Password protected albums?

A saw old request about password protected albums. Is it planed for G2?

What Einstein is proposing is a quite popular feature request.
What he wants is an album that is not protected by user/group permissions, but by a simple password for anonymous users / guests.

You've created a gallery for a special event and don't want to ask all your friends to sign up with your gallery just to see the photos. But the photos still should not be publicly visible.
So you decide to email all your friends the same password for this single album.

I guess we could do something like that by creating a special user for each album / item password. The visiting just has to enter the password and no username and internally he will be logged in as this special album user.

Valiant, you are reading my thoughts ;)

Anyway I will check the G2 architecture myself if it's really that complicated to add such a future.

yes, I had a similar thought.. we could have an ItemEdit plugin for selecting a password for an album.. this would create a user (username like albumpassword-ID where ID is the id of the album.. this makes it clear to an admin looking at the user list where these users came form.. oh, how will memberlist ignore these??).. then assign appropriate permissions on the album for the user (and remove Everybody permissions if needed). Someone trying to access ShowItem for the album would get bumped to the login page and returned to the album.. but we could also have a specialize login view in the module if desired.

other brainstorming...
- a view asks for password and sets a cookie; extend GalleryAlbumItem, add some logic in onLoad event to verify cookie is present
- is there any way to use http basic auth? (maybe not since we always go thru main.php)

I've done the http auth through php a couple of times. Let me know if you want to see some sample code.

i'd prefer no password over a password that can be bypassed by a direct item link. something like that make you believe things are more secure than they really are, even if you add a big disclaimer.

While I don't dislike the password protected albums idea, I think it's separate from the concept of hidden albums.

I DO, however, like the idea of auto-login based on album. It seems easy enough to have a global 'hidden' user (that can't be logged into, directly), and make the viewing of an album conditional on having the user set to hidden.

Or...

Instead of changing the logged in user, create a flag for items which is 'additional users'. I don't have it fully worked out in my head, but this is the idea:

When a user is viewing an item, if the 'additional users' is set, the usernames listed in the field are appended to the permissions query. So, instead of 'signe or everyone or [whatever groups I may be in]', you get that, plus 'additional users'.

My thoughts aren't coming across too clearly, but you may understand what I'm getting at. Hit me on IRC if you have questions about what I'm trying to say.

I changed the onLoad code to check the parentSequence, so the check now applies to all descendent items too (relying on the fact that to build the breadcrumb all ancestor items will be loaded at some point during the core:ShowItem request..)

        // Check for password on core:ShowItem request for this album or its descendents..
        list ($view, $itemId) = GalleryUtilities::getRequestVariables('view', 'itemId');
        if ($view == 'core:ShowItem') {
            if ($itemId != $this->getId()) {
                list ($ret, $parentSequence) = GalleryCoreApi::fetchParentSequence($itemId);
                if ($ret->isError()) {
                    return $ret->wrap(__FILE__, __LINE__);
                }
                if (in_array($this->getId(), $parentSequence)) {
                    $itemId = $this->getId();
                }
            }
            if ($itemId == $this->getId() && (!isset($_SERVER['PHP_AUTH_PW']) ||
                    !$this->isCorrectPassword($_SERVER['PHP_AUTH_PW']))) {
                header('WWW-Authenticate: Basic realm="' . $this->getTitle() . '"');
                header('HTTP/1.0 401 Unauthorized');
                print "Unauthorized\n";
                exit;
            }
        }

So now the main drawback is the search module or imageblock can still find these items, since this code I wrote doesn't use real permissions.. but following the links from these modules to the item will prompt for the password.

I agree that what Einstein is proposing is a quite popular feature request.
pbase.com is providing such feature for the customers as shown on the link below:

http://www.pbase.com/help/password_protection

There is no doubt that G2 will be the killing apps for internet gallery.
The "password protected" feature will make G2 more useful, especially for commercial use.

I wonder whether it will be simpler if the system check only down to album level, not item level. Also will that feature be implemented as an analog of a pad lock in real life. Everyone knows the password can open the album and watch the contents inside.

I am not a good software developer. What I suggest is for brainstorming only.

I'm planning to implement such feature as a plugin but I need some assistance.

1) Add a new permission called passwd.viewObject (They are only allowed to view the album with the password)
2) Add a edit album plugin which allow user to set password
3) If the password is set, associate guest user with passwd.viewObject permission
4) When a guest user access the album, the system redirect them to a new view

For step 4, I dunno what event should I register, which event will be raised when displaying an album?

>> Having it go to a page where you enter the password equally problematic.

This is what make me a lot of headache. For rendering an album, which part of code will be called?

After viewing the code for panorama, I have a thought of making passwdAlbumItem a subclass of albumItem (Just like PanoramaItem is a subclass of PhotoItem.

and inside the loadTemplates method of those view.

if (client cookie's password field set) {
if (cookie's password matches that of the current album) {
load the templates of a typical albumItem.
}
} else {
load the templates prompting password
}

actually I have tried the attachment but I cannot get it work in beta 2.
Maybe it is due to the change in database schema.

After clicking install.

Error (ERROR_STORAGE_FAILURE, ERROR_UNKNOWN)
in modules/core/classes/GalleryStorage/DatabaseStorage.class at line 1236 (gallerystatus::error)
in modules/core/classes/GalleryStorage.class at line 261 (mysqldatabasestorage::addmapentry)
in modules/core/classes/interfaces/GalleryPluginParameterMap.inc at line 98 (gallerystorage::addmapentry)
in modules/core/classes/helpers/GalleryPluginHelper_medium.class at line 397 (gallerypluginparametermap::addmapentry)
in modules/core/classes/helpers/GalleryPluginHelper_medium.class at line 347 (gallerypluginhelper_medium::_addparameter)
in modules/core/classes/GalleryCoreApi.class at line 360 (gallerypluginhelper_medium::setparameter)
in modules/core/classes/GalleryPlugin.class at line 284 (gallerycoreapi::setpluginparameter)
in modules/core/classes/GalleryModule.class at line 176 (albumpasswdmodule::setparameter)
in modules/core/AdminModules.inc at line 68 (albumpasswdmodule::installorupgrade)
in main.php at line 173 (adminmodulescontroller::handlerequest)
in main.php at line 79
in main.php at line 70

I have changed the mindless code a bit and make it work for g2b2.

Since I still cannot get the idea from g2-database interaction. (since I am not familar with those saxon stuff). I just save the password as a module parameter, using the same way of sizelimit module.

I just modified it to make it work. And actually there is some useless class in the zip. But I am also busy with customizing my gallery. so maybe i will take some time to tidy up the code later.
<br>

Here is the module with these updates:
1) Use onLoadHandler as suggested above, instead of changing entity type.
2) Use salt in hashing the password.
3) Up to date with apis.

You need to upgrade to a more recent nightly, http://galleryupdates.jpmullan.com

updated attachment above for current (in cvs) apis.

1. DL the module
2. Unzip the module
3. Copy to folder "albumpasswd" to /<PathToGallery/modules/albumpasswd
4. Install & Activate the module in the Admin Options -> Modules
5. Edit the relevant Albums - in the bottom of the edit-album-page there is now a "Password Protect this Album" field
6. Enjoy

OK - seperate DL is now problem, as long as the module exist ;-)

Thanx for the link to the user contrib, I wonder why I hav'nt found it myself. I thought I had been all over this site by nowx

I'm not sure if the latest cvs fixes this or not, but I do think there was a permissions problem in general with the cart functionality. I'd try the latest cvs and see if that fixes it. It may not because this is using the special password thing but you never know.

what do you use for a user name with this module?

I installed this module on a stand alone G2 and I get the following under the Album tab:
Album Password
Assign a password required for viewing this album.

I assigned a password but when I try to login I get prompted for a Username and a Password (http auth dialog box). I have tried entering every combination that I could think of for the Username, from leaving it blank to setting up a user with the same password. I also noticed that the "Remove password" checkbox doesn't seem to work. When I check it and hit save I get "Settings saved successfully." but the checkbox with "Remove password" is still there.

Any thoughts?

I also had the same difficulty using G2. I am prompted for both a username and password...leaving the usernmame blank and entering the configurd password doesn't seem to work.

Is there an update to this useful module for the final G2 release?
Thanks!

Yes, there is http://sourceforge.net/tracker/index.php?func=detail&aid=1120914&group_id=7130&atid=357130

Feel free to vote on it

____________________________________________
Like Gallery? Like the support? Donate now!!! See G2 live here

The module for password protected albums was done already by a Google SOC student. But when it will be released, I dont have a clue.
http://codex.gallery2.org/index.php/Gallery2:SummerOfCode#Hidden_and_Password-Protected_Items

Perhaps a developer can clue us in.

In the meantime I am putting my votes to the feature request "invitation only". It can be found on the first page of the Feature Vote page.
http://sourceforge.net/tracker/index.php?func=detail&aid=1078228&group_id=7130&atid=357130

I am also interested in that feature. Would be nice if someone could implement that soon.

Already taken care of ;-)

I get this same problem... Anyone find an answer?

Nick