5.31 stripimages displays privates photos
 

Under certain circumstances, the private images are displayed on the image strip on showphoto.php.

- the first photo of the image strip has to be a non private image

The next two photos are displayed regardless if they're private or not.

Code in showphoto.php:
As you can see, the "grab two more" part isn't checking if the image is private or not.

Yes I can understand your philosophy here but this will require some extensive testing to answer. I have done some testing and thus far the only way I can see a private image is if I am logged in as admin which means things are working as they should be since admin sees everything.

Ok, thanks. I know that an admin can see private images, but this happens for normal users and non authenticated users.

Instructions on how to reproduce this bug:

- upload two images to a private album
- upload an image to a public viewable category
- go to the frontpage of photogallery with a normal user account or as an non authenticated user. On the "new photos" strip, the two private images won't show up (as wanted), but the last uploaded image will.
- Click on that image to view it.
- Have a look at the image strip. The thumbnails of the two private images will show up there. Clicking on one of them will bring up the "You need a password to view this image" screen. But from my understanding, the thumbnails of the private images should not be visible.

Let me know if you can reproduce this with the above instructions. If not, I can provide you access to my test installation. To fix this, the "grab to more part" would also need an is_image_private() call.

Try this instead

Unfortunately, it's not that easy. Your fix will make the image strip disappear completely. The problem is that you need to fetch additional rows if the images are private as long as you got two non private images and then do the the "break".

That fixed it, thanks!

Sorry, a bit to early. With your latest fix, the number of photos shown in the image strip will decrease if a private images are in the mysql result set.

See here (4 photos should be displayed):
1 private image -> http://fotogalerie.herr-der-ringe-fi...0/limit/recent
2 private images -> http://fotogalerie.herr-der-ringe-fi...9/limit/recent
no private images -> http://fotogalerie.herr-der-ringe-fi...5/limit/recent

I can see that we'll need to loop for checking is_image_private and ending when we run out of images or we get two more..

Sounds good!
Will you post a small notice when this has been fixed? Either with the updated code or that I can grab the latest version from the member area?
Thanks!

Aw heck.

I was looking for a fix to keep private photos out of the "most recent" gadget on the index page. I see now the problem goes deeper.

So what do I do now with my users? Cut their privates off, or expose their privates?

It's not pretty !!

David no this discussion is about the next prev strip on showphoto.

The feature blocks on the index correctly show images a user has permission to see.