modxcms/Gallery — pull request #46 by stackcoder (2014-09-13 11:28:05+00:00)
Title: Let modx configure phpthumb again

Since commit 092027d6f59b900e810f8943edbd35761ccd2de4 (merged by https://github.com/modxcms/Gallery/pull/30) various configurations are missing. Especially the important cache limit configurations, so the cache would grow until infinity.

You can easily reproduce this with the following line of bash code:
```
for i in {1..5000}; do wget "http://localhost/modx/assets/components/gallery/connector.php?action=web/phpthumb&ctx=web&w=$i&h=$i&zc=1&far=C&q=90&src=%2Fmodx%2F%2Fmodx%2Fassets%2Fgallery%2F3%2F32.jpg" -O /dev/null; done
```
Every Gallery 1.7.0 installation should be vulnerable to this.

Full list of missing settings:
- config_allow_src_above_docroot
- config_cache_maxage
- config_cache_maxsize
- config_cache_maxfiles
- config_error_bgcolor
- config_error_textcolor
- config_error_fontsize
- config_nohotlink_enabled
- config_nohotlink_valid_domains
- config_nohotlink_erase_image
- config_nohotlink_text_message
- config_nooffsitelink_enabled
- config_nooffsitelink_valid_domains
- config_nooffsitelink_require_refer
- config_nooffsitelink_erase_image
- config_nooffsitelink_watermark_src
- config_nooffsitelink_text_message
- cache_source_enabled
- cache_source_directory
- allow_local_http_src
- zc
- far
- cache_directory_depth
- config_ttf_directory

Please consider using the preconfigured modPhpThumb again. Alternatively there is still the older galPhpThumb left here (which should be removed if it's unused).

Another way could be replacing the phpthumb processor by using user defined snippets like [[phpThumbsUp]] which would also prevent duplicated cache entries caused by using them together with Gallery. Whats the reason for an own cache folder, why not using the default cache folder provided by the system instead?