Gallery 1.5.8 is now available for download. This release fixes many security issues including some serious security issues. It also resolves as well as a handful of bugs and reorganizes the internal API some (which is documented here). We strongly recommend that all users of Gallery 1.5.7 and earlier upgrade to this release to protect your Gallery installation. You can download Gallery 1.5.8 from the Gallery 1 download page on SourceForge. Upgrade instructions are available on our documentation site. Please discuss any issues specific to this release in this forum thread.
One security issue was reported to us in private by the Digital Security Research Group [GSecRG] who were professional and are waiting until after this release to publish their findings.
The most of the security issues resolved in this release are the result of a security audit performed by Gotham Digital Science (GDS). They are experts in application security, as this is the primary focus of their business. We recognize that hiring external consultants to perform security audits does not guarantee that our code is bug-free and by no means un-hackable, but it clearly indicates our willingness to perform due diligence to make sure our code is reasonably secure. The combination of an external perspective of security experts and the insight of internal experts both performing detailed audits is yielding much better results than only one of the two perspectives alone. While these security fixes are not in our public source code repository prior to the release, we will begin adding them to it as soon as possible once this story is posted.
