Strange problem with album privacy

[imthebest]

Hello,

A member has 2 albums, both were public. However the member recently changed the permission "Can View Media" of one of those albums to "People You Follow". Since then, the member is unable to see his own album!

The "Can Add Media" permission is set to "Owner only", I don't allow people to change that permission so it's always "Owner only" by default.

I have tried to reproduce this problem here at xenforo.com with no luck.

What could be going wrong? It's a rare problem.
I'm using XFMG 1.0.0 with XF 1.4.2, imported from vBulletin 3.8

 

[imthebest]

Any idea will be more than welcome!

 

[Chris D]

As you can't reproduce this here and you are running XFMG 1.0.0, I would recommend testing this again when you get the opportunity to upgrade. Though, honestly, there shouldn't be any thing in the code that would allow this to happen.

 

[imthebest]

I dont know if it is related but I applied the recently released patch for XFMG to my 1.0.0 installation and I believe that since then the problem started... could this be possible?

 

[Chris D]

No.

 

[imthebest]

I have tried to reproduce the problem on my own forum with another user and I have been unable to reproduce it.
It seems to be related to that specific member/album and I really have no idea of what is going on. If I use the Test Permissions tool and "log in" as the member having the problem I can see that, in fact, he is unable to see his own album.

I if try to access using a direct link to the album or a direct link to a picture inside the album (again, with the permissions of the member having the problem) I get the "You don't have permissions..." error message.

The member also told me (but he doesn't remember if it was done before or after changing the privacy of the album) that he tried to delete a picture of that album however he was told by the system that he was unable to do that because I don't allow people to perform that action.

Maybe there is a bug here?

 

[imthebest]

Since we have no idea of what could be going wrong here I'll upgrade to 1.0.2 (as soon as it gets released) and see if the problem still exists.

 

[imthebest]

I can see that this problem is being listed as one of the bugs fixed in XFMG 1.0.3:

Album became invisible to its owner when privacy was set to "Shared" or "People you follow"

However both you and me were unable to reproduce the problem when I originally reported it. Did you manage to reproduce the problem? Do you have a link to the bug report?

Thanks!

 

[Mike]

I believe the context was: https://xenforo.com/community/threads/album-dissapears.91366/

 

[Chris D]

Yeah, bit of a weird one.

Just one of those cases where we couldn't reproduce it one time, but could another.

It's worth noting that I had kind of assumed that the problem mentioned here was resolved as I hadn't heard anything else. It's perfectly fine to let us know if you're still experiencing issues with something we couldn't reproduce previously.

 

[imthebest]

I'm running XFMG 1.0.3 and the member tells me that he is still unable to see his other album (the one who has the permission "Can View Media" set to "People You Follow").

Could you please double check if this has been properly fixed in 1.0.3?

EDIT: I can confirm that the bug is still present in 1.0.3. I just "logged in" as the user using the "Test Permissions" function and confirmed that I'm unable to see the album whose privacy level is set to "People You Follow".

 

[Chris D]

It has been properly fixed, but the fix isn't retroactive. If the permissions broke before the upgrade then the permissions would need to be reapplied before being able to view the album again.

This would involve a user who can bypass the media privacy to go to the album and change the permissions for them.

I would recommend setting them to "Owner only". That should allow the person to see the album, from there he can choose whatever privacy settings he wants.

 

[imthebest]

Isn't there a way to find all those albums who where affected by this bug? Maybe a SQL query?

The fact that the bugfix wasn't retroactive must have been clearly stated on the 1.0.3 announcement.

 

[Chris D]

I haven't tested this fully but this ought to work:

SELECT album.album_id FROM xengallery_album AS album
INNER JOIN xengallery_album_permission AS perm ON
    (album.album_id = perm.album_id)
WHERE perm.permission = 'view'
    AND perm.access_type = 'followed'
    AND NOT EXISTS(SELECT shared_user_id FROM xengallery_shared_map WHERE shared_user_id = album.album_user_id)

 

[imthebest]

@Chris D that SQL query didn't return any results:

mysql> SELECT album.album_id FROM xengallery_album AS album
    -> INNER JOIN xengallery_album_permission AS perm ON
    ->     (album.album_id = perm.album_id)
    -> WHERE perm.permission = 'view'
    ->     AND perm.access_type = 'followed'
    ->     AND NOT EXISTS(SELECT shared_user_id FROM xengallery_shared_map WHERE shared_user_id = album.album_user_id);
Empty set (2.20 sec)

Could you please review your SQL query?

 

[Chris D]

There was a small bit missing from the query.

Give this a try:

SELECT album.album_id FROM xengallery_album AS album
INNER JOIN xengallery_album_permission AS perm ON
    (album.album_id = perm.album_id)
WHERE perm.permission = 'view'
    AND perm.access_type = 'followed'
    AND NOT EXISTS
    (
        SELECT shared_user_id
        FROM xengallery_shared_map AS shared
        WHERE shared.shared_user_id = album.album_user_id
        AND shared.album_id = album.album_id
    )

 

[imthebest]

That worked fine, thank you very much for your support!

 

[Chris D]

What worked fine? That was only supposed to tell you which album IDs were affected.

How many were there? I'm guessing there were only a few and you were able to navigate to the URL and change the privacy?

 

[imthebest]

Yep, the query worked fine to identify and list the affected albums. There were only 10. Then I went ahead and manually changed the privacy level one by one to "Owner only".

Thanks.

 

[imthebest]

There was a small bit missing from the query.

Give this a try:

SELECT album.album_id FROM xengallery_album AS album
INNER JOIN xengallery_album_permission AS perm ON
    (album.album_id = perm.album_id)
WHERE perm.permission = 'view'
    AND perm.access_type = 'followed'
    AND NOT EXISTS
    (
        SELECT shared_user_id
        FROM xengallery_shared_map AS shared
        WHERE shared.shared_user_id = album.album_user_id
        AND shared.album_id = album.album_id
    )

Yep, the query worked fine to identify and list the affected albums. There were only 10. Then I went ahead and manually changed the privacy level one by one to "Owner only".

Thanks.

I have just noticed that there are still albums who got affected by this bug with their owners still unable to see them! After reviewing the query you provided it looks like it was only listing these type of albums:

perm.access_type = 'followed' (albums who got shared by members with "people they follow")

Now I need know what to put instead of "followed" in order to list those albums who got shared by members with specific users because those are the albums that are still not accessible by the affected owners.

Thanks,
Super120