From b1dad9974116b5cd8236041bc276519d50ee0866 Mon Sep 17 00:00:00 2001 From: Bharat Mediratta Date: Thu, 6 Jun 2013 18:45:46 -0400 Subject: Replace flashmediaelement.swf with a PHP wrapper that strips url fragments and query parameters. --- modules/gallery/views/movieplayer.html.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'modules/gallery') diff --git a/modules/gallery/views/movieplayer.html.php b/modules/gallery/views/movieplayer.html.php index f78cc91a..e4046906 100644 --- a/modules/gallery/views/movieplayer.html.php +++ b/modules/gallery/views/movieplayer.html.php @@ -11,7 +11,8 @@ defaultVideoHeight: , startVolume: 1.0, features: ["playpause", "progress", "current", "duration", "volume", "fullscreen"], - pluginPath: "" + pluginPath: "", + flashName: "flashmediaelement.swf.php" }, ) ); -- cgit v1.2.3 From c70646237e90e998259b72ae9c2497ad1f384432 Mon Sep 17 00:00:00 2001 From: Bharat Mediratta Date: Sat, 8 Jun 2013 16:34:16 -0400 Subject: Rename uploadify SWF wrappers to end in .swf.php for consistency. --- lib/uploadify/uploadify.allglyphs.php | 46 -------------------------- lib/uploadify/uploadify.allglyphs.swf.php | 47 +++++++++++++++++++++++++++ lib/uploadify/uploadify.php | 46 -------------------------- lib/uploadify/uploadify.swf.php | 47 +++++++++++++++++++++++++++ modules/gallery/tests/File_Structure_Test.php | 7 ++-- modules/gallery/tests/xss_data.txt | 2 +- modules/gallery/views/form_uploadify.html.php | 2 +- 7 files changed, 100 insertions(+), 97 deletions(-) delete mode 100644 lib/uploadify/uploadify.allglyphs.php create mode 100644 lib/uploadify/uploadify.allglyphs.swf.php delete mode 100644 lib/uploadify/uploadify.php create mode 100644 lib/uploadify/uploadify.swf.php (limited to 'modules/gallery') diff --git a/lib/uploadify/uploadify.allglyphs.php b/lib/uploadify/uploadify.allglyphs.php deleted file mode 100644 index 18b75a50..00000000 --- a/lib/uploadify/uploadify.allglyphs.php +++ /dev/null @@ -1,46 +0,0 @@ -id}") modules/gallery/views/form_uploadify.html.php 31 DIRTY_JS implode(";",$extensions) modules/gallery/views/form_uploadify.html.php 33 DIRTY_JS url::file("lib/uploadify/cancel.png") diff --git a/modules/gallery/views/form_uploadify.html.php b/modules/gallery/views/form_uploadify.html.php index 4963d185..bba6db73 100644 --- a/modules/gallery/views/form_uploadify.html.php +++ b/modules/gallery/views/form_uploadify.html.php @@ -25,7 +25,7 @@ $("#g-uploadify").uploadify({ width: 298, height: 32, - uploader: "", + uploader: "", script: "id}") ?>", scriptData: , fileExt: "", -- cgit v1.2.3 From 3c100d06ff10d12b1b6b960ba52c5206bac855c4 Mon Sep 17 00:00:00 2001 From: shadlaws Date: Wed, 12 Jun 2013 07:25:26 +0200 Subject: #2074 - Mirror some additional file_proxy checks in data_rest. --- modules/gallery/helpers/data_rest.php | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'modules/gallery') diff --git a/modules/gallery/helpers/data_rest.php b/modules/gallery/helpers/data_rest.php index d4f456d7..a0a225f9 100644 --- a/modules/gallery/helpers/data_rest.php +++ b/modules/gallery/helpers/data_rest.php @@ -25,7 +25,6 @@ class data_rest_Core { static function get($request) { $item = rest::resolve($request->url); - access::required("view", $item); $p = $request->params; if (!isset($p->size) || !in_array($p->size, array("thumb", "resize", "full"))) { @@ -36,10 +35,16 @@ class data_rest_Core { // see if you should make the same change there as well. if ($p->size == "full") { + if ($item->is_album()) { + throw new Kohana_404_Exception(); + } + access::required("view_full", $item); $file = $item->file_path(); } else if ($p->size == "resize") { + access::required("view", $item); $file = $item->resize_path(); } else { + access::required("view", $item); $file = $item->thumb_path(); } -- cgit v1.2.3