BUG: Privileged Access not considering secondary groups ... BUG: Privileged Access not considering secondary groups ...
 

News:

cpg1.5.48 Security release - upgrade mandatory!
The Coppermine development team is releasing a security update for Coppermine in order to counter a recently discovered vulnerability. It is important that all users who run version cpg1.5.46 or older update to this latest version as soon as possible.
[more]

Main Menu

BUG: Privileged Access not considering secondary groups ...

Started by chrix, December 19, 2003, 08:47:17 PM

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

chrix

Issue:
When creating an album as user-1 and set it to be visible to e.g. "Members of 'group-x' Group only", then a user who still has access to this album is not shown the album information (or the album admin buttons).

Reproducible ? Yes
Reproduce steps:
  • create an album
  • set it's visibility to "Members of 'XXX'group only" --- where XXX group should be one of your account's secondary groups
  • go to the album list and change into the category where the album resides
  • compare the recently added albums's display to other albums that are visible to yourself only[/list:u]

    note:
    when reproducing this issue, the album was always an album of the user gallery, the config setting for "show first level album thumbnails" is set to ON, I have not tried reproducing this with the setting to OFF which I presume will not produce this issue ;-)


    Steps to fix:
    In the file index.php you can edit line 360 from:
    if ($visibility == '0' || $visibility == (FIRST_USER_CAT + USER_ID) || $visibility == $USER_DATA['group_id']) {

    to:
    if ($visibility == '0' || $visibility == (FIRST_USER_CAT + USER_ID) || $visibility == $USER_DATA['group_id'] || in_array($visibility, explode(",",$USER_DATA['user_lang']))) {

    This way, the secondary groups are checked as well and info is provided to the users who are in a secondary group.

Oasis

Pixnet Gallery: http://www.pixnet.net
iNSiGNiA Weblog: http://www.jayliu.org