adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-31 06:02:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

Admin users are unable to access their personal private albums via the API (2.8.0) #426

New Issue
Open
opened 2026-10-04 23:57:43 +02:00 by adam · 12 comments
adam commented 2026-10-04 23:57:43 +02:00
Owner
Copy link
Copy source

I found that turning an album private hides it from the API, just like it did in earlier versions of Piwigo, when the current user is an admin.
I went though the code and noticed that in ws_categories_getList() you are excluding all private albums when the current user has administrative permissions. However, you are not checking if the albums are owned by the current user (i.e the admin itself). Sure, you need to exclude private albums of OTHER users, but not the ones that are owned by the current user. I believe the issue is with the calculate_permissions() function, which checks for categories that are authorized explicitly to the user, as well as to the groups the user belongs to, but it doesn't check for the ownership of private albums (i.e. implicit authorization).

If I add the following fragment of code, calculate_permissions() works correctly:

  // retrieve category ids owned by the user
  $query = '
SELECT cat_id
  FROM '.USER_CACHE_CATEGORIES_TABLE.'
  WHERE user_id = '.$user_id.'
;';
  $authorized_array =
    array_merge(
      $authorized_array,
      query2array($query,null, 'cat_id')
      );
I found that turning an album private hides it from the API, just like it did in earlier versions of Piwigo, when the current user is an admin. I went though the code and noticed that in ws_categories_getList() you are excluding all private albums when the current user has administrative permissions. However, you are not checking if the albums are owned by the current user (i.e the admin itself). Sure, you need to exclude private albums of OTHER users, but not the ones that are owned by the current user. I believe the issue is with the calculate_permissions() function, which checks for categories that are authorized explicitly to the user, as well as to the groups the user belongs to, but it doesn't check for the ownership of private albums (i.e. implicit authorization). If I add the following fragment of code, calculate_permissions() works correctly: ``` // retrieve category ids owned by the user $query = ' SELECT cat_id FROM '.USER_CACHE_CATEGORIES_TABLE.' WHERE user_id = '.$user_id.' ;'; $authorized_array = array_merge( $authorized_array, query2array($query,null, 'cat_id') ); ``` <!-- github-sync-id:142547320 -->
adam commented 2026-10-04 23:57:45 +02:00
Author
Owner
Copy link
Copy source

Hello
Not a bug for me An administrator or webmaster is not omniscient either
online or in the Api
Le 22 mars 2016 05:49, "vvinogradsky" notifications@github.com a écrit :

I found that turning an album private hides it from the API, just like it
did in earlier versions of Piwigo, when the current user is an admin.
I went though the code and noticed that in ws_categories_getList() you are
excluding all private albums when the current user has administrative
permissions. However, you are not checking if the albums are owned by the
current user (i.e the admin itself). Sure, you need to exclude private
albums of OTHER users, but not the ones that are owned by the current user.
I believe the issue is with the calculate_permissions() function, which
checks for categories that are authorized explicitly to the user, as well
as to the groups the user belongs to, but it doesn't check for the
ownership of private albums (i.e. implicit authorization).

If I add the following fragment of code, calculate_permissions() works
correctly:

// retrieve category ids owned by the user
$query = '
SELECT cat_id
FROM '.USER_CACHE_CATEGORIES_TABLE.'
WHERE user_id = '.$user_id.'
;';
$authorized_array =
array_merge(
$authorized_array,
query2array($query,null, 'cat_id')
);

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub
https://github.com/Piwigo/Piwigo/issues/445

Hello Not a bug for me An administrator or webmaster is not omniscient either online or in the Api Le 22 mars 2016 05:49, "vvinogradsky" notifications@github.com a écrit : > I found that turning an album private hides it from the API, just like it > did in earlier versions of Piwigo, when the current user is an admin. > I went though the code and noticed that in ws_categories_getList() you are > excluding all private albums when the current user has administrative > permissions. However, you are not checking if the albums are owned by the > current user (i.e the admin itself). Sure, you need to exclude private > albums of OTHER users, but not the ones that are owned by the current user. > I believe the issue is with the calculate_permissions() function, which > checks for categories that are authorized explicitly to the user, as well > as to the groups the user belongs to, but it doesn't check for the > ownership of private albums (i.e. implicit authorization). > > If I add the following fragment of code, calculate_permissions() works > correctly: > > // retrieve category ids owned by the user > $query = ' > SELECT cat_id > FROM '.USER_CACHE_CATEGORIES_TABLE.' > WHERE user_id = '.$user_id.' > ;'; > $authorized_array = > array_merge( > $authorized_array, > query2array($query,null, 'cat_id') > ); > > — > You are receiving this because you are subscribed to this thread. > Reply to this email directly or view it on GitHub > https://github.com/Piwigo/Piwigo/issues/445 <!-- github-comment-id:199663872 -->
adam commented 2026-10-04 23:57:45 +02:00
Author
Owner
Copy link
Copy source

@vvinogradsky the api method pwg.categories.getList has a parameter "public". Set it to false to retrieve all the albums (e.g. ignore the permissions). Of cours this parameter works only for admins/webmasters

@vvinogradsky the api method pwg.categories.getList has a parameter "public". Set it to false to retrieve all the albums (e.g. ignore the permissions). Of cours this parameter works only for admins/webmasters <!-- github-comment-id:199687979 -->
adam commented 2026-10-04 23:57:46 +02:00
Author
Owner
Copy link
Copy source

I tried passing the "public" parameter set to "false", it does not work.
Perhaps we are seeing different behavior because of the way i did that, so let me reiterate my steps:

  1. Did a clean installation of Piwigo 2.8.0, and created only a single user named "admin" (this is the admin user created during the installation)
  2. Create two albums (named "Arizona" and "Winter"), uploaded a couple of pictures there from Lightroom
  3. Using the API, I made the "Arizona" album private (using the pwg.categories.setInfo) method with status=private. Perhaps marking an album private through Piwigo's administrative console produces a different result?
  4. Now the Arizona album is not visible via the API.

If you still don't believe me, here is what I am seeing in the ws.htm tool:

http://piwigo28.int/ws.php?format=rest&method=pwg.categories.getList&public=false

<rsp stat="ok">
<categories>
<category id="1" status="public" nb_images="6" total_nb_images="6" date_last="2016-03-20 16:48:43" max_date_last="2016-03-20 16:48:43" nb_categories="0" url="http://piwigo28.int/index.php?/category/1">
<name>Winter</name>
<comment/>
<uppercats>1</uppercats>
<global_rank>2</global_rank>
<representative_picture_id>1</representative_picture_id>
<tn_url>http://piwigo28.int/_data/i/upload/2016/03/20/20160320130948-42f6bea1-th.jpg</tn_url>
</category>
</categories>
</rsp>



http://piwigo28.int/ws.php?format=rest&method=pwg.categories.getAdminList

<rsp stat="ok">
<categories>
<category id="2" name="Arizona" uppercats="2" global_rank="1" status="private" nb_images="6">
<comment/>
<fullname>Arizona</fullname>
</category>
<category id="1" name="Winter" uppercats="1" global_rank="2" status="public" nb_images="6">
<comment/>
<fullname>Winter</fullname>
</category>
</categories>
</rsp>

Do you see that Arizona is not being returned by getList, even though I set the public parameter to "false"? Only getAdminList returns it.

And just in case, here are my users:

<rsp stat="ok">
<paging page="0" per_page="100" count="2"/>
<users>
<user>
<id>1</id>
<username>admin</username>
<email>vvinogradsky@hotmail.com</email>
<status>webmaster</status>
<level>8</level>
<groups/>
</user>
<user>
<id>2</id>
<username>guest</username>
<status>guest</status>
<level>0</level>
<groups/>
</user>
</users>
</rsp>

Finally, yes - I am logged in as "admin":

http://piwigo28.int/ws.php?format=rest&method=pwg.session.getStatus

<rsp stat="ok">
<username>admin</username>
<status>webmaster</status>
<theme>elegant</theme>
<language>en_GB</language>
<pwg_token>1762fd6511c3239e6a8e22fbbcb4ffd7</pwg_token>
<charset>utf-8</charset>
<current_datetime>2016-03-22 11:31:06</current_datetime>
<version>2.8.0</version>
<upload_file_types>jpg,jpeg,png,gif</upload_file_types>
<upload_form_chunk_size>500</upload_form_chunk_size>
</rsp>
I tried passing the "public" parameter set to "false", it does not work. Perhaps we are seeing different behavior because of the way i did that, so let me reiterate my steps: 1. Did a clean installation of Piwigo 2.8.0, and created only a single user named "admin" (this is the admin user created during the installation) 2. Create two albums (named "Arizona" and "Winter"), uploaded a couple of pictures there from Lightroom 3. Using the API, I made the "Arizona" album private (using the pwg.categories.setInfo) method with status=private. _Perhaps marking an album private through Piwigo's administrative console produces a different result?_ 4. Now the Arizona album is not visible via the API. If you still don't believe me, here is what I am seeing in the ws.htm tool: ``` http://piwigo28.int/ws.php?format=rest&method=pwg.categories.getList&public=false <rsp stat="ok"> <categories> <category id="1" status="public" nb_images="6" total_nb_images="6" date_last="2016-03-20 16:48:43" max_date_last="2016-03-20 16:48:43" nb_categories="0" url="http://piwigo28.int/index.php?/category/1"> <name>Winter</name> <comment/> <uppercats>1</uppercats> <global_rank>2</global_rank> <representative_picture_id>1</representative_picture_id> <tn_url>http://piwigo28.int/_data/i/upload/2016/03/20/20160320130948-42f6bea1-th.jpg</tn_url> </category> </categories> </rsp> http://piwigo28.int/ws.php?format=rest&method=pwg.categories.getAdminList <rsp stat="ok"> <categories> <category id="2" name="Arizona" uppercats="2" global_rank="1" status="private" nb_images="6"> <comment/> <fullname>Arizona</fullname> </category> <category id="1" name="Winter" uppercats="1" global_rank="2" status="public" nb_images="6"> <comment/> <fullname>Winter</fullname> </category> </categories> </rsp> ``` Do you see that Arizona is not being returned by getList, even though I set the public parameter to "false"? Only getAdminList returns it. And just in case, here are my users: ``` <rsp stat="ok"> <paging page="0" per_page="100" count="2"/> <users> <user> <id>1</id> <username>admin</username> <email>vvinogradsky@hotmail.com</email> <status>webmaster</status> <level>8</level> <groups/> </user> <user> <id>2</id> <username>guest</username> <status>guest</status> <level>0</level> <groups/> </user> </users> </rsp> ``` Finally, yes - I am logged in as "admin": ``` http://piwigo28.int/ws.php?format=rest&method=pwg.session.getStatus <rsp stat="ok"> <username>admin</username> <status>webmaster</status> <theme>elegant</theme> <language>en_GB</language> <pwg_token>1762fd6511c3239e6a8e22fbbcb4ffd7</pwg_token> <charset>utf-8</charset> <current_datetime>2016-03-22 11:31:06</current_datetime> <version>2.8.0</version> <upload_file_types>jpg,jpeg,png,gif</upload_file_types> <upload_form_chunk_size>500</upload_form_chunk_size> </rsp> ``` <!-- github-comment-id:199863900 -->
adam commented 2026-10-04 23:57:47 +02:00
Author
Owner
Copy link
Copy source

@flop25 I am talking about my own private album - I created it, then marked private. Other users should not see it (I agree, even other admins or webmasters), but I should see it because I am the owner of that album.

@flop25 I am talking about my own private album - I created it, then marked private. Other users should not see it (I agree, even other admins or webmasters), but I should see it because I am the owner of that album. <!-- github-comment-id:199869336 -->
adam commented 2026-10-04 23:57:48 +02:00
Author
Owner
Copy link
Copy source

The problem is that albums have no owner. It would be an interresting feature (and very usefull for Community) but involves a lot of rework.

The problem is that albums have no owner. It would be an interresting feature (and very usefull for Community) but involves a lot of rework. <!-- github-comment-id:199875809 -->
adam commented 2026-10-04 23:57:48 +02:00
Author
Owner
Copy link
Copy source

Actually @modus75 is wrong : the "public" parameter can be "true" to fetch only public albums and "false" to fetch albums based on permissions, there is no way to bypass the permissions.

The only solution is to add yourself to the list of granted users once the album is private (see pwg.permissions.add endpoint). This is the intended usage.

Actually @modus75 is wrong : the "public" parameter can be "true" to fetch only public albums and "false" to fetch albums based on permissions, there is no way to bypass the permissions. The only solution is to add yourself to the list of granted users once the album is private (see pwg.permissions.add endpoint). This is the intended usage. <!-- github-comment-id:199877598 -->
adam commented 2026-10-04 23:57:49 +02:00
Author
Owner
Copy link
Copy source

Frankly, I thought that the whole point of making an album private is to make it accessible by the owner only. But since there are no owners, then what is really the purpose of the added feature?

Also, if we are talking about permissions then why admins can access private albums via the web interface, and not though the API? Shouldn't the behavior be consistent?

Frankly, I thought that the whole point of making an album private is to make it accessible by the owner only. But since there are no owners, then what is really the purpose of the added feature? Also, if we are talking about permissions then why admins can access private albums via the web interface, and not though the API? Shouldn't the behavior be consistent? <!-- github-comment-id:199885472 -->
adam commented 2026-10-04 23:57:50 +02:00
Author
Owner
Copy link
Copy source

The purpose is to add a limited list of users and/or groups that can access the album.

Admins cannot access private albums they are not associated to in the front office, "pwg.categories.getList" is a front office method.

They obviously still can administrate them in the back office ("pwg.categories.getAdminList")

The purpose is to add a limited list of users and/or groups that can access the album. Admins cannot access private albums they are not associated to in the front office, "pwg.categories.getList" is a front office method. They obviously still can administrate them in the back office ("pwg.categories.getAdminList") <!-- github-comment-id:199887790 -->
adam commented 2026-10-04 23:57:51 +02:00
Author
Owner
Copy link
Copy source

Unfortunately, pwg.categories.getAdminList returns a different set of properties for private albums, for example, no image counts, no thumbnail information.

Also, this logic with permissions has a rather serious flaw - pwg.categories.setInfo allows admins to sneakily make any album public (as long as the ID is known). This means that admins can temporarily turn any private album public, do what they need, then make them private again.

I'd like to point out that Lightroom users asked me many times to implement the ability to manage album permissions from the plugin. Jumping back and forth between the plugin and the front office to make private albums accessible to the user has an extremely poor usability, and there is no way to do that through the API. I expect an increasing number of users asking why the Lightroom plugin still cannot access or make albums private, even though version 2.8 supposedly has all the necessary provisions for it.

Unfortunately, pwg.categories.getAdminList returns a different set of properties for private albums, for example, no image counts, no thumbnail information. Also, this logic with permissions has a rather serious flaw - pwg.categories.setInfo allows admins to sneakily make any album public (as long as the ID is known). This means that admins can temporarily turn any private album public, do what they need, then make them private again. I'd like to point out that Lightroom users asked me many times to implement the ability to manage album permissions from the plugin. Jumping back and forth between the plugin and the front office to make private albums accessible to the user has an extremely poor usability, and there is no way to do that through the API. I expect an increasing number of users asking why the Lightroom plugin still cannot access or make albums private, even though version 2.8 supposedly has all the necessary provisions for it. <!-- github-comment-id:199896781 -->
adam commented 2026-10-04 23:57:51 +02:00
Author
Owner
Copy link
Copy source

I mentionned "pwg.permissions.add" above. Use it to add the admin to the authorized list.

I don't see how it is a flaw, there are back-office methods and there are front-office methods. If the admin could not set an album public again THAT would be a problem.
The API is designed to replicate all that can be done in the webinterface.

I mentionned "pwg.permissions.add" above. Use it to add the admin to the authorized list. I don't see how it is a flaw, there are back-office methods and there are front-office methods. If the admin could not set an album public again THAT would be a problem. The API is designed to replicate all that can be done in the webinterface. <!-- github-comment-id:199898196 -->
adam commented 2026-10-04 23:57:52 +02:00
Author
Owner
Copy link
Copy source

Ah, I missed that!
Good point, I'll try to play with this. Sounds like this can do what I need.
Thanks!

Ah, I missed that! Good point, I'll try to play with this. Sounds like this can do what I need. Thanks! <!-- github-comment-id:199903357 -->
adam commented 2026-10-04 23:57:53 +02:00
Author
Owner
Copy link
Copy source

I find very interesting that @modus75 was thinking the "public" parameter would make possible to get the same list as pwg.categories.getAdminList (considering he has implemented this feature 9 years ago). Maybe we should consider adding an option "ignore_permissions" which would require the administrator status. It would replace the pwg.categories.getAdminList (which returns far less data compared to pwg.categories.getList)

I find very interesting that @modus75 was thinking the "public" parameter would make possible to get the same list as pwg.categories.getAdminList (considering he has implemented this feature 9 years ago). Maybe we should consider adding an option "ignore_permissions" which would require the administrator status. It would replace the pwg.categories.getAdminList (which returns far less data compared to pwg.categories.getList) <!-- github-comment-id:200747586 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#426