issue when user edits own file issue when user edits own file
 

News:

cpg1.5.48 Security release - upgrade mandatory!
The Coppermine development team is releasing a security update for Coppermine in order to counter a recently discovered vulnerability. It is important that all users who run version cpg1.5.46 or older update to this latest version as soon as possible.
[more]

Main Menu

issue when user edits own file

Started by Casper, March 24, 2005, 09:49:10 PM

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

Casper

(note from Thu: The following posts were split from another discussion on adding files to a public album)

Tranz,

the seems to be a problem.  I uploaded the 1.4. site, which seemed to go ok.  It told me it would show when approved.
After I uploaded the 1.3.2 site, I noticed the 1.4 site was showing, so I went to check it, and found the hyperlink was not working.

I went to edit the file info, found the problem and fixed it, but when I applied the changes the file disappeared, and I received an 'you are not allowed to access this page' error.  On going back to the album, the file appears to have been deleted.

Shall I re-submit?
It has been a long time now since I did my little bit here, and have done no coding or any other such stuff since. I'm back to being a noob here

Casper

Hmmmm, a definate problem here.

I tried to edit the file info on my other submission, in the 1.3. showcase, and the same thing has happened.  So when a user edits the file info, the file appears to be delelted.
It has been a long time now since I did my little bit here, and have done no coding or any other such stuff since. I'm back to being a noob here

Tranz

That is strange. I saw both your entries earlier. I had approved the first one. The second one didn't need approval since I assigned you to the VIP group which did not require approval.

I have this config " Allow users to retain control over their pics in public galleries" set to Yes. I don't know what could have happened. :(

Tranz

#3
Casper, I just looked at your recent uploads page and it showed your 2 submissions. When I tried to view them, I got this:
QuoteCritical error
File is in a non existant album (0)!?

So it looks like they weren't deleted, but assigned to an album that can't be seen.

They also show up in the last uploads album, and top viewed

Nibbler

Check $public_albums_list code in editonepic, it might not be filling the album box with public albums for non-admins.

Tranz

I was able to reproduce this on my local installation. After submitting an edit as nonadmin, I got this:
QuoteYou don't have permission to access this page.

File: C:\wamp\websites\cpg-dev\editOnePic.php - Line: 212

This is what I have at line 212:
if (!(GALLERY_ADMIN_MODE || $CURRENT_PIC['category'] == FIRST_USER_CAT + USER_ID || ($CONFIG['users_can_edit_pics'] && $CURRENT_PIC['owner_id'] == USER_ID))) cpg_die(ERROR, $lang_errors['access_denied'], __FILE__, __LINE__);

Observed the same behavior as Casper's files.

Nibbler

committed fix for files going to no album, cannot replicate permissions issue.

Tranz

Thank you, Nibbler. That fixed it so that nonadmin can edit own files.

Do the ones that have already been affected need to be manually changed in the database?

I can't see the files before the fix in editpics.

Nibbler

You'd need to manually give them them the desired aid.

Tranz

I went into my local database and entered the album id. The problem file now shows up fine.

@casper, donnoman will have to update the gallery with the fix, and edit the database. So yay, you didn't need to resubmit. :)