--- brilliant_gallery-orig.module	2009-09-07 18:17:11.000000000 -0400
+++ brilliant_gallery.module	2009-09-07 18:04:41.000000000 -0400
@@ -359,14 +359,14 @@
   $rp = file_directory_path();
   if ($galleryfolder <> '') {
     $rp .= '/'. $galleryfolder;
   }
-  $absolpath = realpath($rp);
+  $absolpath = $rp;
   $result .= '<p>';
   $result .= '<p>This page allows you to set or unset visibility of each image (data item) in all Brilliant galleries there are on this website.';
   #$result .= '<p><b>Files folder:</b> ' . file_directory_path() . '/';
   ob_start();
-  $recurs = bg_iterative_recurse_dir($absolpath);
+  $recurs = bg_iterative_recurse_dir(realpath($absolpath));
   #echo '<pre>'; print_r( $recurs ); echo '</pre>';
   #echo '<pre>'; print_r( $retval_dimensions ); echo '</pre>';
   $result .= ob_get_contents();
   $dirshavefiles = array();
@@ -386,14 +386,15 @@
     }
     else {
       $rootfolder = '';
     }
-    $path_middle = str_replace($absolpath, '', $key);
+    $path_middle = str_replace(realpath($absolpath), '', $key);
+    $gallerypath = '/' . $galleryfolder . $path_middle;
     $result .= '<li><a href="?fld='. $galleryfolder . $path_middle .'">'. $galleryfolder . $path_middle . $rootfolder .'</a></li>';
     if ($galleryfolder . $path_middle == $_GET['fld']) {
       # User has asked to manage images in this folder.
       $tablerows         = array();
-      $temp              = load_dir_to_array($key, variable_get('brilliant_gallery_maximagewidth', 150), variable_get('brilliant_gallery_maxwidth', '1000'), 1);
+      $temp              = load_dir_to_array($gallerypath, variable_get('brilliant_gallery_maximagewidth', 150), variable_get('brilliant_gallery_maxwidth', '1000'), 1);
       $retval_dimensions = $temp[0];
       $imagemaxh         = $temp[1];
       $maxpoct           = count($retval_dimensions);
       #echo '<p>max: ' . $maxpoct;
@@ -430,9 +431,9 @@
           #}
           #else {
             # Important to begin with the "/" otherwise thumbnails in non-root folders fail. See http://drupal.org/node/175292
             #&dummy=.jpg
-            $displayimage .= '<a href="'. $modulepath .'/image.php?imgp='. base64_encode($absolpath . $path_middle .'/'. $retval[$poct - 1]) .'&amp;imgw='. $imgwbig .'&amp;imgh='. $imghbig .'"';
+            $displayimage .= '<a href="'. $modulepath .'/image.php?imgp='. base64_encode($gallerypath .'/'. $retval[$poct - 1]) .'&amp;imgw='. $imgwbig .'&amp;imgh='. $imghbig .'"';
           #}
 
           switch ($overbrowser) {
               
@@ -463,9 +464,9 @@
             $displayimage .= ' title="'. $caption .'"';
           }
           $displayimage .= '>';
           # width="' . $imgw . '"
-          $displayimage .= '<img style="border: 0; margin:0px; padding:0px;" alt="" src="'. $modulepath .'/image.php?imgp='. base64_encode($absolpath . $path_middle .'/'. $retval[$poct - 1]) .'&amp;imgw='. $imgw .'&amp;imgh='. $imgh .'" />';
+          $displayimage .= '<img style="border: 0; margin:0px; padding:0px;" alt="" src="'. $modulepath .'/image.php?imgp='. base64_encode($gallerypath .'/'. $retval[$poct - 1]) .'&amp;imgw='. $imgw .'&amp;imgh='. $imgh .'" />';
           $displayimage .= '</a>';
         }
         else {
           $displayimage .= '<a href="'. $fullimgpath .'">';
@@ -633,13 +634,9 @@
     #echo $absolpath;
     #drupal_set_message(t('absol: '.$absolpath));
   }
   else {
-    $rp = file_directory_path();
-    if ($galleryfolder <> '') {
-      $rp .= '/'. $galleryfolder;
-    }
-    $absolpath = realpath($rp);
+    $absolpath = '/'. $galleryfolder;
   }
   #$result .= $absolpath;
 
   # Make an array with images in this folder, and their properties.
--- image-orig.php	2009-07-03 12:06:18.000000000 -0400
+++ image.php	2009-09-07 18:10:11.000000000 -0400
@@ -1,9 +1,14 @@
 <?php
 /* $Id: image.php,v 1.15.2.3.2.2.2.3 2009/07/03 16:06:18 tjfulopp Exp $ */
 
-if (strpos(base64_decode($_GET['imgp']), "://") !== false) {
-  # Fixing a possible URL injection problem. Using ':' was not enough because Windows paths contain it as well.
+/* check for bad URL inputs */
+$urlpath = base64_decode($_GET['imgp']);
+if (strpos($urlpath, "://") !== false ||
+	strpos($urlpath, "..") !== false ||
+	preg_match('/\D/', ($_GET['imgw'] . $_GET['imgh'])) > 0 ||
+	($_GET['imgw'] + $_GET['imgh']) < 10 ||
+	($_GET['imgw'] + $_GET['imgh']) > 20000 ) {
   header("HTTP/1.0 404 Not Found");
   exit();
 }
 
@@ -13,12 +18,16 @@
     chdir('..');
   }
   #module_load_include('/includes/bootstrap.inc', 'image', 'includes/bootstrap');
   require_once './includes/bootstrap.inc';
+  require_once './includes/file.inc';
   drupal_bootstrap(DRUPAL_BOOTSTRAP_FULL); // See http://drupal.org/node/211378#comment-924059
   #drupal_bootstrap(DRUPAL_BOOTSTRAP_DATABASE);
   #drupal_cron_run();
 }
+
+$imagepath = realpath(file_directory_path() . $urlpath);
+
 # Crucial - to suppress Devel (if installed and enabled) output appearing in the generated XML!
 $GLOBALS['devel_shutdown'] = FALSE;
 # Cache expiration time.
 $bgcachexpire = 3600 * 24 * 3;
@@ -114,11 +123,9 @@
   return $my_data;
 }
 
 function resizeimage($imgp, $imgw, $imgh) {
-  $imagepath = base64_decode($imgp);
-  #echo '.... ' . base64_decode( $imgp );
-  #flush();die(' stop!');
+  global $imagepath;
   # Thanks to Michał Albrecht!
   $suffix = strtolower(substr($imagepath, -4));
   $imgsize = @getimagesize($imagepath);
   # http://be.php.net/getimagesize
--- functions-orig.inc	2009-09-07 18:17:26.000000000 -0400
+++ functions.inc	2009-09-07 18:13:27.000000000 -0400
@@ -39,9 +39,10 @@
 function load_dir_to_array($absolpath, $imagewidth, $fullresolutionmaxwidth, $brilliant_gallery_sort) {
   # Load Directory Into Array
   $poct              = -1;
   $retval_dimensions = array();
-  $handle            = opendir($absolpath);
+  $actualpath        = realpath(file_directory_path() . $absolpath);
+  $handle            = opendir($actualpath);
   $imagemaxh         = 0;
   while ($file = @readdir($handle)) {
     $testending = strtolower(substr($file, -4, 4));
     if (!testext($file) and strtolower($testending) <> '.mpg' and strtolower($testending) <> '.swf' and strtolower($testending) <> '.mov' and strtolower($testending) <> '.avi') {
@@ -52,9 +53,9 @@
     #$retval[$poct] = $file;
     $retval_dimensions[$poct]['file'] = $file;
 
     # Is image horizontally or vertically oriented?
-    $temp = getimagesize($absolpath .'/'. $file);
+    $temp = getimagesize($actualpath .'/'. $file);
     if ($temp === false) {
       continue;
     }
     if (($temp[0] - $temp[1]) >= 0) {