From f488384a7b56b1e9511fa23d3ac359de64901213 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Mon, 30 Apr 2012 15:04:45 -0700
Subject: Guard reparent/rearrange against bad values in source_id.  Fixes
 #1843.

---
 modules/organize/controllers/organize.php | 8 ++++++++
 1 file changed, 8 insertions(+)

(limited to 'modules/organize/controllers')

diff --git a/modules/organize/controllers/organize.php b/modules/organize/controllers/organize.php
index 5a2c3e4f..048f6fc3 100644
--- a/modules/organize/controllers/organize.php
+++ b/modules/organize/controllers/organize.php
@@ -81,6 +81,9 @@ class Organize_Controller extends Controller {
 
     foreach (explode(",", $input->post("source_ids")) as $source_id) {
       $source = ORM::factory("item", $source_id);
+      if (!$source->loaded()) {
+        continue;
+      }
       access::required("edit", $source->parent());
 
       if ($source->contains($new_parent) || $source->id == $new_parent->id) {
@@ -116,6 +119,11 @@ class Organize_Controller extends Controller {
 
     $input = Input::instance();
     $target = ORM::factory("item", $input->post("target_id"));
+    if (!$target->loaded()) {
+      json::reply(null);
+      return;
+    }
+
     $album = $target->parent();
     access::required("edit", $album);
 
-- 
cgit v1.2.3


From 581d9a58db6a18a2597ee5487e57716f367c884b Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 5 May 2012 19:38:31 -0700
Subject: Clean up title handling code in organize and wind theme for
 consistency. Fixes #1847.

---
 modules/organize/controllers/organize.php       | 5 +++--
 modules/organize/views/organize_dialog.html.php | 2 +-
 modules/organize/views/organize_frame.html.php  | 2 +-
 themes/wind/views/dynamic.html.php              | 2 +-
 themes/wind/views/page.html.php                 | 4 ++--
 5 files changed, 8 insertions(+), 7 deletions(-)

(limited to 'modules/organize/controllers')

diff --git a/modules/organize/controllers/organize.php b/modules/organize/controllers/organize.php
index 048f6fc3..3f04e56d 100644
--- a/modules/organize/controllers/organize.php
+++ b/modules/organize/controllers/organize.php
@@ -56,7 +56,7 @@ class Organize_Controller extends Controller {
       "sort_column" => $album->sort_column,
       "sort_order" => $album->sort_order,
       "editable" => access::can("edit", $album),
-      "title" => $album->title,
+      "title" => (string)html::clean($album->title),
       "children" => array());
 
     foreach ($album->viewable()->children() as $child) {
@@ -67,8 +67,9 @@ class Organize_Controller extends Controller {
         "width" => $dims[1],
         "height" => $dims[0],
         "type" => $child->type,
-        "title" => $child->title);
+        "title" => (string)html::clean($child->title));
     }
+    Kohana_Log::add("error","".print_r($data,1));
     json::reply($data);
   }
 
diff --git a/modules/organize/views/organize_dialog.html.php b/modules/organize/views/organize_dialog.html.php
index a386fa77..9ea4d923 100644
--- a/modules/organize/views/organize_dialog.html.php
+++ b/modules/organize/views/organize_dialog.html.php
@@ -11,7 +11,7 @@
   var set_title = function(title) {
     $("#g-dialog").dialog("option", "title", ORGANIZE_TITLE.replace("__TITLE__", title));
   }
-  set_title("<?= $album->title ?>");
+  set_title("<?= html::clean($album->title) ?>");
 
   var done_loading = function() {
     $("#g-organize-app-loading").hide();
diff --git a/modules/organize/views/organize_frame.html.php b/modules/organize/views/organize_frame.html.php
index 20a1a6da..51d49104 100644
--- a/modules/organize/views/organize_frame.html.php
+++ b/modules/organize/views/organize_frame.html.php
@@ -506,7 +506,7 @@
       root: {
         allowDrop: Boolean(<?= access::can("edit", item::root()) ?>),
         nodeType: "async",
-        text: "<?= item::root()->title ?>",
+        text: "<?= html::clean(item::root()->title) ?>",
         draggable: false,
         id: "<?= item::root()->id ?>",
         expanded: true
diff --git a/themes/wind/views/dynamic.html.php b/themes/wind/views/dynamic.html.php
index a8a4d362..c8b2fcaf 100644
--- a/themes/wind/views/dynamic.html.php
+++ b/themes/wind/views/dynamic.html.php
@@ -3,7 +3,7 @@
   <div id="g-album-header-buttons">
     <?= $theme->dynamic_top() ?>
   </div>
-  <h1><?= html::clean($title) ?></h1>
+  <h1><?= html::purify($title) ?></h1>
 </div>
 
 <ul id="g-album-grid" class="ui-helper-clearfix">
diff --git a/themes/wind/views/page.html.php b/themes/wind/views/page.html.php
index 24d3347e..18ade97f 100644
--- a/themes/wind/views/page.html.php
+++ b/themes/wind/views/page.html.php
@@ -10,11 +10,11 @@
         <?= $page_title ?>
       <? else: ?>
         <? if ($theme->item()): ?>
-          <?= $theme->item()->title ?>
+          <?= html::purify($theme->item()->title) ?>
         <? elseif ($theme->tag()): ?>
           <?= t("Photos tagged with %tag_title", array("tag_title" => $theme->tag()->name)) ?>
         <? else: /* Not an item, not a tag, no page_title specified.  Help! */ ?>
-          <?= item::root()->title ?>
+          <?= html::purify(item::root()->title) ?>
         <? endif ?>
       <? endif ?>
     </title>
-- 
cgit v1.2.3


From a16b46545115b1b5fd963282c487e078f7eb5eb0 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 5 May 2012 19:44:11 -0700
Subject: Remove debug line added in 581d9a58db6a18a2597ee5487e57716f367c884b

---
 modules/organize/controllers/organize.php | 1 -
 1 file changed, 1 deletion(-)

(limited to 'modules/organize/controllers')

diff --git a/modules/organize/controllers/organize.php b/modules/organize/controllers/organize.php
index 3f04e56d..145c3283 100644
--- a/modules/organize/controllers/organize.php
+++ b/modules/organize/controllers/organize.php
@@ -69,7 +69,6 @@ class Organize_Controller extends Controller {
         "type" => $child->type,
         "title" => (string)html::clean($child->title));
     }
-    Kohana_Log::add("error","".print_r($data,1));
     json::reply($data);
   }
 
-- 
cgit v1.2.3


From 3191f0f18b606a93bb6ae9e05a95cc505660ba96 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 8 May 2012 19:02:58 -0700
Subject: Fix up a title that I overlooked in
 581d9a58db6a18a2597ee5487e57716f367c884b

---
 modules/organize/controllers/organize.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'modules/organize/controllers')

diff --git a/modules/organize/controllers/organize.php b/modules/organize/controllers/organize.php
index 145c3283..b0c13e7d 100644
--- a/modules/organize/controllers/organize.php
+++ b/modules/organize/controllers/organize.php
@@ -195,7 +195,7 @@ class Organize_Controller extends Controller {
         "expandable" => false,
         "id" => $child->id,
         "leaf" => $child->children_count(array(array("type", "=", "album"))) == 0,
-        "text" => $child->title,
+        "text" => (string)html::clean($child->title),
         "nodeType" => "async");
 
       // If the child is in the selected path, open it now.  Else, mark it async.
-- 
cgit v1.2.3