url" => url::site("rest/tag/1")),
@@ -55,6 +57,8 @@ class Tags_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     identity::set_active_user(identity::guest());
 
     try {
+      $request = new stdClass();
+      $request->params = new stdClass();
       $request->params->name = "test tag";
       tags_rest::post($request);
     } catch (Exception $e) {
diff --git a/modules/user/controllers/admin_users.php b/modules/user/controllers/admin_users.php
index c11b0596..03d9858b 100644
--- a/modules/user/controllers/admin_users.php
+++ b/modules/user/controllers/admin_users.php
@@ -323,7 +323,7 @@ class Admin_Users_Controller extends Admin_Controller {
     return $form;
   }
 
-  private function _add_locale_dropdown(&$form, $user=null) {
+  private static function _add_locale_dropdown(&$form, $user=null) {
     $locales = locales::installed();
     foreach ($locales as $locale => $display_name) {
       $locales[$locale] = SafeString::of_safe_html($display_name);
-- 
cgit v1.2.3


From e98991b90f3fb1d81d510af20c58644441b83534 Mon Sep 17 00:00:00 2001
From: Tim Almdal <tnalmdal@shaw.ca>
Date: Sun, 31 Jan 2010 16:58:42 -0800
Subject: return a location method so the page reloads properly if the edit was
 successful.

---
 modules/tag/controllers/admin_tags.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/tag/controllers/admin_tags.php b/modules/tag/controllers/admin_tags.php
index 3b605a4e..9092ec68 100644
--- a/modules/tag/controllers/admin_tags.php
+++ b/modules/tag/controllers/admin_tags.php
@@ -97,7 +97,8 @@ class Admin_Tags_Controller extends Admin_Controller {
       message::success($message);
       log::success("tags", $message);
 
-      print json_encode(array("result" => "success"));
+      print json_encode(array("result" => "success",
+              "location" => url::site("admin/tags")));
     } else {
       print json_encode(array("result" => "error", "form" => $in_place_edit->render()));
     }
-- 
cgit v1.2.3


From f8db2a9f8c39bdc92081f7c032f473515e2cea53 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 31 Jan 2010 20:47:25 -0800
Subject: Update the install version to 2 to match module.info.

---
 modules/watermark/helpers/watermark_installer.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/watermark/helpers/watermark_installer.php b/modules/watermark/helpers/watermark_installer.php
index b3e91044..e45ef746 100644
--- a/modules/watermark/helpers/watermark_installer.php
+++ b/modules/watermark/helpers/watermark_installer.php
@@ -33,7 +33,7 @@ class watermark_installer {
                DEFAULT CHARSET=utf8;");
 
     @mkdir(VARPATH . "modules/watermark");
-    module::set_version("watermark", 1);
+    module::set_version("watermark", 2);
   }
 
   static function uninstall() {
-- 
cgit v1.2.3


From e1bf010d89c4ef2023f204834c468793d866483c Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 31 Jan 2010 20:50:52 -0800
Subject: Force all non-guest users to have an email address since that's
 required in model validation.  Without this, any save on a user without email
 will fail which means that you can't log in.

Bump user module to version 3.
---
 modules/user/helpers/user_installer.php | 16 ++++++++++++++--
 modules/user/module.info                |  2 +-
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/modules/user/helpers/user_installer.php b/modules/user/helpers/user_installer.php
index 1d49998d..729f087a 100644
--- a/modules/user/helpers/user_installer.php
+++ b/modules/user/helpers/user_installer.php
@@ -29,9 +29,21 @@ class user_installer {
   static function upgrade($version) {
     if ($version == 1) {
       module::set_var("user", "mininum_password_length", 5);
-
       module::set_version("user", $version = 2);
     }
+
+    if ($version == 2) {
+      db::build()
+        ->update("users")
+        ->set("email", "unknown@unknown.com")
+        ->where("guest", "=", 0)
+        ->and_open()
+        ->where("email", "IS", null)
+        ->or_where("email", "=", "")
+        ->close()
+        ->execute();
+      module::set_version("user", $version = 3);
+    }
   }
 
   static function uninstall() {
@@ -117,7 +129,7 @@ class user_installer {
     access::allow($registered, "view", $root);
     access::allow($registered, "view_full", $root);
 
-    module::set_version("user", 2);
     module::set_var("user", "mininum_password_length", 5);
+    module::set_version("user", 3);
   }
 }
\ No newline at end of file
diff --git a/modules/user/module.info b/modules/user/module.info
index d1e02382..185a3e3a 100644
--- a/modules/user/module.info
+++ b/modules/user/module.info
@@ -1,4 +1,4 @@
 name = "Users and Groups"
 description = "Gallery 3 user and group management"
-version = 2
+version = 3
 
-- 
cgit v1.2.3


From 64e014203c22ad437ce62fd622f176468c1b91f3 Mon Sep 17 00:00:00 2001
From: Tim Almdal <tnalmdal@shaw.ca>
Date: Mon, 1 Feb 2010 08:15:49 -0800
Subject: Correct the internationalization of the status message.

---
 modules/gallery/helpers/gallery_task.php | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/modules/gallery/helpers/gallery_task.php b/modules/gallery/helpers/gallery_task.php
index b2f18d7c..6ce6c03e 100644
--- a/modules/gallery/helpers/gallery_task.php
+++ b/modules/gallery/helpers/gallery_task.php
@@ -241,7 +241,7 @@ class gallery_task_Core {
       $total = 0;
 
       switch ($task->get("mode", "init")) {
-      case "init":  // 0%
+      case "init":
         $threshold = time() - 1209600; // older than 2 weeks
         foreach(array("logs", "tmp") as $dir) {
           $dir = VARPATH . $dir;
@@ -276,8 +276,9 @@ class gallery_task_Core {
         $task->set("current", $current);
       }
 
-      $task->status = t("Removed: %count files. Total: %total_count.",
-                        array("count" => $current, "total_count" => $total));
+      $task->status = t2("Removed: 1 file. Total: %total_count.",
+                         "Removed: %count files. Total: %total_count.",
+                         $current, array("total_count" => $total));
 
       if ($total == $current) {
         $task->done = true;
-- 
cgit v1.2.3


From 43985ea2fb137aa7d532617271e37d7c20def3c5 Mon Sep 17 00:00:00 2001
From: Tim Almdal <tnalmdal@shaw.ca>
Date: Mon, 1 Feb 2010 08:35:23 -0800
Subject: Update the description to reflect we are only removing "expired"
 files.

---
 modules/gallery/helpers/gallery_task.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/gallery/helpers/gallery_task.php b/modules/gallery/helpers/gallery_task.php
index 6ce6c03e..3e6278e5 100644
--- a/modules/gallery/helpers/gallery_task.php
+++ b/modules/gallery/helpers/gallery_task.php
@@ -40,7 +40,7 @@ class gallery_task_Core {
     $tasks[] = Task_Definition::factory()
                  ->callback("gallery_task::file_cleanup")
                  ->name(t("Remove old files"))
-                 ->description(t("Remove files from the logs and tmp directory"))
+                 ->description(t("Remove expired files from the logs and tmp directory"))
       ->severity(log::SUCCESS);
     return $tasks;
   }
-- 
cgit v1.2.3