coppermine-gallery.com/forum

Support => cpg1.4.x Support => Older/other versions => cpg1.4 permissions => Topic started by: cptechnik on August 16, 2007, 05:53:48 AM

Title: BUG?!? Profile visible without logon
Post by: cptechnik on August 16, 2007, 05:53:48 AM
my Profile ist cached by google!

Just test it on your gal:
http://[mydomain]/galerie/profile.php?uid=1

i tested it on demo from coppermine...
http://coppermine-gallery.net/demo/cpg14x/profile.php?uid=2

huh?!?

but i cant visit the userlist:
http://forum.coppermine-gallery.net/index.php?action=mlist



Title: Re: BUG?!? Profile visible without logon
Post by: Hein Traag on August 16, 2007, 07:32:17 AM
Not a bug but just the way it's built in. There are ways of hiding these from unregistered users eyes, search the board. I can see both member info and members list.
Title: Re: BUG?!? Profile visible without logon
Post by: Joachim Müller on August 16, 2007, 07:38:39 AM
There is no sensitive information available on the profile page (you can't see the email address there). It's actually a feature, not a bug. As Hein suggested: disabled to link to the profile if you don't want it to be available for guests.
Be carefull when shouting "bug": a bug is a feature that doesn't work as expected. Your report doesn't qualify as a valid bug report.
Title: Re: BUG?!? Profile visible without logon
Post by: cptechnik on August 16, 2007, 07:00:40 PM
Ok, ok, it is a FEATURE... not a bug...

"I can see both member info and members list." ...because you are logged on?

"search the board" - na, da tu ich mich sehr schwer...

"no sensitive information available on the profile page (you can't see the email address there)."
but i added 'additional information' on my gallery like website, messenger-uin...
guest can't see the memberlist, but if sombody know the direct link to the profile,
like "http://coppermine-gallery.net/demo/cpg14x/profile.php?uid=2", then the guest see all the information (except email).

the subdirectorys '/albums' are not call-able with .htaccess:
---
SetEnvIfNoCase Referer "^http://[mydomain]" local_ref=1
Order Allow,Deny
Allow from env=local_ref
---
but the profile.php is placed in the root-directory...

The tread shouldn't be a announcement, it should be a question...

i renamed the profile.php, and now searching for sollutions...
Title: Re: BUG?!? Profile visible without logon
Post by: Nibbler on August 16, 2007, 07:19:15 PM
Just add the normal code to restrict the page to logged in users only. Add

if (!USER_ID) cpg_die(ERROR, $lang_errors['access_denied'], __FILE__, __LINE__);

After


require('include/init.inc.php');
Title: Re: BUG?!? Profile visible without logon
Post by: Joachim Müller on August 16, 2007, 07:47:01 PM
Nibbler's suggestion won't remove the links to the profile pages, it will just hide the profile information for guests.

If you have issues with the memberlist, post a link to your gallery for a start.

Don't post in German on the English support board.

Please respect the "one issue per thread" policy in the future. Your .htaccess issues definitely are not related.
Title: Re: BUG?!? Profile visible without logon
Post by: cptechnik on August 20, 2007, 05:49:20 PM
@nibbler
Many, many thanks!
I knew, it was something like "if (user exists){do...}" but i don't want to learn all variables and output-functions... in this case i am a user, not a programmer...

thank you, nibbler!