If a user is an album collaborator and that album has a password the access check should allow the collaborator access without entering the password.

It looks like there is some incomplete code there.

Issue fork photos-3207838

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

Nathaniel created an issue. See original summary.

nathaniel’s picture

nathaniel commented

Code snippet for PhotosAccessTest:

    // Test collaborator access password protected album.
    $edit = [
      'photos_privacy[viewid]' => 3,
      'photos_privacy[pass]' => 'test',
      'photos_privacy[updateuser]' => $this->accountEditOwnPhotosRole->getAccountName() . ' (' . $this->accountEditOwnPhotosRole->id() . ')',
    ];
    $this->updateAlbumPrivacySettings($edit);
    $this->drupalLogin($this->accountEditOwnPhotosRole);
    // Make sure password is not requested.
    $this->drupalGet('node/' . $photosImage->getAlbumId());
    $this->assertSession()->statusCodeEquals(200);
    $this->assertSession()->responseNotContains('Please enter password');
    // Allowed to view and edit.
    $this->checkAlbumAccess($photosImage, 200, 200, $file->createFileUrl());
nathaniel’s picture

nathaniel commented
Version: 6.0.x-dev » 7.0.x-dev
Parent issue: » #3562122: Refactoring and new image library features

jeremy1606 made their first commit to this issue’s fork.

jeremy1606 opened merge request !4

jerech’s picture

jerech commented
Status: Active » Needs review

I've submitted a MR!4 that addresses the collaborator access issue when an album is password protected (viewid = 3).

The fix is implemented in photos_access_pass_validate(): it now explicitly checks if the current user ID is listed as a collaborator in the photos_access_user table (where collaborate = 1 and id = $t['view']->id). If they are a collaborator, the function returns TRUE immediately, correctly bypassing the password prompt and redirect logic.

The proposed test case (from comment #2) was used to validate the fix.

  • 5de301a4 committed on 7.0.x 
    test: #3207838 Collaborator should bypass album with password

By:...

  • 3a3ce776 committed on 7.0.x 
    feat: #3207838 Collaborator should bypass album with password

By:...
nathaniel’s picture

nathaniel commented
Status: Needs review » Fixed

Looks good! Thanks for working on this.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.