Gallery 1.4.3-pl2 Security Release

Submitted by signe on Tue, 2004-06-01 23:01

Notice: This affects all versions of Gallery from 1.2 to 1.4.3-pl1:

We have discovered a well-hidden but potentially serious security flaw in these versions of Gallery which can allow a hacker to log in to your Gallery as an administrator and perform any actions on your albums. No risk is posed to the webserver-itself or any non-Gallery data. All Gallery users are very strongly urged to upgrade to 1.4.3-pl2 immediately, which fixes this serious problem and will secure your system.

Gallery 1.4.3-pl2 can be downloaded from the Gallery Download Page.

Please use the Discussion Forums for any issues or questions. This topic is now locked to further comments to prevent confusion and to make sure no questions are lost.[10PM PDT] A patch version of the update has been made available on the downloads page. After downloading the patch, you can apply it by running this command on your (UNIX) server: Copy the downloaded file to the location where your Gallery directory exists, but not inside of it.

gzip -d gallery-1.4.3-pl1_to_pl2.patch.gz
patch -p0 < gallery-1.4.3-pl1_to_pl2.patch

Version 1.4.3-pl2-1 of the Debian gallery package was uploaded on Tuesday, June 1, 2004 and should be available in Debian unstable after the archive run completes in the afternoon (EST) of Wednesday, June 2, 2004. Version 1.2.5-9woody1 of the Debian gallery package for Debian Stable (aka Woody) was sent to the Debian Security Team on Tuesday, June 1, 2004 and should be available in Debian stable shortly.

Submitted by capnhairdo on Wed, 2004-06-02 00:38.

Is it just me, or is 1.4.3-pl2 missing the config.php file? I can't seem to find it in the ZIP file, which makes setting up Gallery somewhat difficult.

Submitted by stevepiercy on Wed, 2004-06-02 01:04.

Where are the directions to install the upgrade?

Submitted by Collectonian on Wed, 2004-06-02 02:43.

I'm rather disappointed with this release. It's marked as a security release, but instead it has MAJOR changes, including the addition of Java stuff. No mention of those major changes are made in the announcement at all...instead I found out after doing the upgrade on both of my gallery installations.

Submitted by signe on Wed, 2004-06-02 03:25.

No, actually, there are two changes in the -pl2 release and nothing more. The major changes were made in 1.4.3 which was released on April 19th. 
 
http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=116&mode=thread&order=0&thold=1 
 
-pl1: (May 5th) 
 
http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=117&mode=thread&order=0&thold=1

Submitted by signe on Wed, 2004-06-02 03:26.

http://gallery.menalto.com/modules.php?op=modload&name=GalleryDocs&file=index&page=gallery1-install.upgrade.php

Submitted by signe on Wed, 2004-06-02 03:27.

config.php is not a file that has ever been included with Gallery. It's a file that you create during the installation process. 
 
http://gallery.menalto.com/modules.php?op=modload&name=GalleryDocs&file=index&page=gallery1-install.php

Submitted by dragonboat on Wed, 2004-06-02 05:24.

No metadata is included in the gallery main page. i.e. no chartset data. Album pages are fine. 
 
Is this an expected feature?

Submitted by itcheg on Wed, 2004-06-02 07:45.

Can anyone tell me how to aply the patch with ws_FTP 
 
Thanks in advance

Submitted by valiant on Wed, 2004-06-02 07:56.

Does this security hole also affect prior versions? 
Could you post phpbb-style manual mod for this security fix? 
"open file x, line y after blabla insert blabla, 
line z, replace blabla by blabla" 
it's just that i don't wanna learn reading patch files

Submitted by twalker on Wed, 2004-06-02 10:09.

I am trying to apply the patch but it has asked me for a file to patch. I am sure I have the correct version of gallery for this patch. 
 
user@host $ patch -p0 < gallery-1.4.3-pl1_to_pl2.patch 
Hmm... Looks like a unified diff to me... 
The text leading up to this was: 
-------------------------- 
|diff -u -r gallery-1.4.3-pl1/ChangeLog gallery/ChangeLog 
|--- gallery-1.4.3-pl1/ChangeLog Wed May 5 15:56:38 2004 
|+++ gallery/ChangeLog Tue Jun 1 08:40:42 2004 
-------------------------- 
File to patch: 
 
As this is the first time I have used patch the man and --help commands have not answer this in my case.

Submitted by signe on Wed, 2004-06-02 15:20.

The patch file can only be run from a UNIX system - if you have to upgrade via FTP, you should download the full release, and tell your ftp client to only upload the changed files.

Submitted by signe on Wed, 2004-06-02 15:21.

Either move the patch file out one directory (not inside the gallery directory, but inside the one above that), or change your command to "patch -p1". Either should work.

Submitted by NSimkins on Wed, 2004-06-02 15:45.

Sorry if this is elementary, but does Gallery have to be in Configuration Mode to run this patch? Thanks!

Submitted by signe on Wed, 2004-06-02 16:46.

Gallery should always be in configuration mode when you are running an upgrade, however, technically speaking, this particular change does not include any changes to the setup directory so it's not necessary.

Submitted by folke on Wed, 2004-06-02 19:10.

Here is how to patch by hand or using ftp: 
 
change in init.php line 25 from 
 
$sensitiveList = array("gallery", "GALLERY_BASEDIR"); 
 
into 
 
$sensitiveList = array("gallery", "GALLERY_BASEDIR", "GALLERY_EMBEDDED_INSIDE", "GALLERY_EMBEDDED_INSIDE_TYPE"); 
 
 
that's all, and you're secured. 
 
than you have NO REAL 1.4.3pl2 VERSION (but your old version secured), because between 1.4.3pl1 und pl2 there are also some other minor changes, but they have nothing to do with the security issue. 
 
kind regards 
 
Folke

Submitted by valiant on Wed, 2004-06-02 20:14.

thanks!

Submitted by phule on Thu, 2004-06-03 13:36.

Is this the only change? The patch looks like it's trying to fix other files than just init.php 
 
I can't upgrade until they fix the Java-by-default-upload "feature" (or unless they did already and no one mentioned it.)

Submitted by phule on Thu, 2004-06-03 13:45.

Can I assume that the patch won't work if you don't have your gallery directory actually named "gallery" ?

Submitted by signe on Thu, 2004-06-03 18:10.

If you use the -p1 parameter, and put the patch file inside your directory, it will work normally. 
 
-p1 tells patch to strip off the first part of the path information

Submitted by phule on Thu, 2004-06-03 18:57.

Thanks!

Submitted by folke on Thu, 2004-06-03 19:15.

no, from pl1 to pl2 there are some other diffs, but they are not security related

Submitted by duel on Thu, 2004-06-03 21:07.

does it matter if that new line of code gets word wrapped around to a new line? or does it have to fit on one long line?

Submitted by signe on Thu, 2004-06-03 22:18.

If you don't want the java applets, all you have to do is delete GalleryRemote*.jar from the java directory. Poof. No more applets.

Submitted by twalker on Fri, 2004-06-04 11:21.

Thanks signe.

Submitted by valiant on Fri, 2004-06-04 15:30.

doesn't matter. just make sure it's a normal wordwrap and there's no space or enter/newline in between.

Submitted by Cromeium on Fri, 2004-06-04 21:13.

Im usung phpnuke and attemping to patch gallery but im having problems. 
 
I do to the modules directory just before the gallery directory (where I downloaded the patch) and issued the commands 
 
gzip -d gallery-1.4.3-pl1_to_pl2.patch.gz 
 
then 
 
patch -p0 < gallery-1.4.3-pl1_to_pl2.patch 
 
I get the following after the last command 
 
patching file gallery/ChangeLog 
Hunk #1 FAILED at 1. 
1 out of 1 hunk FAILED -- saving rejects to file gallery/ChangeLog.rej 
patching file gallery/Version.php 
Hunk #1 FAILED at 17. 
Hunk #2 FAILED at 31. 
2 out of 2 hunks FAILED -- saving rejects to file gallery/Version.php.rej 
patching file gallery/docs/g1package/index.html 
Hunk #1 FAILED at 2. 
1 out of 1 hunk FAILED -- saving rejects to file gallery/docs/g1package/index.html.rej 
patching file gallery/init.php 
Hunk #1 FAILED at 17. 
1 out of 1 hunk FAILED -- saving rejects to file gallery/init.php.rej 
can't find file to patch at input line 83 
Perhaps you used the wrong -p or --strip option? 
The text leading up to this was: 
-------------------------- 
|diff -u -r gallery-1.4.3-pl1/setup/check.inc gallery/setup/check.inc 
|--- gallery-1.4.3-pl1/setup/check.inc Sun Apr 11 15:03:42 2004 
|+++ gallery/setup/check.inc Thu May 6 03:05:29 2004 
-------------------------- 
File to patch: 
 
What am I doing wrong with this?

Submitted by jwatt on Fri, 2004-06-04 22:12.

upgraded from 1.4.1 to 1.4.3-pl2 and my highlighted images disappeared. had to roll back to 1.4.1 
 
also noticing that select box commands don't work in mozilla 1.7b. not sure if they ever did. i'll try mozilla 1.7rc2...

Submitted by signe on Sat, 2004-06-05 22:33.

The last error is that you didn't put your Gallery in config mode. 
 
The others... not sure. What version are you running? The patch will only apply against 1.4.3-pl1.

Submitted by Kulock on Sun, 2004-06-06 15:07.

This happened to me at one point when I upgraded, IIRC, what happened was that my FTP didn't upload all of the new source files over the old, and so something I'd modified regarding the dropshadows around the thumbnails caused a problem with the highlights showing up. 
 
Try backing up your existing Gallery source files, and then uploading the new versions completely, and see if that fixes the problem with your highlights (and if it does, just replicate your modifications from the previous version). Don't forget about how if you have an html_wrap file being overrided by a version without the .default tag, you won't see the upgraded version in action.

Submitted by leslienord on Tue, 2004-06-08 00:16.

I have tried both ways -p0 (outside the Gallery directory and -p1 inside the Gallery directory after moving the patch there: 
 
 
bash-2.05a$ patch -p0 < gallery-1.4.3-pl1_to_pl2.patch 
can't find file to patch at input line 4 
Perhaps you used the wrong -p or --strip option? 
The text leading up to this was: 
-------------------------- 
|diff -u -r gallery-1.4.3-pl1/ChangeLog gallery/ChangeLog 
|--- gallery-1.4.3-pl1/ChangeLog Wed May 5 15:56:38 2004 
|+++ gallery/ChangeLog Tue Jun 1 08:40:42 2004 
-------------------------- 
File to patch: patch -p1 < gallery-1.4.3-pl1_to_pl2.patch 
patch: No such file or directory 
Skip this patch? [y] 
 
I'm not getting anywhere - what should I try next?

Submitted by leslienord on Tue, 2004-06-08 00:48.

After making some changes for my configuration mode I got this: 
 
 
bash-2.05a$ patch -p1 < gallery-1.4.3-pl1_to_pl2.patch 
patching file ChangeLog 
Hunk #1 FAILED at 1. 
1 out of 1 hunk FAILED -- saving rejects to file ChangeLog.rej 
patching file Version.php 
Hunk #1 FAILED at 17. 
Hunk #2 FAILED at 31. 
2 out of 2 hunks FAILED -- saving rejects to file Version.php.rej 
patching file docs/g1package/index.html 
Hunk #1 FAILED at 2. 
1 out of 1 hunk FAILED -- saving rejects to file docs/g1package/index.html.rej 
patching file init.php 
patching file setup/check.inc 
patching file util.php 
Hunk #1 FAILED at 17. 
Hunk #2 succeeded at 2715 (offset -6 lines). 
1 out of 2 hunks FAILED -- saving rejects to file util.php.rej 
 
 
How do I check what version I have - the Gallery displays 1.4.3 but I have no idea what the pl number is. 
 
Leslie

Submitted by Not_Public on Tue, 2004-06-08 13:12.

note for the less *nix familiar: 
 
you need to run 
sh configure.sh 
from your gallery base dir before running patch

Submitted by floridave on Wed, 2004-06-09 04:51.

unzip the files local. 
FTP Init.php, util.php, Version.php and manifest.php. Overwrite exsisting files on the server. 
 
Dave

Submitted by signe on Wed, 2004-06-09 19:33.

If you're using 1.4.3-pl1, that's what it will say at the bottom of your Gallery. You need to download the full version of Gallery and install over the top. The patch only works for -pl1 to -pl2.

Submitted by signe on Wed, 2004-06-09 19:34.

As the original notice says, all Gallery versions from 1.2 through 1.4.3-pl1 are affected.

Submitted by cassandra on Mon, 2004-06-14 20:19.

I am running 1.4.1-pl1, would like to patch to 1.4.3-pl2. Can I upgrade directly from 1.4.1 or do I need to overwrite the whole program? 
 
Is there a patch from 1.4.1-1.4.3? 
 
I am little confused. Thanks for any help.

Submitted by phule on Mon, 2004-06-14 20:31.

I must have missed that part of the install. I'll try that now.

Submitted by signe on Mon, 2004-06-14 20:37.

You need to perform the full upgrade. There is no patch version from 1.4.1

Submitted by phule on Mon, 2004-06-14 20:41.

Is there a way to keep these as options but not make them the default?

Gallery

Random Image

Top album page

Navigation

User login

Support Gallery!

New forum topics

User Testimonial

Gallery 1.4.3-pl2 Security Release