Photo Organizer

  • Status Closed
  • Percent Complete
  • Task Type Bug Report
  • Category Backend / Core
  • Assigned To No-one
  • Operating System All
  • Severity Low
  • Priority Very Low
  • Reported Version 2.36
  • Due in Version Undecided
  • Due Date Undecided
  • Votes
  • Private
Attached to Project: Photo Organizer
Opened by kaz - 2010-08-11
Last edited by pizza - 2010-10-11

FS#436 - Permission model not working for me.

Maybe I am doing something wrong.

In addition to "admin", I have two users in my system, call them Bob and Alice.

Bob has registered Alice as his client.

Likewise, Alice has registered Bob as her client.

Both Alice and Bob have folders which are marked Protected, and in which all images are likewise marked Protected.

Yet, Alice and Bob cannot see each other's pictures and folders at all. Each can only search for his own pictures and folders.

Correctly, an anonymous guest cannot see anything.

Correctly, if either Alice or Bob switch a picture to Public, then everyone can see it, including the anonymous guest.

Correctly, the administrator account sees everything.

Just this Protected access is not doing what I think it should.

Closed by  pizza
2010-10-11 16:23
Reason for closing:  Not a bug
Additional comments about closing:  Since v2.37 is out, I'm considering this closed. If this bug is still present, we can re-open this.
kaz commented on 2010-08-11 03:11

BTW, yes, both users accepted each other and set Trusted to Yes.

Each received an e-mail from PO that they can see the other's Protected material.

pizza commented on 2010-08-11 14:34

Due to the utter inflexibility of the original public/protected/private model I made a few major changes to how it worked. The original implementation of "protected" meant that *any* client of yours could access *all* of your protected images/folders. That's... not good.

It's not enough to be a registered client and mark images/folders as protected now. You have to create a datebook event and indicate which client it's with. Then on the folder(s), you can select a datebook event to link with. This gives the client access to whatever's in those folders.

It's a little convoluted, so I added an alternative way of giving people access to a protected resource -- simply assign a password and hand that out instead.

Both of these features were introduced in v2.34, but I suppose the documentation is VERY outdated.

kaz commented on 2010-08-11 17:27

Thanks for the explanation.

I can get the event linking to work. This works for Alice and Bob.
The problem is that it only works for two people. A folder can have
at most one datebook event, which can have at most one client!

I can't get the password method to work at all. If Bob makes
the folder public and adds a password, Alice can see it without
being challenged with a password.

If Bob makes it protected, Alice cannot see the folder.
However, it turns out that Alice can use a direct URL
reference to get to that folder by number. Then Alice
is challenged for a resource password on a page with
this URL:


She enters the correct password, but is taken to
blank page with the URL:


No web UI, no folder.

kaz commented on 2010-08-12 02:22

Opened a separate bug for the above blank page problem. I will try to get more information by turning on debugging.

pizza commented on 2010-08-12 15:46

The blank page is a bug, but it's probably already fixed.

I think you understand the way things *should* work (bugs notwithstanding..)

The single-event-per-folder and single-client-per-event limitation was intentional. In the end it comes down to whether or not you want to create an account for that "client" to access those photos. IMO for one-off stuff it's simpler to create a folder password and hand them a direct URL to the folder. "client" accounts come in handy when there are multiple "events/shoots" and you want them to be easily visible to that client.


Available keyboard shortcuts


Task Details

Task Editing