$CONFIG['users_can_edit_pics'] still valid? picEditor.php $CONFIG['users_can_edit_pics'] still valid? picEditor.php
 

News:

cpg1.5.48 Security release - upgrade mandatory!
The Coppermine development team is releasing a security update for Coppermine in order to counter a recently discovered vulnerability. It is important that all users who run version cpg1.5.46 or older update to this latest version as soon as possible.
[more]

Main Menu

$CONFIG['users_can_edit_pics'] still valid? picEditor.php

Started by the_todd, July 12, 2005, 12:45:58 AM

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

the_todd

picEditor.php line 80:
if (!(GALLERY_ADMIN_MODE || $CURRENT_PIC['category'] == FIRST_USER_CAT + USER_ID || ($CONFIG['users_can_edit_pics'] && $CURRENT_PIC['owner_id'] == USER_ID)) || !USER_ID) {cpg_die(ERROR, $lang_errors['access_denied'], __FILE__, __LINE__);};

is $CONFIG['users_can_edit_pics'] still valid?, On my gallery this is barring me from editing pics because it is set to 0, by default I believe, but there is nowhere that I see in the gallery config to set "users can edit pics" to yes. Seems like it should go under the category: Files and thumbnails advanced settings.

Also, there is no 'category' column in the cpg140_ pictures talbe to make $CURRENT_PIC['category'] in this query in the same spot as above.
$result = cpg_db_query("SELECT * FROM {$CONFIG['TABLE_PICTURES']} WHERE pid = '$pid'");
        $CURRENT_PIC = mysql_fetch_array($result);
if (!(GALLERY_ADMIN_MODE || $CURRENT_PIC['category'] == FIRST_USER_CAT + USER_ID || ($CURRENT_PIC['owner_id'] == USER_ID)) || !USER_ID) {cpg_die(ERROR, $lang_errors['access_denied'], __FILE__, __LINE__);};

~Todd

Nibbler

Look it up in the lang file

array('Allow users to retain control over their pics in public galleries', 'users_can_edit_pics',

I'll take a look at that code, thanks.

the_todd

Thanks I should have thought to look there. Anyways, there still remains the issue with the unnecessary $CURRENT_PIC['category'] == FIRST_USER_CAT + USER_ID in the if since it doesn't exist.

Todd

Joachim Müller

[moderation]
bumping this unresolved thread to the top...

omniscientdeveloper


Aditya Mooley

@Todd - thanks for bringing this to our notice

Removed
$CURRENT_PIC['category'] == FIRST_USER_CAT + USER_ID from picEditor.php and committed to CVS.

Aditya
--- "Its Nice 2 BE Important but its more Important 2 Be NICE" ---
Follow Coppermine on Twitter