V6.2 has been released. Note that there are a number of fixes, including a security fix that prevents users from execuruting programs from the hosting system. (Programs are executed with the privileges of the web server user, and have to be pre-existing on the system.) An advisory detailing the problem will hit BugTraq on April 27th. (Thanks to AresU for finding this and for responsible disclosure!)
As a result, I *strongly* recommend that everyone upgrade to V6.2.
Download
here .
New Features- Added a new "Popular" option. This shows the 10 (by default) most popular photos or albums. Popularity is based on rating, number of times rated and number of times viewed. New for this feature: popular_button and most_popular config items, thmb_album_popular.gif graphic, popular style sheet class and updated album_header.tml.
- SSI setting for popular modes defines number of images to display. (I.E. ssi=10 shows 10 most popular)
- Added self-administration: users can now create sub-albums and set album thumbnails for albums they own.
- Added new user class: guest. Guests are defined through the "default_guests" config item, and are like regular users but cannot upload.
- Added ability to set photo and album owners through the "Update Titles & Descriptions" form.
- Admins are now excluded from quota checking.
- A "thmb_root.jpg" image added to the root album will now be used as the album thumbnail for the root album.
- Re-organized Configuration Management screen into sections.
- Added "Edit User List" capability for flatfile authentication (authentication_type=1). This form shows up on the Configuration Management screen.
- Added jhead_comments config item, which uses jhead to automatically insert a photo's title/description (if present) as a comment in the EXIF header.
- Added a check to ensure the style sheet is working, through the use of a "hidden" class that hides the error when things are working properly.
- Added "postupload" config item, which allows an ImageMagick command to be run on a pic after upload.
- Added 2 new sort options: newest first and oldest first, by file creation date.
- Added public_albums option to protect only photos (thumbnail view is pulic).
- Login errors now display as a popup window.
- Improved "fatal error" troubleshooting.
- Jump Station will now go to target album on click (submit not required).
- Automatic ImageMagick sensing for new configs has been added.
- Allowed entered passwords to override cookies.
- Made DB code more robust.
Bug Fixes- Major security hole fixed where any program can be remotely executed has been closed -- thanks to AresU for finding this and for responsible disclosure!
- Fixed broken SSI code - it now won't display all the "extra stuff" in SSI mode. The ssirecentuploads style class has also been updated.
- Fixed security hole around creating albums.
- Fixed bug where first level sub albums showed their own thumbnail for the "root" album's nav button.
- Fixed problem where ()'s in album filenames broke the nav footer.
- Photos without a thumbnail are no longer displayed on the "Set Album Thumbnail" screen.
- Fixed "Update Titles & Descriptions" bug for "empty" albums.
- Movies can now be viewed when browsing through a batch of photos and movies.
- Fixed a bug where setting thumbnails for sub-sub albums threw an error.
- Fixed a bug where the "Full Size" viewing button didn't work if you had defined a default size.
- Removed double /'s from thumbnail links.
- Fixed a bug where rating_location wasn't being honoured.
- Fixed broken movie links on search results page.
