Random Highlight not respecting permissions -- no, really!

I've spent a good chunk of time poring through the documentation and forums looking over the confusion about permissions and random picture selection, but I'm still having problems. It's entirely possible that I'm simply not understanding something, please bear with me and help me understand what's going on.

I understand that permissions are set individually and that permissions are not inherited -- that any images that I don't want viewed by a general audience need to have privileges set invidually, rather than simply applying blanket privileges to an album (PITA, but that's beside the point, and I understand that it's on the TODO list).

My scenario deals with the selection of a random image from within the album to serve as the album's thumbnail (as far as I can tell, this may be different from the Image Block functionality, I've not been playing with that yet). I have an album ("Album X") that contains three sub-albums within it; two of these sub-albums are available to the group Everyone, and the third is available only to me.

-- Album X
-- -- Sub-album One
-- -- -- Okay Pictures
-- -- Sub-album Two
-- -- -- Okay Pictures
-- -- Sub-album Three
-- -- -- NOT Okay Pictures

I have checked the permissions on the "hidden" sub-album ("Sub-album Three"), and the permissions on the individual images stored within it (the "NOT Okay Pictures"). There is no access whatsoever given to any groups or users beyond myself on any of those individual images, or on the Sub-album they are contained in. When I am logged out or in guest mode, I cannot see that album, and trying to go directly to an image within it gives me the login prompt. So far, so good. However, the widget that periodically selects a new thumbnail for "Album X" will use the thumbnail from the taboo "Sub-album Three" folder (predictably) one-third of the time. I think you can imagine the "yikes!" moment I had when I was surprised to see a very naked picture of myself on my Gallery page.

Again -- I've checked the Group and User Privileges for the individual images in question, not just of the album they're sitting in. I'm very, very nervous here -- I truly want to understand fully what's happening here, as I don't like the spectre looming that I'll have more nekkid photo surprises.

Thanks so much for taking the time to look at this with me. I've removed all of the taboo albums from my system, but I've created a test album that demonstrates exactly the behavior I was talking about. I've called it Album X and it's on the first page of my Gallery:

http://photo.humuhumu.com

Inside Album X there are two sub-albums, "Good" which is available to Everyone, and "Bad" which is not. Inside Good there is only one photo, of me with an onion ring on my arm. Inside Bad there is only one photo, of me eating cereal. Again -- I've double, triple, quadruple checked the permissions on both the cereal photo AND on the Bad album, and these should be hidden. When I'm logged out or in Guest mode, I cannot see the album, and cannot reach the photo using its direct url. However, when at my main Gallery page, the random highlight thumbnail for Album X is the image of me eating cereal half the time. I have the random highlight set to change every minute, so you shouldn't have to wait very long to see it.

Valiant, I've created an account for you that gives you all access on Album X, Good, Bad, and the two photos. I'll PM you the details.

Thanks again for lending a hand.

Thanks for bearing with me, Valiant, and thanks for your explanation, that helps bunches.

There's one more thing I could use your patience in clarifying for me -- if I have any albums or photos anywhere in the system that are non-public, aren't they all contained in a single public album at the top level (in my case, the one titled "Humuhumu's Life in Photos")? The thumbnail for the top level is visible in the sidebar when I go to add a new album or a new photo at that top level. Right now I'm the only one with privileges to add stuff at that level, but I would like to be able to grant some people the ability to do that without also essentially granting them privileges to see me naked as a jaybird. If I turn Random Highlight off at that top level, but leave it on for the albums underneath it that don't have private things in them, does that solve that problem? I'm new to Gallery -- are there other places where one might see the thumbnail for the top level?

I absolutely understand that sometimes one has to sidestep complexity in favor of gettin' 'er done, but random highlight not respecting privileges resulted in my unwittingly showcasing my assets to the world, when I thought that I'd been very careful & thorough in locking them down (and in fact, I had been). Granted, I was able to catch it before I let anyone know about my new photo galleries, but there likely will be others who won't be so lucky. Maybe add a warning in the Random Highlight module setup? Is there already a warning and I missed it/skimmed over it?

What's the proper way to file a feature request?

no, else we respect permissions everywhere.
it's not that we don't respect permissions here, well it's a matter of interpretation. i'd say yes, we don't respect permissions when choosing a thumbnail for an album. another dev would argue that when you choose a thumbnail for an album, and you're not using the random highlight module, then you have to choose a single thumbnail for all users.
how would you do that?

say album X has photos which are only visible for group A and other photos that are only visible to group B. which photo do you take as the album highlight? remember, random highlight is not activated, that's just an additional feature.
you can't select any photo as highlight of the album without violating permissions since if you chose a photo which was only visible to group A, group B would see it also as album highlight.

so now we know, we'd need multiple highlights for each album. that would be a feature request. for now, we say:
- if you have private photos in a public album, or in a private subalbum of a public album, ... make sure you are ok with the thumbnail of the public album, that is, change it once. changing a highlight is done in a few seconds.

But i definitely agree that the case with random highlight is differnt. in random highlight we can select the highlight for each user anyway, and why not obey permissions in this case.

@top level highlight:
right, if anyone else can edit the top album, they'll see the top level album highlight. recommendation: disable random highlight for the top level album. i think you can see the top level highlight only in these edit pages on top level.

and i'm sorry for your inconveniences.

update:

random highlight obeys permissions. it works. please give me "All Access" in your g2 on Album good, bad and both photos in them. before, i didn't have permission to see the permissions of the bad photo example.
i'd say your photo in the bad album has the permission to be publicly viewable^, but i need to verify this.

i've tried to reproduce it on my test g2 install, the same structure.
album A
-- subalbum public (everybody view all access)
---- subsubitem public (everybody view all access)
-- subalbum private (everybody no access )
---- subsubitem private (everybody no access

and album A shows always subsubitem public as highlight when logged out, and switches between public and private when logged in as admin.

you didn't make it easy for me to check your issue, you should have set the random highlight duration to 0...

but from what i see:
after logout, after 1 or 2 random highlight cycles, the private (bad) highlight is never seen again.
this could be explained with the g2 permission cache...or not.

so i'd say: a user who doesn't have permission to see an item will never see it as random highlight. not even in your G2.
to test this theory, close all browser tabs / windows that show your website, then clear your browser cookie cache (or just delete the GALLERYSID cookie for this website) and then go as guest to your page and keep hitting refresh.
i'd set the random highlight timeout to 0 such that you can test faster.

You're right! Thanks so much, what a relief. After logging out and restarting the browser, it works properly; Guest mode didn't reflect what Guests were actually seeing. I had tried logging out, and thought that I had seen the taboo images; perhaps as you say it was a cache issue, and sometimes logging out isn't sufficient.

Thanks again for taking the time to work through this with me -- I'm very sorry about the 1 minute lag you were having to deal with.

Reading this discussion gives me the question if the permission handling is done at the right place and in the right way.

• I can very easily have my theme use an acting user id that has admin rights if I want to (I haven't tested if it then also works, but I *assume* it would). I don't think that should be that easy. You should only be allowed to use acting user id's of users who have less rights then the logged in one, or at least use the most restrictive rules of all user ids specified.
• Pictures that I am not allowed to see should not be displayed even though I ask for them specifially, even though my theme got an acting user id with all rights when I'm logged in with too little rights. Could that not be arranged at the picture level?? The picture would simply show the broken picture image or something when you ask for bad pics...

Am I making sense?

Permissions aren't meant to be broken in my humble opinion :P

Unfortunately if you want to enforce the permissions for users you would have to check the permissions of the logged in user every time and verify the login as well. I guess that will be an extra load on the server that nobody wants to have.

ps
The "Create link" option does display when I use the guest preview on photo pages. I already figured out it doesn't show when I actually log out, but it was weird anyway to see it in guest preview mode...

actually, i agree.
the API shouldn't accept any other actingUserId than guest or activeUserId (easy to implement).

does any other user than guest or activeUserId make sense? IMO no.
as root / admin, you may want to see what group x or user y sees, but that's not that important right now and it's not offered as a feature.

RwD, could you file it as a, hmm, bug? that all functions that accept a userId should compare the userId with activeUserId and anonymousUserId and return permission denied if it's another userId.

a theme / module other could still change the activeUserId manually though. that's hard to prevent.

gallery a big collection of scripts? who want you to offend? lol
there are just 3 scripts in G2. index.php which redirects to main.php. main.php which is the entry point. and bootstrap.inc which instantiates $gallery. the rest are mainly classes and 2 functions in init.inc
arg, it must seem i have too much time

The issue has been fixed a long time ago and is not present in Gallery 2.2.3 with 2.2.3's randomhighlight module to our knowledge.
Please post _exact_ steps to reproduce (what albums, subalbums, items to add, what permissions each album / item / subitem has), what result you're experiencing as a logged out user and what you'd expect.
Also note that "guest mode" isn't the same as being logged out. The guest mode is just an approximation and might show some things that are visible to the user you're logged in as.
Thanks.

--------------
Documentation: Support / Troubleshooting | Installation, Upgrade, Configuration and Usage

After doing some more testing, it is rather curious.

The above observations were done on a RH interval of 0.
If I change it to 1 min, and refresh the 2 PCs simultaneously, then the restricted image still occasionally shows on PC2, when it is shown on PC1, but it is much less likely to do so. When it is shown on PC1, it has a much shorter life (not 1 min), and another refresh straight after will cause the image to change. The unrestricted images do persist for 1 minute as expected.

Could it be that the restricted image is in fact generated, but the RH timer is reset immediately so it runs again on the next call, to get another image?

This still leaves the possibility, even if low, of a restricted image appearing on the home page if someone happens to open it at the same time as an admin or authorised user, before the RH re-runs. Assuming the RH is only triggered by a page request, then it would have to coincide with home page being viewed as Admin/ authorised user AND bringing up the restricted image, a very low-risk scenario in practice, especially if there were lots of unrestricted albums compared to restricted.

Still, if the restricted images were highly sensitive,like the first poster's nekked selfportraits (!), it could be damaging. It would be better if the RH could not access restricted images at all, including from admin accounts, than risk this.

-----------------------------
www.lightpainter.co.uk