6 files changed, 19 insertions, 62 deletions
diff --git a/inc/lib/minify/Minify/Controller/Base.php b/inc/lib/minify/Minify/Controller/Base.php
index 240b5449..5a863290 100755
--- a/inc/lib/minify/Minify/Controller/Base.php
+++ b/inc/lib/minify/Minify/Controller/Base.php
@@ -79,33 +79,6 @@ abstract class Minify_Controller_Base {
     }
     
     /**
-     * Load any code necessary to execute the given minifier callback.
-     * 
-     * The controller is responsible for loading minification code on demand
-     * via this method. This built-in function will only load classes for
-     * static method callbacks where the class isn't already defined. It uses
-     * the PEAR convention, so, given array('Jimmy_Minifier', 'minCss'), this 
-     * function will include 'Jimmy/Minifier.php'.
-     * 
-     * If you need code loaded on demand and this doesn't suit you, you'll need
-     * to override this function in your subclass. 
-     * @see Minify_Controller_Page::loadMinifier()
-     * 
-     * @param callback $minifierCallback callback of minifier function
-     * 
-     * @return null
-     */
-    public function loadMinifier($minifierCallback)
-    {
-        if (is_array($minifierCallback)
-            && is_string($minifierCallback[0])
-            && !class_exists($minifierCallback[0], false)) {
-            
-            require str_replace('_', '/', $minifierCallback[0]) . '.php';
-        }
-    }
-    
-    /**
      * Is a user-given file within an allowable directory, existing,
      * and having an extension js/css/html/txt ?
      * 
@@ -244,7 +217,6 @@ abstract class Minify_Controller_Base {
      * @return null
      */
     public function log($msg) {
-        require_once 'Minify/Logger.php';
         Minify_Logger::log($msg);
     }
 }
diff --git a/inc/lib/minify/Minify/Controller/Files.php b/inc/lib/minify/Minify/Controller/Files.php
index 83f028ad..f084cd07 100755
--- a/inc/lib/minify/Minify/Controller/Files.php
+++ b/inc/lib/minify/Minify/Controller/Files.php
@@ -4,8 +4,6 @@
  * @package Minify
  */
 
-require_once 'Minify/Controller/Base.php';
-
 /**
  * Controller class for minifying a set of files
  * 
diff --git a/inc/lib/minify/Minify/Controller/Groups.php b/inc/lib/minify/Minify/Controller/Groups.php
index 2d4e43b2..c4c25db1 100755
--- a/inc/lib/minify/Minify/Controller/Groups.php
+++ b/inc/lib/minify/Minify/Controller/Groups.php
@@ -4,8 +4,6 @@
  * @package Minify
  */
 
-require_once 'Minify/Controller/Base.php';
-
 /**
  * Controller class for serving predetermined groups of minimized sets, selected
  * by PATH_INFO
diff --git a/inc/lib/minify/Minify/Controller/MinApp.php b/inc/lib/minify/Minify/Controller/MinApp.php
index d47c60d9..6943ee6b 100755
--- a/inc/lib/minify/Minify/Controller/MinApp.php
+++ b/inc/lib/minify/Minify/Controller/MinApp.php
@@ -4,8 +4,6 @@
  * @package Minify
  */
 
-require_once 'Minify/Controller/Base.php';
-
 /**
  * Controller class for requests to /min/index.php
  * 
@@ -22,6 +20,13 @@ class Minify_Controller_MinApp extends Minify_Controller_Base {
      * @return array Minify options
      */
     public function setupSources($options) {
+        // PHP insecure by default: realpath() and other FS functions can't handle null bytes.
+        foreach (array('g', 'b', 'f') as $key) {
+            if (isset($_GET[$key])) {
+                $_GET[$key] = str_replace("\x00", '', (string)$_GET[$key]);
+            }
+        }
+
         // filter controller options
         $cOptions = array_merge(
             array(
@@ -36,7 +41,6 @@ class Minify_Controller_MinApp extends Minify_Controller_Base {
         $sources = array();
         $this->selectionId = '';
         $firstMissingResource = null;
-        
         if (isset($_GET['g'])) {
             // add group(s)
             $this->selectionId .= 'g=' . $_GET['g'];
@@ -195,9 +199,12 @@ class Minify_Controller_MinApp extends Minify_Controller_Base {
     protected function _getFileSource($file, $cOptions)
     {
         $spec['filepath'] = $file;
-        if ($cOptions['noMinPattern']
-            && preg_match($cOptions['noMinPattern'], basename($file))) {
-            $spec['minifier'] = '';
+        if ($cOptions['noMinPattern'] && preg_match($cOptions['noMinPattern'], basename($file))) {
+            if (preg_match('~\.css$~i', $file)) {
+                $spec['minifyOptions']['compress'] = false;
+            } else {
+                $spec['minifier'] = '';
+            }
         }
         return new Minify_Source($spec);
     }
diff --git a/inc/lib/minify/Minify/Controller/Page.php b/inc/lib/minify/Minify/Controller/Page.php
index de471e12..1095fb46 100755
--- a/inc/lib/minify/Minify/Controller/Page.php
+++ b/inc/lib/minify/Minify/Controller/Page.php
@@ -4,8 +4,6 @@
  * @package Minify
  */
 
-require_once 'Minify/Controller/Base.php';
-
 /**
  * Controller class for serving a single HTML page
  * 
@@ -59,7 +57,6 @@ class Minify_Controller_Page extends Minify_Controller_Base {
                 'cssMinifier' => array('Minify_CSS', 'minify')
                 ,'jsMinifier' => array('JSMin', 'minify')
             );
-            $this->_loadCssJsMinifiers = true;
             unset($options['minifyAll']);
         }
         $this->sources[] = new Minify_Source($sourceSpec);
@@ -67,21 +64,5 @@ class Minify_Controller_Page extends Minify_Controller_Base {
         $options['contentType'] = Minify::TYPE_HTML;
         return $options;
     }
-    
-    protected $_loadCssJsMinifiers = false;
-    
-    /**
-     * @see Minify_Controller_Base::loadMinifier()
-     */
-    public function loadMinifier($minifierCallback)
-    {
-        if ($this->_loadCssJsMinifiers) {
-            // Minify will not call for these so we must manually load
-            // them when Minify/HTML.php is called for.
-            require_once 'Minify/CSS.php';
-            require_once 'JSMin.php';
-        }
-        parent::loadMinifier($minifierCallback); // load Minify/HTML.php
-    }
 }
 
diff --git a/inc/lib/minify/Minify/Controller/Version1.php b/inc/lib/minify/Minify/Controller/Version1.php
index 5279d36d..91fcf614 100755
--- a/inc/lib/minify/Minify/Controller/Version1.php
+++ b/inc/lib/minify/Minify/Controller/Version1.php
@@ -4,8 +4,6 @@
  * @package Minify
  */
 
-require_once 'Minify/Controller/Base.php';
-
 /**
  * Controller class for emulating version 1 of minify.php (mostly a proof-of-concept)
  * 
@@ -26,6 +24,11 @@ class Minify_Controller_Version1 extends Minify_Controller_Base {
      * 
      */
     public function setupSources($options) {
+        // PHP insecure by default: realpath() and other FS functions can't handle null bytes.
+        if (isset($_GET['files'])) {
+            $_GET['files'] = str_replace("\x00", '', (string)$_GET['files']);
+        }
+
         self::_setupDefines();
         if (MINIFY_USE_CACHE) {
             $cacheDir = defined('MINIFY_CACHE_DIR')
@@ -51,8 +54,7 @@ class Minify_Controller_Version1 extends Minify_Controller_Base {
         ) {
             return $options;
         }
-        $extension = $m[1];
-        
+
         $files = explode(',', $_GET['files']);
         if (count($files) > MINIFY_MAX_FILES) {
             return $options;
@@ -63,7 +65,6 @@ class Minify_Controller_Version1 extends Minify_Controller_Base {
             . DIRECTORY_SEPARATOR;
         $prependAbsPaths = $_SERVER['DOCUMENT_ROOT'];
         
-        $sources = array();
         $goodFiles = array();
         $hasBadSource = false;