Disable search for guest or make old images private

[Hubertus]

I just moved to new V3, and stil guest can explore old images using Random or Search. This is invasion of privacy previous users. I need to disable this, or make old images private.

 

[Rodolfo]

You can disable the explorer or force the old images to belong to a private album.

 

[Hubertus]

Im, having explorer disabled, but guest still can use Random or search. Where to make old images private?

 

[Rodolfo]

You will need to create a private album and then get its id. You can do this by going to the album > full info > id. So lets say that the album id is 123 and it belongs to the user 321 (you also need to go to edit user to see its real id. In Chevereto we use public ids (alphanumerics) and private ID (int).

Now, you need to run this query:

UPDATE chv_images set image_album_id=123, image_user_id=321 WHERE image_user_id IS NULL

That will affect ALL the images that are public.

 

[Hubertus]

Thanks, that solved the problem of privacy

 

[Hubertus]

But, hide all old images from viewer page So this is not good solution for now

To reverse this use:

UPDATE chv_images set image_album_id=NULL, image_user_id=NULL WHERE image_user_id=321;

 

[SirMoo]

The solution I used was to do an admin check for random and explorer. If admin, it shows the link and works. If not then it simply redirects to the home page and the link doesn't show. This solves a couple of problems. One, general image privacy and the other being to prevent possible exposure to adult images that are uploaded (users would have to know the direct URL and in that case they were trying to get it anyway. ). Simple if else will solve any problems.

 

[Hubertus]

Yes Im using 'if admin' too, but still when user knows chevereto, then he can see all private images on our site. Anyone can use this url domain.com/search/images/?q=text&page=1 to see private images.

 

[SirMoo]

Yes Im using 'if admin' too, but still when user knows chevereto, then he can see all private images on our site. Anyone can use this url domain.com/search/images/?q=text&page=1 to see private images.

Use the same solution for this. In the theme folder there is a search.php simply add to the very top

<?php if(is_admin()) { ?>

Then at the very bottom

<?php }else{ G\redirect($handler->issue404); } ?>

This will then force them when they try to enter a search... they'll simply be redirected to the main page. Honestly, in terms of the else statement, I'm not sure if that's the proper way to go about it. I was wanting a 404 error... However, it didn't do what I wanted but did something else that worked fine so I've left it at that.

This simple combo has solved all my problems of not granting access to features for users without actually modifying core files. I'm sure you can replicated to be is_user (or what ever the proper code is) to do the same for users only.

Let me know if there are any security issues with this.

 

[Majen]

We have the same issue to solve before we can update from 2.x to 3.x. With the new privacy settings coming up in 3.3.0, it would be possible to add all old 2.x images to one album and set the album settings to "Anyone with the link" to replicate the 2.x behavior for all old images, right? To be clear: Does "Anyone with the link" privacy mean that the pictures are omitted from the search, explore and random function?

Can guests also choose between "Public" and "Anyone with the link" or are new guest uploads always public?

Thanks for the great 3.x release! I'm looking forward to upgrade once this issue is resolved or we found a workaround

 

[Rodolfo]

Guest uploads are public and doesn't belong to any album. In 3.3.0 there will be a new privacy set for albums which is "private but link" and those images won't show up in any public list.

There is also an improved private mode for 3.3.0 where you can also set what to do with the content. For instance you will set he system as private which makes the system only usable for registered users but also you will be able to override the content privacy to force private or force private but anyone with the link.

Most likely 3.3.0 will solve all the missing privacy concerns

 

[Majen]

That sounds awesome! I look forward to the 3.3.0 release