[RC4] Permissions - Design Issue?

[Kirby]

First of all, I think in gallery_global.php int should be

Content visible to verified customers only.

Instead of

Content visible to verified customers only.

Furthermore, ther seems to be a serious problem with permissions.

Let's say Usergroup Registered does not hav any permissions (for gallery) at all.
Now I also got a Usergroup Gallery Users with do have permissions to View, Upload, etc.

But in 1 specific album, I don't want Gallery Users to be able to upload images, so I am using custom permissions there only for this usergroup.
But users who are primary Registered and have a membergroup Gallery Users are still able to upload images there - until I select Use Custom Permissions and Hit Save (without changing anything, as I ready said - per default they don't have any rights).

I tracked this down to fetch_category_perms():

Content visible to verified customers only.

It seems like you are setting the combined usergroup permissions ($galleryperms) here if specific permissions for usergroup $usergroupid do not exist for category $catid.
Shouldn't the permissions for this specific usergroup ($gallery_permissions["$usergroupid"]['gallery_perms']) be used here?

You are correct about the typo with $bbuserino variable. There's really no reason that should cause a problem though as the check to see if that variable is empty is really just more of a percaution and the foreach statement is still processing the proper variable.

For the permissions thing, it almost sounds like you've answered your own question. If a user is a member of two groups and one group has permissions for a category then they are going to be able to view that category. If you don't want that group to have permissions to a specific category then you need to change the permissions for that group in that specific category (as you said above).

[Kirby]

I think you got me wrong Brian

Usergroup Permissions (gallery_admin.php?do=permissions)
Registered => All No
Gallery Users => Can Upload = Yes

Category Permissions (gallery_admin.php?do=categorypermissions)
For Album X (all other permissions are not customized):
Registered => Not Customized
Gallery Users => Customized, Can Upload = No

Now I have a user who is member of Registered and Gallery Users: He can Upload in Album X.
Only if I select Use Custom Permissions for usergroup Registered (without chaning any of them, all set to No) he will not be able to upload there.

And I think this is not the way it should be?

No clue how that would be happening. If you'd like to submit a support ticket though I'll be glad to take a look.

[ConqSoft]

Originally Posted by Kirby

Only if I select Use Custom Permissions for usergroup Registered (without chaning any of them, all set to No) he will not be able to upload there.

Brian, the same thing is happening with your Show Gallery Images on the Forum Home Page and Kevin's Show Gallery Images on the CMPS page hacks. Only Admins/Super Mods can see the images, unless you go to the permissions editor for each category, and set the permissions to Custom (but not change any of them). (Worked fine on RC3, but this issue started with RC4.)

http://www.vbadvanced.com/forum/show...&postcount=328

Might be related somehow?

[Kirby]

OK. I'll prepare a totally fresh installation, as I don't feel that much comfortable giving access to my testserver

[KW802]

Originally Posted by ConqSoft

Might be related somehow?

I've been following this thread carefully for that very reason.

[Kirby]

Ticket submitted

[TheAllusionist]

I would love to know if this was resolved I have the same problem

[Kirby]

I do already have a fix that seems to work, but I want Brian to confirm this first

For anyone else that is experiencing a problem with the permissions as Kirby is describing, please download the package from here again and upload the /forum/includes/functions_gallery.php file over your existing one.

[ConqSoft]

That doesn't fix the issue with your (and Kevin's) hacks to show gallery images in other locations. Any ideas on those?

That's due to the changes in the permissions system after RC3. I'll go and update my post for the forum home hack and I believe Kevin is going to try to update his as soon as he has a few minutes to spare.