Skip to content

Releases: mike-richardson-uk/mono-gallery

Release list

v1.0.1 — Security Patch

v1.0.1 — Security Patch Latest
Latest

Choose a tag to compare

View all tags
@mike-richardson-uk mike-richardson-uk released this 13 Jun 15:23
v1.0.1
43b6d0f

Security patch — all users should upgrade from v1.0.0

This release fixes 14 vulnerabilities identified in a comprehensive security audit, including 2 critical and 4 high severity issues.

Critical

  • SSRF in Apple Photos import: iCloud host validation was bypassable via subdomain confusion (e.g. icloud.com.evil.com). Now enforced with a strict regex against p{N}-sharedstreams.icloud.com.
  • SSRF via unvalidated asset download URLs in Apple Photos import: URLs from the API response are now validated for https scheme and Apple-owned hostname before download_url() is called.

High

  • Broken OAuth state check: wp_verify_nonce() arguments were swapped in Google Photos callback — the incoming state parameter was never actually verified. Fixed.
  • Unauthenticated OAuth callback: the Google OAuth redirect endpoint was publicly accessible. Now requires manage_options capability.
  • MIME type spoofing on upload: file type was validated from the filename extension only. Now uses wp_check_filetype_and_ext() (byte-level validation) plus getimagesize() confirmation.
  • XSS: admin settings tab labels were output without escaping. Fixed with esc_html().

Medium

  • Image proxy tokens now expire after 24 hours (previous window also accepted to avoid boundary issues).
  • Watermark cache write made atomic via temp-file-then-rename, eliminating a TOCTOU race condition.
  • Watermark cache key no longer includes Google OAuth client secrets.
  • Google OAuth tokens stored in a non-autoloaded wp_options row.
  • sort_order field validated against an explicit allowlist before storage.

Low

  • Plugin directory .htaccess added to block web access to .conf / .md / .txt files.
  • Leaflet map popup rebuilt via DOM API to eliminate an innerHTML XSS surface.
  • Leaflet 1.9.4 now loaded with verified SHA-256 Subresource Integrity hashes.
  • Apple Photos import error messages sanitised to prevent filesystem path leakage.

See the README changelog for the full list.

Assets 2
Loading

v1.0.0 — Initial Release

v1.0.0 — Initial Release

Choose a tag to compare

View all tags
@mike-richardson-uk mike-richardson-uk released this 13 Jun 10:47
v1.0.0
6735063

Mono Gallery v1.0.0

Minimal monochrome photography gallery plugin for WordPress, built for Cloudways.

Features

Gallery

  • CSS grid and masonry layouts
  • Lightbox with keyboard/swipe navigation and EXIF metadata panel
  • Leaflet.js GPS world map (grayscale, no API key required)
  • Search and album/tag filtering

Photo management

  • Drag-and-drop bulk uploader
  • EXIF extraction: camera, lens, aperture, shutter, ISO, focal length, GPS
  • Free-form tagging
  • Manual albums and smart albums (auto-populated by rules: camera, lens, date, location, tag, etc.)

Import

  • Google Photos — full OAuth2 integration
  • Apple Photos — iCloud Shared Albums import

Image protection

  • Signed HMAC proxy URLs (originals never exposed in HTML)
  • Referrer check, transparent overlay, CSS/JS drag/right-click blocking
  • .htaccess + Nginx rules for direct file access
  • Optional keyboard shortcut blocking

Watermark

  • Server-side GD watermarking — configurable text, position, opacity, size
  • Originals never modified

Performance (Cloudways-optimised)

  • Redis object cache integration
  • On-demand WebP conversion with Accept header negotiation
  • ETag / 304 Not Modified support
  • Cloudways Nginx config generator
  • Breeze/Varnish bypass headers

Installation

Upload mono-gallery/ to wp-content/plugins/ and activate. See the Setup & Help tab under Mono Gallery → Settings for the full Cloudways setup guide.

Loading