Password protect redirect

Fixed this myself again.

The problem is with the password module itself. When setting a password for a particular album, the password module password protects that item, but then only removes the 'core.view' permissions for anonymous users for all descendant objects (children and grandchildren, etc). When these descendant objects are accessed directly, the password module checks if they are password protected (which they will not be) and then returns and since the 'core.view' permissions have been removed, the gallery core module redirects to the standard login page.

I ended up having to add some code that will pull in all the descendants of the password protected object and then check to see if the itemId of the descendant is in that list (protected by an ancestor). I then had to comment out the check for the 'core.view' permissions since the password module has removed this permission for all descendants. With these changes, if an object is not specifically password protected but is under an ancestor that is, the code path for the single password page redirect will be taken.

I have only tested this within my own particular use case on my own gallery but I am sure the change is generic enough to be applied to any use case. Anyway, long story short, here is the diff and patch for the changes I made in case anyone wants similar functionality.

Diff:

169c169,177
<       if ($view == 'core.ShowItem' && $itemId == $item->getId() && !$duringUpgrade) {
---
>         # XXX - Added to redirect to proper password prompt even if a child of
>         #       a password protected album is accesssed directly.
>         $protected = false;
>         list ($ret, $descendants) = GalleryCoreApi::fetchDescendentItemIds($item, null, null, null);
>         if (!empty($descendants)) {
>             $protected = array_search($itemId, $descendants);
>         }
> 
>       if ($view == 'core.ShowItem' && ($itemId == $item->getId() || $protected) && !$duringUpgrade) {
191c199
<               if (isset($permissions['core.view']) || !empty($isHidden)) {
---
>               //if (isset($permissions['core.view']) || !empty($isHidden)) {
206c214
<               }
---
>               //}

Patch:

*** module.inc.orig   2008-09-27 20:13:28.000000000 -0500
--- module.inc  2008-09-27 20:06:11.000000000 -0500
***************
*** 166,172 ****
            $itemId = $item->getId();
        }
  
!       if ($view == 'core.ShowItem' && $itemId == $item->getId() && !$duringUpgrade) {
            list ($ret, $permissions) = GalleryCoreApi::getPermissions($itemId);
            if ($ret) {
                return $ret;
--- 166,180 ----
            $itemId = $item->getId();
        }
  
!         # XXX - Added to redirect to proper password prompt even if a child of
!         #       a password protected album is accesssed directly.
!         $protected = false;
!         list ($ret, $descendants) = GalleryCoreApi::fetchDescendentItemIds($item, null, null, null);
!         if (!empty($descendants)) {
!             $protected = array_search($itemId, $descendants);
!         }
! 
!       if ($view == 'core.ShowItem' && ($itemId == $item->getId() || $protected) && !$duringUpgrade) {
            list ($ret, $permissions) = GalleryCoreApi::getPermissions($itemId);
            if ($ret) {
                return $ret;
***************
*** 188,194 ****
                    }
                }
  
!               if (isset($permissions['core.view']) || !empty($isHidden)) {
                    /* Redirect to PasswordEntry if we have core.view or item is also hidden */
                    global $gallery;
                    $session =& $gallery->getSession();
--- 196,202 ----
                    }
                }
  
!               //if (isset($permissions['core.view']) || !empty($isHidden)) {
                    /* Redirect to PasswordEntry if we have core.view or item is also hidden */
                    global $gallery;
                    $session =& $gallery->getSession();
***************
*** 203,209 ****
                          array('view' => 'password.PasswordEntry', 'itemId' => $itemId),
                          array('forceFullUrl' => true, 'htmlEntities' => false)));
                    $phpVm->exit_();
!               }
            }
        }
        return null;
--- 211,217 ----
                          array('view' => 'password.PasswordEntry', 'itemId' => $itemId),
                          array('forceFullUrl' => true, 'htmlEntities' => false)));
                    $phpVm->exit_();
!               //}
            }
        }
        return null;

i am trying to implement this patch and wanted (well have) to patch the file manually. (i only have FTP access currently to solve this problem)

i will be unsing a password for each album, does this patch enable a guest with the password to view full size images? guest currently do not have that permission in my gallery, only the admin.