Banned member can access CPM gallery Banned member can access CPM gallery
 

News:

CPG Release 1.6.26
Correct PHP8.2 issues with user and language managers.
Additional fixes for PHP 8.2
Correct PHP8 error with SMF 2.0 bridge.
Correct IPTC supplimental category parsing.
Download and info HERE

Main Menu

Banned member can access CPM gallery

Started by klewless, July 26, 2008, 12:17:24 AM

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

klewless

Hi,

We had to ban a certain individual from our forum and gallery (bridged CPM and SMF).When I banned him, I banned his username and added as many of his IPs to the banned user list on CPM as I could, without inadvertently banning other members. (He uses at least one computer with AOL unfortunately)

I learned recently through a friend that the banned member can access the Coppermine gallery -- the home page, at least (in which we have recent uploads displayed). I believe he has some saved links or other way to get in (quite possibly another member's login info).

Not being sure what to do, I am considering changing the directory name for the gallery: myforum/CPM/  to myforum/something else/  so he will not have a link to it, just in case that is what is happening. (I would change the link on the forum to the new name too of course). This would invalidate any saved links people have, but would this mess up the database for the gallery?

Any other ideas?

Thanks in advance,
Klew


Joachim Müller

Quote from: klewless on July 26, 2008, 12:17:24 AM
This would invalidate any saved links people have, but would this mess up the database for the gallery?
No, as the database records only contain relative paths, seen from your albums folder. Renaming the folder coppermine resides in is not problem, you just have to reflect your changes in coppermine's config - change "URL of your coppermine gallery folder".
However, the entire concept looks like a security-by-obscurity approach to me and is a bit pointless if you ask me - I would never punish my legitimate users just for the sake of getting rid of one jerk. Let him have read access if he needs it and manage the rest using the permissions system built into coppermine.