adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

Piwigo 11.3.0 - user unable to view folder and contents they DO HAVE permission to view when newly created folder permissions updated and images added via webservice calls #1189

New Issue
Open
opened 2026-10-05 00:35:20 +02:00 by adam · 2 comments
adam commented 2026-10-05 00:35:20 +02:00
Owner
Copy link
Copy source

Steps to reproduce:
0. log in as the non-admin user in a private webbrowser session.
0. log in as the admin user in a private webbrowser session.

  1. set default album permissions to admin only

  2. create new folder - pwg.categories.add - status:private

  3. call pwg.categories.getList cat_id:

  4. observe new album not visible (this is correct)

  5. pwg.permissions.add - group:, cat_id:

  6. call pwg.categories.getList cat_id:

  7. observe - album is not visible

  8. log out, and log in - still no visible album

  9. Add image to the new folder (accessible to all users) using the pwg.images.setInfo method.

  10. observe - album still not visible to non-admin user

  11. observe - album contents not visible to non-admin user if queried direct

If these steps are instead followed on the website webpages, then the album is visible to the user.
I suggest that the website webpage calls something extra when linking a photo to a folder other than that contained inside "pwg.images.setInfo".

I've spent a few hours reading through the php code but cannot find the necessary change.
I think the problem is that the USER_CACHE_CATEGORIES_TABLE is not being updated with a list of users who have indirect permission. I think this because of the album_notification.php file line 294 that merges direct and indirect permissions, but, maybe this is totally unrelated.

Needless to say, once the user is given explict rather than indirect permission to view the album, they can see it immediatly,

Steps to reproduce: 0. log in as the non-admin user in a private webbrowser session. 0. log in as the admin user in a private webbrowser session. 1. set default album permissions to admin only 2. create new folder - pwg.categories.add - status:private 3. call pwg.categories.getList cat_id:<parent id> 4. observe new album not visible (this is correct) 5. pwg.permissions.add - group:<the non-admin user containing group>, cat_id:<the newly created album id> 7. call pwg.categories.getList cat_id:<parent id> 8. observe - album is not visible 9. log out, and log in - still no visible album 10. Add image to the new folder (accessible to all users) using the pwg.images.setInfo method. 11. observe - album still not visible to non-admin user 12. observe - album contents not visible to non-admin user if queried direct If these steps are instead followed on the website webpages, then the album is visible to the user. I suggest that the website webpage calls something extra when linking a photo to a folder other than that contained inside "pwg.images.setInfo". I've spent a few hours reading through the php code but cannot find the necessary change. I *think* the problem is that the USER_CACHE_CATEGORIES_TABLE is not being updated with a list of users who have indirect permission. I think this because of the album_notification.php file line 294 that merges direct and indirect permissions, but, maybe this is totally unrelated. Needless to say, once the user is given explict rather than indirect permission to view the album, they can see it immediatly, <!-- github-sync-id:831766078 -->
adam commented 2026-10-05 00:35:21 +02:00
Author
Owner
Copy link
Copy source

Hello Extorn
thank you for your reports

Needless to say, once the user is given explicit rather than indirect permission to view the album, they can see it immediately,

just to be 100% sure: when you say direct/indirect that's a reference to the fact the permission is inherited from a group to the user, and not a refe to the child/parent system for albums

Hello Extorn thank you for your reports > Needless to say, once the user is given explicit rather than indirect permission to view the album, they can see it immediately, just to be 100% sure: when you say direct/indirect that's a reference to the fact the permission is inherited from a group to the user, and not a refe to the child/parent system for albums <!-- github-comment-id:799387813 -->
adam commented 2026-10-05 00:35:21 +02:00
Author
Owner
Copy link
Copy source

This is correct

This is correct <!-- github-comment-id:801867659 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#1189