Private album keeps asking for password

[Netwit]

To get to a private album on my site, a user must first type in the username and password, and then a second password for the private album. The problem is that to view each individual photo in the album, the user must keep typing in the private album password. (The error message is "This forum requires a password for access!") Is this a bug? Any ideas on how to fix it?

[Michael P]

Check the thread at the top of the page and make sure you are running the latest build; we did find an issue with changing private albums/categories and cookies that was fixed a few days back.

[Mikan]

I have this same problem and I'm running the latest (05/31) version.
If a user goes to My Photos and tries to enter a his own password protected album it keeps asking for a password.

This doesn't happen if that password is in url - this only happens if he tries to access that password protected album by going "My Photos" and then clicks that album.

I think I fixed that by adding this:

Content visible to verified customers only.

before this:
if ( isset($_GET['catp']) ) {

in showgallery.php

As far as I can tell when that password is being send from get_password / getpass.tmpl... there's no function in showgallery that reads that POST catp-value.

Is this a valid fix.. I don't know.. maybe Michael / Omegatron can check this and give a comment.

[Chuck S]

I show the code in showgallery.php as correct

if ( isset($_GET['catp']) ) {
@setcookie( "catp", $_GET['catp'], 0, "{$Globals['cookie_path']}", $Globals['domain_path'] );
$GLOBALS[catp] = $_GET['catp'];
}


$catp is never a post item. Basically what we say there is if there is a catp variable in the url reset the cookie to that get which overwrites the catp password

[Mikan]

$catp is never a post item.

Oh... what's this then:

getpass.tmpl

<form method="post" action="{$Globals['maindir']}/showgallery.php">
.....
<input type="text" size="24" name="catp" class="bginput" />
....
</form>

And why that addition that I posted fixed my problem?

[Chuck S]

Well catp is in the typecast request line so it should parse a get or post as its an array.

That is the template that is called if you cont have a cookie on your computer. Are you saying if you dont have the cookie on your computer and type the password in there that the cookie is not created?

[Chuck S]

If so try this

Content visible to verified customers only.

to this

Content visible to verified customers only.

[Michael P]

I see what he is saying, that in the case of the form the catp is being passed via a POST and not a GET. We need to check for the existance of both. We can't check $_REQUEST because then the cookie overrides those other two, so we need to check POST and GET explictly.

[Mikan]

Originally Posted by omegatron

Content visible to verified customers only.

Thanks, but that one doesn't work because you are still using these "$_GET['catp']" to set that cookie and that GLOBALS and those GETs don't help if that catp is being passed via POST so my solution that I posted earlier is still better

[Michael P]

My bad, I edited Chuck's post incorrectly. I just updated it with:

Content visible to verified customers only.