mvanrompuy / lychee Goto Github PK

No protection against changes to the logged in user and role at user-side. This is problematic as at server-side no checks are implemented that will check if the action can be performed by the logged in user (though I think they were in the past).

This is a serious security risk (example: every logged-in user is able to change user role to admin), that everyone who wants to tryout this fork should be aware of.

I'm currently starting to implement checks in the PHP code to solve this.

Search results that return pictures without an associated album id fail to open.

Problem is caused by an incorrect link, containing 'null' as the album-id out of which an incorrect corresponding hyperlink is created. Probably originated out of the internal changes to the unsorted smartalbum.

Example object:

Example link:
http://snipped/#false/14782970514058

On commit: 8441a18

Other search results do work correctly (photos in albums and albums).

The 'starred' column in the photos table needs to be moved and linked to a specific user_id. This will allow user to make their own selection of favorite pictures, rather tahn having one global smartalbum.

This is a leftover from the master branch that hasn't yet been ported to support the multi-user setup.

I just cloned the multiuser branch on my web server, but I can't upload any pictures. Here are the log from database:

I Followed instruction in the Installation.md, gave 775 to data/ and 777 to Config.php, nothing worked.

edit: When I try the master from Lychee the uploads are working, so i think it isn't a PHP issue. But why is there no uploads folder in the multiuser branch ?