Gallery v1.3.4-pl1 security release

We received email this morning from Larry Nguyen, an alert and responsible Gallery user who notified us about a cross-site-scripting flaw in Gallery that affects all released versions from v1.1 to v1.3.4. This security flaw can allow a malicious user to craft a URL that executes Javascript code on your website.

We estimate the security risk of this flaw to be relatively minor, however we take all security issues very seriously. You can download patch instructions or a complete version of Gallery including the new changes from the Download Page on SourceForge.

Read on for more information on the vulnerability, cross site scripting, and a simple one-character-change quick fix.
The simple fix is to edit search.php and change this line:

$searchString = removeTags($searchstring);

to:

$searchstring = removeTags($searchstring);

Note that the entire change is in the capitalization of a single letter. This is a very simple fix that you can make trivially with your text editor. To test the error, try searching for the following:

in your Gallery. If it shows a Javascript popup window, then you didn't make the change correctly.

Cross site scripting is a technique where one user manages to embed special Javascript commands into a website such that another user executes them. This javascript code can do a variety of bad things. This particular vulnerability is not as severe, because the user would have to arrange for you to click upon a URL that they send you containing the javascript (since search terms are not saved anywhere in Gallery).