Hi uhhhh,
Good points. I'll try to incorporate them where I can.
1 & 2. (Loading the js on every page problem) You see the problem I've been stuck with. I don't want to have the user figure out which pages they're going to have the shortcode on, it's already complicated enough (as the support volume would indicate). Some users have PhotoSmash only on a couple of pages, some users have it on every page in their site, and that can be hundreds of pages (see the corn snake site for an example...there's a link buried somewhere in this forum).
3) Agreed...The next big thing (after the one I'm currently working on) is just that. I even posted a blog post to that effect http://smashly.net/blog/facing-future/ back on April 22.
The start over that you reference is related to a major switch from using a 3rd party library (Upload Class) for the image uploads to using the Standard WordPress upload libraries (you have to understand that this was my first real plugin so I am learning as I went). Unfortunately, I couldn't completely drop the legacy code because there were some people I helped build sites with it. I haven't figured out how to get them moved to the new code without redoing their stuff. There are indeed a few stubs for features that I backed off implementing, particularly around file/video uploads. I was concerned about the security implications of allowing the loading files that could not be verified. At least with images, WordPress handles that verification.
4) If you figure out what going on with your test, please let me know. I have PhotoSmash installed on several WP 3.0 instances and none of them have problems. No one else has reported any issues around this either, and there are >1,000 active users from the best I can tell.
5) Thanks for not post that publicly. Please email me through the Contacts page: http://smashly.net/contact/ as soon as possible. I have been very concerned about this topic and have tried to be diligent in using various WP/PHP methods for validating user input, but that doesn't mean that I haven't let something slip through. To guard against SQL injection, I use: (int), $wpdb->insert(), $wpdb->update(), and $wpdb->prepare. To guard against XSS, all user input is run through wp_kses. Please let me know of any holes you've found in this. I do feel it my duty to keep this code as safe for my users as possible.
6) The 777 nonsense is a relic from the Upload Class that was used in the original versions. Some users systems would not allow the creation of folders with 755. Tons of problems. I leveraged code/ideas from NextGEN Gallery to deal with those issues. Finally, I figured out how to use the standard WordPress function for uploading images through the Media Library, and I gained integration with the Media Library as a result. Best move I've made with PhotoSmash. Again, I can't kill the old code without damaging certain people. I've been considering forking PhotoSmash, but haven't divined how to do it in such a way that the Legacy app gets forked and the good one continues on.
7) Dude, if you've got some suggestions for making this thing tighter and more solid, I am 150% ready to listen. There have been a number of people who have stepped up and provided some suggestions, guidance, code, criticism, help on the forums, etc. I could not be any happier for their help.
I do appreciate the kind words about the plugin. Hopefully most people will recognize that it's a pretty decent plugin. But for people who are more technically inclined and are thinking beyond just a photo gallery, I hope that they can see that it is a fair piece beyond just a gallery. You could use it to build data collection forms and display that data back in spreadsheet format (with or without images), or with PhotoSmash Extend to create a new post, categorized and tagged for each entry. You could make it do a Contact form, etc. But, the ugly code and my lack of styling skills don't do it any favors. The trouble has been that my vision for the plugin has outstripped my experience and available time to devote to it. So, any help I get is soooo appreciated.
To have someone else looking at the code is a God-send. When they say 2 sets of eyes are better than 1, it is 1000 times more true when it comes to code.
As I stated in that blog post, a major cleanup and reorganization is on the horizon. Maybe I'll make it to version 1.0 eventually!
Thanks again for the comments. I look forward to what you find.
Cheers,
Byron