Bharat Mediratta 9e6be40e31 Add viewable() protection to children() and children_count() calls. ...

This is not currently necessary (nor is it a security hole) because we
don't constrain permissions at the child level in the core, but it
makes our security audits easier and will enable the scenario where
somebody writes a module to add per-photo permissions.

2009-09-21 20:47:55 -07:00

..

admin_advanced_settings.php

XSS review fixes (mostly adding missing html::mark_clean()) calls.

2009-08-31 02:12:01 -07:00

admin_dashboard.php

Security pass over all controller code. Mostly adding CSRF checking

2009-06-01 22:40:22 -07:00

admin_graphics.php

Don't call dirname() on the toolkit dir, it's already a directory! (Thanks Kaare)

2009-08-18 13:48:00 -07:00

admin_languages.php

Fix bug #522 - Handle "save settings" correctly in the "share translations" form.

2009-09-01 11:11:22 -07:00

admin_maintenance.php

XSS review fixes (mostly adding missing html::mark_clean()) calls.

2009-08-31 02:12:01 -07:00

admin_modules.php

Fix for ticket 510: i18n fixes - localize module / theme name in some status messages

2009-07-03 14:58:33 -07:00

admin_theme_options.php

Add a new "show credits" check box in the theme options so that you

2009-06-23 16:05:32 -07:00

admin_themes.php

Move specialized (pretty) url generation back into Item_Model so that

2009-09-08 13:44:52 -07:00

admin.php

Security pass over all controller code. Mostly adding CSRF checking

2009-06-01 22:40:22 -07:00

albums.php

Fix Item_Model::get_position() so that our sort is stable when the comparison

2009-09-21 11:35:27 -07:00

combined.php

In this patch, drag now works to the album tree, but the progress bar is not

2009-08-16 12:36:14 -07:00

file_proxy.php

Fix the setting of the mime type header. as per

2009-08-20 12:26:47 +08:00

items.php

Use abs_url() inside url::redirect() calls so that we don't just wind

2009-09-10 21:31:50 -07:00

l10n_client.php

Use abs_url() inside url::redirect() calls so that we don't just wind

2009-09-10 21:31:50 -07:00

maintenance.php

Restructure things so that the application is now just another module.

2009-05-27 15:07:27 -07:00

move.php

Move specialized (pretty) url generation back into Item_Model so that

2009-09-08 13:44:52 -07:00

movies.php

Minor tweaks to the url refactor.

2009-09-08 17:01:59 -07:00

packager.php

Remove 'ENGINE=InnoDB' specification from tables that we create. Use

2009-08-27 15:47:54 -07:00

permissions.php

Don't allow users to take away their own edit permissions. If we

2009-09-06 11:45:41 -07:00

photos.php

Add viewable() protection to children() and children_count() calls.

2009-09-21 20:47:55 -07:00

quick.php

Move specialized (pretty) url generation back into Item_Model so that

2009-09-08 13:44:52 -07:00

rest.php

Security pass over all controller code. Mostly adding CSRF checking

2009-06-01 22:40:22 -07:00

simple_uploader.php

Properly deal with invalid images. This fixes ticket #611 which shows

2009-08-27 17:04:48 -07:00

upgrader.php

Rejigger the way we handle "done" status in the upgrader. Now we

2009-06-30 18:28:55 -07:00

welcome_message.php

Use abs_url() inside url::redirect() calls so that we don't just wind

2009-09-10 21:31:50 -07:00