NextGEN Gallery – WordPress Gallery Plugin - Version 1.5.2

Version Description

  • 25.03.2010 =
  • Bugfix : XSS security vulnerability (THX to Core Security Advisories Team , Pedro Varangot)
  • Bugfix : Missing $wpdb in shortcodes.php
Download this release

Release Info

Developer alexrabe
Plugin Icon 128x128 NextGEN Gallery – WordPress Gallery Plugin
Version 1.5.2
Comparing to
See all releases

Code changes from version 1.5.1 to 1.5.2

Files changed (5) hide show
  1. changelog.txt +4 -0
  2. lib/shortcodes.php +3 -1
  3. nggallery.php +2 -2
  4. readme.txt +4 -0
  5. xml/media-rss.php +3 -3
changelog.txt CHANGED
@@ -1,6 +1,10 @@
1
  NextGEN Gallery
2
  by Alex Rabe & NextGEN DEV Team
3
 
 
 
 
 
4
  = V1.5.1 - 23.03.2010 =
5
  * Bugfix : PHP4 compat issue for Add gallery & options page
6
  * Bugfix : Gallery widget can now have a empty title
1
  NextGEN Gallery
2
  by Alex Rabe & NextGEN DEV Team
3
 
4
+ = V1.5.2 - 25.03.2010 =
5
+ * Bugfix : XSS security vulnerability (THX to Core Security Advisories Team , Pedro Varangot)
6
+ * Bugfix : Missing $wpdb in shortcodes.php
7
+
8
  = V1.5.1 - 23.03.2010 =
9
  * Bugfix : PHP4 compat issue for Add gallery & options page
10
  * Bugfix : Gallery widget can now have a empty title
lib/shortcodes.php CHANGED
@@ -204,7 +204,9 @@ class NextGEN_shortcodes {
204
  * @return the_content
205
  */
206
  function show_gallery( $atts ) {
207
-
 
 
208
  extract(shortcode_atts(array(
209
  'id' => 0,
210
  'template' => '',
204
  * @return the_content
205
  */
206
  function show_gallery( $atts ) {
207
+
208
+ global $wpdb;
209
+
210
  extract(shortcode_atts(array(
211
  'id' => 0,
212
  'template' => '',
nggallery.php CHANGED
@@ -4,7 +4,7 @@ Plugin Name: NextGEN Gallery
4
  Plugin URI: http://alexrabe.de/?page_id=80
5
  Description: A NextGENeration Photo gallery for the Web 2.0.
6
  Author: Alex Rabe
7
- Version: 1.5.1
8
 
9
  Author URI: http://alexrabe.de/
10
 
@@ -44,7 +44,7 @@ if(preg_match('#' . basename(__FILE__) . '#', $_SERVER['PHP_SELF'])) { die('You
44
  if (!class_exists('nggLoader')) {
45
  class nggLoader {
46
 
47
- var $version = '1.5.1';
48
  var $dbversion = '1.5.0';
49
  var $minium_WP = '2.9';
50
  var $minium_WPMU = '2.9';
4
  Plugin URI: http://alexrabe.de/?page_id=80
5
  Description: A NextGENeration Photo gallery for the Web 2.0.
6
  Author: Alex Rabe
7
+ Version: 1.5.2
8
 
9
  Author URI: http://alexrabe.de/
10
 
44
  if (!class_exists('nggLoader')) {
45
  class nggLoader {
46
 
47
+ var $version = '1.5.2';
48
  var $dbversion = '1.5.0';
49
  var $minium_WP = '2.9';
50
  var $minium_WPMU = '2.9';
readme.txt CHANGED
@@ -141,6 +141,10 @@ To show the most recent added mages : **[recent max=x ]**
141
 
142
  == Changelog ==
143
 
 
 
 
 
144
  = V1.5.1 - 23.03.2010 =
145
  * Bugfix : PHP4 compat issue for Add gallery & options page
146
  * Bugfix : Gallery widget can now have a empty title
141
 
142
  == Changelog ==
143
 
144
+ = V1.5.2 - 25.03.2010 =
145
+ * Bugfix : XSS security vulnerability (THX to Core Security Advisories Team , Pedro Varangot)
146
+ * Bugfix : Missing $wpdb in shortcodes.php
147
+
148
  = V1.5.1 - 23.03.2010 =
149
  * Bugfix : PHP4 compat issue for Add gallery & options page
150
  * Bugfix : Gallery widget can now have a empty title
xml/media-rss.php CHANGED
@@ -66,7 +66,7 @@ if ( $mode == 'last_pictures' ) {
66
 
67
  if (!isset($gallery) || $gallery==null) {
68
  header('content-type:text/plain;charset=utf-8');
69
- echo sprintf(__("The gallery ID=%s does not exist.","nggallery"), $gid);
70
  exit;
71
  }
72
 
@@ -105,14 +105,14 @@ if ( $mode == 'last_pictures' ) {
105
  $album = nggdb::find_album($aid);
106
  if (!isset($album) || $album==null ) {
107
  header('content-type:text/plain;charset=utf-8');
108
- echo sprintf(__("The album ID=%s does not exist.", "nggallery"), $aid);
109
  exit;
110
  }
111
 
112
  $rss = nggMediaRss::get_album_mrss($album);
113
  } else {
114
  header('content-type:text/plain;charset=utf-8');
115
- echo sprintf(__("Invalid MediaRSS command (%s).", "nggallery"), $mode);
116
  exit;
117
  }
118
 
66
 
67
  if (!isset($gallery) || $gallery==null) {
68
  header('content-type:text/plain;charset=utf-8');
69
+ echo sprintf(__("The gallery ID=%s does not exist.","nggallery"), intval($gid) );
70
  exit;
71
  }
72
 
105
  $album = nggdb::find_album($aid);
106
  if (!isset($album) || $album==null ) {
107
  header('content-type:text/plain;charset=utf-8');
108
+ echo sprintf(__("The album ID=%s does not exist.", "nggallery"), intval($aid) );
109
  exit;
110
  }
111
 
112
  $rss = nggMediaRss::get_album_mrss($album);
113
  } else {
114
  header('content-type:text/plain;charset=utf-8');
115
+ echo __('Invalid MediaRSS command', 'nggallery');
116
  exit;
117
  }
118