Mambo 4.5.2 and getorderby

more information:

I ran thru the following use case as a user, admin, and guest:

1. access mambo main page
2. log in
3. click on link to embedded gallery
4. open first album
5. click on first picture
6. go to page to execute phpinfo()

In each case, I noticed that the http header data (namely the http_cookie) had some subtle differences.

as user: sessioncookie=4b6c78911a247b1d4c9a820e3ef2b04b; usercookie[username]=username; usercookie[password]=50be3f1e50be3f1e50be3f1e50be3f1e; GALLERYSID_34355e=27031eeebda9ec91801a39f7bfde98f0

as guest: sessioncookie=4b6c78911a247b1d4c9a820e3ef2b04b; GALLERYSID_34355e=bffe0c9d36eef6c250bf0c8de25d05ac

as admin: sessioncookie=4b6c78911a247b1d4c9a820e3ef2b04b; GALLERYSID_34355e=bffe0c9d36eef6c250bf0c8de25d05ac

Also, as guest I noticed that the URL contained an extra parameter tacked onto the end containing the GALLERYSID data where there was none in the other two requests. As stated before the guest and admin users function without difficulty. I scanned thru gallery2.php and noticed that the only portion of code that differentiates between users and guests+admin is below, so something must be happening in this code block that is causing problems with users... I suppose it could be a combination of other bits of code, but I didn't see anything else in the code that would execute for all users whose username != admin.

            if (!empty($my->username) && (strcasecmp($my->username, 'admin')!=0))
            {
                // Check to see if they have an album

                list ($ret, $rootAlbum) = GalleryView::_getItem();
                if ($ret->isError())
                {
                    return 0;
                }

                list ($ret, $childIds) = GalleryCoreApi::fetchChildAlbumItemIds($rootAlbum);
                if ($ret->isError())
                {
                    return 0;
                }
                if (!empty($childIds))
                {
                    list ($ret, $items) = GalleryCoreApi::loadEntitiesById($childIds);
                    if ($ret->isError())
                    {
                        return 0;
                    }

                    $found_album = false;
                    foreach ($items as $child)
                    {
                        if (strcasecmp($child->getTitle(), $my->username)==0)
                        {
                            // Yes, they have an album
                            $found_album = true;
                            break;
                        }
                    }
                    if ($found_album == false)
                    {
                        if ($special_action == 'create_album')
                        {
                            // If they want an album, create one!
                            CreateUserAlbum($my);
                        }
                        else
                        {
                            echo '<p>You currently don't have a photo album, but you're entitled to one. '
                                .'<a href="http://' . $HTTP_HOST . $PHP_SELF . '?' . $_SERVER['QUERY_STRING']
                                .'&special_action=create_album' . '">Create my album!</a></p>' . "\n";
                        }
                    }
                }
            }

oh, delete that block of code and it should fix the problem... :D