NextGEN Gallery – WordPress Gallery Plugin - Version 2.0.65

Version Description

  • 05.04.2014 =
  • Secured: Limit uploads to images and zips
Download this release

Release Info

Developer photocrati
Plugin Icon 128x128 NextGEN Gallery – WordPress Gallery Plugin
Version 2.0.65
Comparing to
See all releases

Code changes from version 2.0.63 to 2.0.65

Files changed (7) hide show
  1. changelog.txt +3 -0
  2. nggallery.php +2 -2
  3. products/photocrati_nextgen/modules/nextgen_addgallery_page/adapter.nextgen_addgallery_ajax.php +8 -5
  4. products/photocrati_nextgen/modules/nextgen_basic_gallery/templates/thumbnails/index.php +1 -1
  5. products/photocrati_nextgen/modules/nextgen_data/class.gallerystorage_driver_base.php +32 -0
  6. products/photocrati_nextgen/modules/nextgen_data/class.ngglegacy_gallerystorage_driver.php +4 -1
  7. readme.txt +3 -0
changelog.txt CHANGED
@@ -1,6 +1,9 @@
1
  NextGEN Gallery
2
  by Photocrati Media
3
 
 
 
 
4
  = V2.0.63 - 04.29.2014 =
5
  * NEW: Translation ready
6
  * NEW: Including German translation by Roland Stumpp
1
  NextGEN Gallery
2
  by Photocrati Media
3
 
4
+ = V2.0.65 - 05.04.2014 =
5
+ * Secured: Limit uploads to images and zips
6
+
7
  = V2.0.63 - 04.29.2014 =
8
  * NEW: Translation ready
9
  * NEW: Including German translation by Roland Stumpp
nggallery.php CHANGED
@@ -4,7 +4,7 @@ if(preg_match('#' . basename(__FILE__) . '#', $_SERVER['PHP_SELF'])) { die('You
4
  /**
5
  * Plugin Name: NextGEN Gallery by Photocrati
6
  * Description: The most popular gallery plugin for WordPress and one of the most popular plugins of all time with over 9 million downloads.
7
- * Version: 2.0.63
8
  * Author: Photocrati Media
9
  * Plugin URI: http://www.nextgen-gallery.com
10
  * Author URI: http://www.photocrati.com
@@ -430,7 +430,7 @@ class C_NextGEN_Bootstrap
430
  define('NGG_PRODUCT_URL', path_join(str_replace("\\", '/', NGG_PLUGIN_URL), 'products'));
431
  define('NGG_MODULE_URL', path_join(str_replace("\\", '/', NGG_PRODUCT_URL), 'photocrati_nextgen/modules'));
432
  define('NGG_PLUGIN_STARTED_AT', microtime());
433
- define('NGG_PLUGIN_VERSION', '2.0.63');
434
 
435
  if (!defined('NGG_HIDE_STRICT_ERRORS')) {
436
  define('NGG_HIDE_STRICT_ERRORS', TRUE);
4
  /**
5
  * Plugin Name: NextGEN Gallery by Photocrati
6
  * Description: The most popular gallery plugin for WordPress and one of the most popular plugins of all time with over 9 million downloads.
7
+ * Version: 2.0.65
8
  * Author: Photocrati Media
9
  * Plugin URI: http://www.nextgen-gallery.com
10
  * Author URI: http://www.photocrati.com
430
  define('NGG_PRODUCT_URL', path_join(str_replace("\\", '/', NGG_PLUGIN_URL), 'products'));
431
  define('NGG_MODULE_URL', path_join(str_replace("\\", '/', NGG_PRODUCT_URL), 'photocrati_nextgen/modules'));
432
  define('NGG_PLUGIN_STARTED_AT', microtime());
433
+ define('NGG_PLUGIN_VERSION', '2.0.65');
434
 
435
  if (!defined('NGG_HIDE_STRICT_ERRORS')) {
436
  define('NGG_HIDE_STRICT_ERRORS', TRUE);
products/photocrati_nextgen/modules/nextgen_addgallery_page/adapter.nextgen_addgallery_ajax.php CHANGED
@@ -15,16 +15,17 @@ class A_NextGen_AddGallery_Ajax extends Mixin
15
  {
16
  $retval = array();
17
 
18
- $gallery_id = intval($this->param('gallery_id'));
19
- $gallery_name = urldecode($this->param('gallery_name'));
20
- $error = FALSE;
 
 
21
 
22
  if ($this->validate_ajax_request('nextgen_upload_image'))
23
  {
24
  // We need to create a gallery
25
  if ($gallery_id == 0) {
26
  if (strlen($gallery_name) > 0) {
27
- $gallery_mapper = $this->object->get_registry()->get_utility('I_Gallery_Mapper');
28
  $gallery = $gallery_mapper->create(array(
29
  'title' => $gallery_name
30
  ));
@@ -33,7 +34,8 @@ class A_NextGen_AddGallery_Ajax extends Mixin
33
  $error = TRUE;
34
  }
35
  else {
36
- $gallery_id = $gallery->id();
 
37
  }
38
  }
39
  else {
@@ -65,6 +67,7 @@ class A_NextGen_AddGallery_Ajax extends Mixin
65
  catch (E_NggErrorException $ex) {
66
  $retval['error'] = $ex->getMessage();
67
  $error = TRUE;
 
68
  }
69
  catch (Exception $ex) {
70
  $retval['error'] = __("An unexpected error occured.", 'nggallery');
15
  {
16
  $retval = array();
17
 
18
+ $created_gallery = FALSE;
19
+ $gallery_id = intval($this->param('gallery_id'));
20
+ $gallery_name = urldecode($this->param('gallery_name'));
21
+ $gallery_mapper = $this->object->get_registry()->get_utility('I_Gallery_Mapper');
22
+ $error = FALSE;
23
 
24
  if ($this->validate_ajax_request('nextgen_upload_image'))
25
  {
26
  // We need to create a gallery
27
  if ($gallery_id == 0) {
28
  if (strlen($gallery_name) > 0) {
 
29
  $gallery = $gallery_mapper->create(array(
30
  'title' => $gallery_name
31
  ));
34
  $error = TRUE;
35
  }
36
  else {
37
+ $created_gallery = TRUE;
38
+ $gallery_id = $gallery->id();
39
  }
40
  }
41
  else {
67
  catch (E_NggErrorException $ex) {
68
  $retval['error'] = $ex->getMessage();
69
  $error = TRUE;
70
+ if ($created_gallery) $gallery_mapper->destroy($gallery_id);
71
  }
72
  catch (Exception $ex) {
73
  $retval['error'] = __("An unexpected error occured.", 'nggallery');
products/photocrati_nextgen/modules/nextgen_basic_gallery/templates/thumbnails/index.php CHANGED
@@ -80,7 +80,7 @@ $this->start_element('nextgen_gallery.gallery_container', 'container', $displaye
80
 
81
  ?>
82
 
83
- <?php if ($number_of_columns > 0): ?>
84
  <?php if ((($i + 1) % $number_of_columns) == 0 ): ?>
85
  <br style="clear: both" />
86
  <?php endif; ?>
80
 
81
  ?>
82
 
83
+ <?php if ($number_of_columns > 0 && empty($show_all_in_lightbox)): ?>
84
  <?php if ((($i + 1) % $number_of_columns) == 0 ): ?>
85
  <br style="clear: both" />
86
  <?php endif; ?>
products/photocrati_nextgen/modules/nextgen_data/class.gallerystorage_driver_base.php CHANGED
@@ -462,6 +462,38 @@ class Mixin_GalleryStorage_Driver_Base extends Mixin
462
  return $this->object->copy_images($images, $gallery, $db, TRUE);
463
  }
464
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
465
 
466
  function is_zip()
467
  {
462
  return $this->object->copy_images($images, $gallery, $db, TRUE);
463
  }
464
 
465
+ function is_image_file()
466
+ {
467
+ $retval = FALSE;
468
+
469
+ if ((isset($_FILES['file']) && $_FILES['file']['error'] == 0)) {
470
+ $file_info = $_FILES['file'];
471
+
472
+ if (isset($file_info['type'])) {
473
+ $type = strtolower($file_info['type']);
474
+ error_log("Attempted to upload {$type}.");
475
+ $valid_types = array(
476
+ 'image/gif',
477
+ 'image/jpg',
478
+ 'image/jpeg',
479
+ 'image/pjpeg',
480
+ 'image/png',
481
+ );
482
+ $valid_regex = '/\.(jpg|jpeg|gif|png)$/';
483
+
484
+ // Is this a valid type?
485
+ if (in_array($type, $valid_types)) $retval = TRUE;
486
+
487
+ // Is this a valid extension?
488
+ else if (strpos($type, 'octem-stream') !== FALSE && preg_match($valid_regex, $type)) {
489
+ $retval = TRUE;
490
+ }
491
+ }
492
+ }
493
+
494
+ return $retval;
495
+ }
496
+
497
 
498
  function is_zip()
499
  {
products/photocrati_nextgen/modules/nextgen_data/class.ngglegacy_gallerystorage_driver.php CHANGED
@@ -207,12 +207,15 @@ class Mixin_NggLegacy_GalleryStorage_Driver extends Mixin
207
  if ($this->object->is_zip()) {
208
  $retval = $this->object->upload_zip($gallery);
209
  }
210
- else {
211
  $retval = $this->object->upload_base64_image(
212
  $gallery,
213
  file_get_contents($file['tmp_name']),
214
  $filename ? $filename : (isset($file['name']) ? $file['name'] : FALSE)
215
  );
 
 
 
216
  }
217
  }
218
  elseif ($data) {
207
  if ($this->object->is_zip()) {
208
  $retval = $this->object->upload_zip($gallery);
209
  }
210
+ else if ($this->is_image_file()) {
211
  $retval = $this->object->upload_base64_image(
212
  $gallery,
213
  file_get_contents($file['tmp_name']),
214
  $filename ? $filename : (isset($file['name']) ? $file['name'] : FALSE)
215
  );
216
+ }
217
+ else {
218
+ throw new E_UploadException(__('Invalid image file. Acceptable formats: JPG, GIF, and PNG.', 'nggallery'));
219
  }
220
  }
221
  elseif ($data) {
readme.txt CHANGED
@@ -199,6 +199,9 @@ For more information, feel free to visit the official website for the NextGEN Ga
199
 
200
  == Changelog ==
201
 
 
 
 
202
  = V2.0.63 - 04.29.2014 =
203
  * NEW: Translation ready
204
  * NEW: Including German translation by Roland Stumpp
199
 
200
  == Changelog ==
201
 
202
+ = V2.0.65 - 05.04.2014 =
203
+ * Secured: Limit uploads to images and zips
204
+
205
  = V2.0.63 - 04.29.2014 =
206
  * NEW: Translation ready
207
  * NEW: Including German translation by Roland Stumpp