remove guest from users list in album permission #1676

New Issue

Open

opened 2026-10-05 00:52:33 +02:00 by adam · 6 comments

adam commented 2026-10-05 00:52:33 +02:00

Owner

Copy link

Copy source

When making an album private, user "guest" is listed like any other user to be granted access. While it's a feature used by a very few administrators, it is far more often used by mistake. I would prefer to have "guest" removed. The problem is that we can't disable it in case it was used on purpose. So I propose to have a configuration setting like $conf['album_permissions_list_guest'] to false by default, unless it was used in the past.

When making an album private, user "guest" is listed like any other user to be granted access. While it's a feature used by a very few administrators, it is far more often used by mistake. I would prefer to have "guest" removed. The problem is that we can't disable it in case it was used on purpose. So I propose to have a configuration setting like `$conf['album_permissions_list_guest']` to `false` by default, unless it was used in the past. <img width="680" alt="Screenshot 2023-05-16 at 12 23 10" src="https://github.com/Piwigo/Piwigo/assets/9326959/0bd8830e-d594-4484-8b47-0bb9d26466d1"> <!-- github-sync-id:1711721753 -->

adam commented 2026-10-05 00:52:34 +02:00

Author

Owner

Copy link

Copy source

Actually it's more a "manage permissions for guest" settings which includes:

• listing "guest" in the list of users for album permission
• "guest" user edit popin : "permissions" button, associate to groups, set the privacy level

Actually it's more a "manage permissions for guest" settings which includes: - listing "guest" in the list of users for album permission - "guest" user edit popin : "permissions" button, associate to groups, set the privacy level <!-- github-comment-id:1549485386 -->

adam commented 2026-10-05 00:52:35 +02:00

Author

Owner

Copy link

Copy source

A few thoughts about this topic...

If manage permissions for guest is set to false, should we allow "guest" to be added to a group?

If an administrator switches this setting to false and that "guest" had permissions or was in a group (with permissions), should Piwigo remove permissions and remove "guest" from its groups? (I would say "yes")

A few thoughts about this topic... If `manage permissions for guest` is set to `false`, should we allow "guest" to be added to a group? If an administrator switches this setting to `false` and that "guest" had permissions or was in a group (with permissions), should Piwigo remove permissions and remove "guest" from its groups? (I would say "yes") <!-- github-comment-id:1748938426 -->

adam commented 2026-10-05 00:52:35 +02:00

Author

Owner

Copy link

Copy source

Hi Pierrick!

If manage permissions for guest is set to false, should we allow "guest" to be added to a group?

it should still be able to, since plugins may use "technical" groups in order to set permissions, options etc. to several users at once.

If an administrator switches this setting to false and that "guest" had permissions or was in a group (with permissions), should Piwigo remove permissions and remove "guest" from its groups? (I would say "yes")

That's tricky technically but yes: if someone use the Guest for permissions then change its mind, he probably expects Piwigo to remove Guest from the permission list of all albums

Hi Pierrick! > If `manage permissions for guest` is set to `false`, should we allow "guest" to be added to a group? it should still be able to, since plugins may use "technical" groups in order to set permissions, options etc. to several users at once. > If an administrator switches this setting to `false` and that "guest" had permissions or was in a group (with permissions), should Piwigo remove permissions and remove "guest" from its groups? (I would say "yes") That's tricky technically but yes: if someone use the Guest for permissions then change its mind, he probably expects Piwigo to remove Guest from the permission list of all albums <!-- github-comment-id:1748978183 -->

adam commented 2026-10-05 00:52:36 +02:00

Author

Owner

Copy link

Copy source

If manage permissions for guest is set to false, should we allow "guest" to be added to a group?

it should still be able to, since plugins may use "technical" groups in order to set permissions, options etc. to several users at once.

Do you have a specific example in mind where it would be useful to have "guest" permitted to do something thanks to belonging to a group?

I agree that groups are not only for album permissions, but I would like to have some good arguments to keep "guest" in groups.

I also don't think it would be a good idea to have "guest" in groups but not taking it into account for permissions.

> > If `manage permissions for guest` is set to `false`, should we allow "guest" to be added to a group? > > it should still be able to, since plugins may use "technical" groups in order to set permissions, options etc. to several users at once. Do you have a specific example in mind where it would be useful to have "guest" permitted to do something thanks to belonging to a group? I agree that groups are not only for album permissions, but I would like to have some good arguments to keep "guest" in groups. I also don't think it would be a good idea to have "guest" in groups but not taking it into account for permissions. <!-- github-comment-id:1749021050 -->

adam commented 2026-10-05 00:52:37 +02:00

Author

Owner

Copy link

Copy source

You know it's been a while since I'm not into it.
I don't have specific examples indeed.

You know it's been a while since I'm not into it. I don't have specific examples indeed. <!-- github-comment-id:1749057978 -->

adam commented 2026-10-05 00:52:38 +02:00

Author

Owner

Copy link

Copy source

Today a user reported a "bug": 2 of her private albums were visible to anonymous visitors. Of course, it was because the 2 private albums had been authorized to guest.

Even with the manage permissions for guest setting could make things confused. We should also have a specific warning on the permissions page for guest:

Warning, you're editing permissions for anonymous visitors. Do it knowingly.

Today a user reported a "bug": 2 of her private albums were visible to anonymous visitors. Of course, it was because the 2 private albums had been authorized to `guest`. Even with the `manage permissions for guest` setting could make things confused. We should also have a specific warning on the permissions page for guest: > Warning, you're editing permissions for anonymous visitors. Do it knowingly. <!-- github-comment-id:2589650932 -->

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

master

issue-2560-people

translation

16.x

feat/embedding-based-contextual-tagging

issue-2576-search-include-ai-in-search-results

feat/search-ocr-ai

issue-2391-update-menu-design

15.x

detect-container

issue-2386-update-filters-users-activity

issue-2362-add-filters-options-in-admin

issue-2367-imagemagick7

issue-2225-quicksearch-help

14.x

issue-2164-BatchManagerUnitMode-Redesign

13.x

12.x

issue-1657-SVG_Support

issue-1703-historySearchMethod

11.x

2.10

2.9

2.8

2.7

2.5

2.6

2.4

2.3

2.2

2.1

2.0

1.7

1.3

1.6

1.5

1.4

16.4.0

16.3.0

16.2.0

16.1.0

16.0.0

16.0.0RC3

16.0.0RC2

15.7.0

16.0.0RC1

16.0.0beta1

16.0.0beta2

15.6.0

15.5.0

15.4.0

15.3.0

15.2.0

15.1.0

15.0.0

15.0.0beta3

15.0.0beta2

15.0.0beta1

14.5.0

14.4.0

14.3.0

14.2.0

14.1.0

14.0.0

14.0.0RC2

14.0.0RC1

14.0.0beta3

14.0.0beta2

13.8.0

14.0.0beta1

13.7.0

13.6.0

13.5.0

13.4.0

13.3.0

13.2.0

13.1.0

13.0.0

13.0.0RC4

13.0.0RC3

13.0.0RC2

13.0.0RC1

12.3.0

13.0.0beta2

13.0.0beta1

12.2.0

12.1.0

12.0.0

12.0.0RC2

12.0.0RC1

12.0.0beta2

12.0.0beta1

11.5.0

11.4.0

11.3.0

11.2.0

11.1.0

11.0.0

11.0.0beta5

2.11.0beta4

2.11.0beta3

2.11.0beta2

2.11.0beta1

2.10.2

2.10.1

2.10.0

2.10.0RC1

2.10.0beta2

2.10.0beta1

2.9.5

2.9.4

2.9.3

2.9.2

2.9.1

2.9.0

2.9.0RC2

2.9.0RC1

2.9.0beta2

2.8.6

2.8.5

2.8.4

2.9.0beta1

2.8.3

2.8.2

2.8.1

2.8.0

2.8.0RC2

2.8.0RC1

2.7.4

2.7.3

2.6.5

2.5.6

2.5.5

2.6.4

2.7.2

2.7.1

2.7.0

2.7.0RC2

2.7.0RC1

2.7.0beta2

2.6.3

2.7.0beta1

2.6.2

2.5.4

2.6.1

2.6.0

2.6.0RC2

2.6.0RC1

2.6.0beta2

2.5.3

2.5.2

2.6.0beta1

2.5.1

2.5.0

2.5.0RC2

2.4.7

2.5.0RC1

2.4.6

2.5.0beta3

2.5.0beta2

2.5.0beta1

2.4.5

2.4.4

2.4.3

2.4.2

2.4.1

2.4.0

2.3.5

2.4.0RC3

2.3.4

2.4.0RC2

2.4.0RC1

2.3.3

2.4.0beta2

2.4.0beta1

2.3.2

2.3.1

2.3.0

2.3.0RC2

2.3.0RC1

2.2.5

2.3.0beta3

2.2.4

2.3.0beta2

2.2.3

2.2.2

2.3.0beta1

2.2.1

2.2.0

2.2.0RC4

2.2.0RC3

2.2.0RC2

2.1.6

2.2.0RC1

2.1.5

2.1.4

2.1.3

2.1.2

2.1.1

2.1.0

2.0.10

2.1.0RC3

2.1.0RC2

2.1.0RC1

2.0.9

2.0.8

2.0.7

2.0.6

2.0.5

2.0.4

2.0.3

2.0.2

2.0.1

2.0.0

2.0.0RC4

1.7.3

2.0.0RC3

2.0.0RC2

2.0.0RC1

1.7.2

1.7.1

1.7.0

1.7.0RC2

1.7.0RC1

1.6.2

1.6.1

1.6.0

1.6.0RC2

1.6.0RC1

1.5.2

1.5.1

1.5.0

1.5.0RC2

1.5.0RC1

1.4.1

1.4.0

1.4.0RC3

1.4.0RC2

1.3.4

1.4.0RC1

1.3.3

1.3.2

1.3.1

1.3.0

1.3.0RC2

1.3.0RC1

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

adam (Adam Wojcieszonek)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/Piwigo#1676