Updating owner permissions across entire gallery

Gallery version (not just "2"): 2.3 core 1.3.0
PHP version (e.g. 5.1.6): 5.2.4
PHPInfo Link (see FAQ): (private test server)
Webserver (e.g. Apache 1.3.33): Apache 2.2.8
Database (e.g. MySql 5.0.32): MySQL 5.0.51a
Activated toolkits (e.g. NetPbm, GD): netpbm, gd
Operating system (e.g. Linux): Ubuntu Server 8.04
Browser (e.g. Firefox 2.0): IE8

I'm trying to figure out if it's possible to update the owner permissions for every album in the gallery recursively. For instance, in my gallery root I have over 100 albums, each owned by a registered user. I want to be able to recursively add the Edit Item permission to every album and item but not change the ownership. If I go to the root album and choose Edit Permissions it will only let me set the permissions for a specific user, there doesn't seem to be a way to tell it to change permissions for the existing owner and so this would result in a specific user or group having Edit Item permissions on every album and item rather than the existing defined owner.

Is there a way to do this in the core code? Or is there an existing module to manage this? I've even been looking at possibly writing a MySQL query to perform the updates on the tables direct but this may end up trashing my gallery if I don't get it quite right.

Gallery does have a concept of owner - it's the very first option in the permissions page, in both Gallery 1 and 2. Each item in Gallery 2 has an ownerid value in the database too. Any new album created also has it's owner set to the user that created it. I've dug around in the database enough to have written some SQL to be able to reassign ownerships in my G1 migration (all user info is lost because my G1 is embedded in PHP Nuke).

I'll try and write a module to handle this and make it available to anyone who wants it, but I didn't want to start on it if someone had already done it (or it was already in the core).

But G1 does have a sort of owner permission handling, see the Owner Permissions tab in the properties for an album/item. You can set it so that the owner of an item can always edit or delete it, and this does work because on my existing G1 (1.5) site users can happily add and remove items that they have "ownership" of even though the permissions page has these permissions set to NOBODY .

However, I do see that I partly misunderstood your reply. It's a shame that G2 doesn't have even the simple option that G1 provides for this.

And I know what NTFS permissions are, I've been a Windows network admin and developer for 15 years

I think what I might do is have a group called Owners with no users in it, and assign permissions to that group as required. Then I can modify the appropriate permissions method in the core API (I think GalleryUserHelper_simple::hasItemPermission is the place to do this) so that when checking if a user has permissions it also checks if the user is the owner of the item and the Owners group for the appropriate permission, and if so then returns the same response as if the user had that same permission assigned. This way there should only be a few ACLs (on my own gallery there should be just one as all Owners will have the same permissions on their items), and so shouldn't impact the performance too much (and indeed should be better than having 1 ACL per user assigned to every item they own).

If you have any other ideas feel free to suggest them - I'll be messing with this over the next few hours and if I can get it to work I'll post the code changes.

Great! Please add to the wiki:
http://codex.gallery2.org/Gallery2:User_Contributions#Mods.2FPatches
____________________________________________
Like Gallery? Like the support? Donate now!!! See G2 live here

You've got to create a new account over there. If I get a chance and remember, I'll add it
____________________________________________
Like Gallery? Like the support? Donate now!!! See G2 live here

Here's a revision using a UNION - this should be more scaleable, and it also moves the userid and group name into the $data array rather than putting them directly into the $query string.

Replace, from the original version of GalleryPermissionHelper_simple.class

	$query = '
	SELECT
	    [GalleryAccessSubscriberMap::itemId],
	    ' . $bitOr . '
	FROM
	    [GalleryAccessMap], [GalleryAccessSubscriberMap]
	WHERE
	    [GalleryAccessSubscriberMap::itemId] IN (' . $itemIdMarkers . ')
	    AND
	    [GalleryAccessSubscriberMap::accessListId] = [GalleryAccessMap::accessListId]
	    AND
	    [GalleryAccessMap::userOrGroupId] IN (' . $entityIdMarkers . ')
	' . $groupBy;

	$data = $itemIds;
	$data[] = (int)$userId;
	array_splice($data, count($data), 0, $groupIds);

with

	$query = '
	SELECT
	    [GalleryAccessSubscriberMap::itemId],
	    ' . $bitOr . '
	FROM
	    [GalleryAccessMap], [GalleryAccessSubscriberMap]
	WHERE
	    [GalleryAccessSubscriberMap::itemId] IN (' . $itemIdMarkers . ')
	    AND
	    [GalleryAccessSubscriberMap::accessListId] = [GalleryAccessMap::accessListId]
	    AND
	    [GalleryAccessMap::userOrGroupId] IN (' . $entityIdMarkers . ')

	' . $groupBy . '
	    
	UNION

	SELECT
	    [GalleryAccessSubscriberMap::itemId],
	    ' . $bitOr . '
	FROM
	    [GalleryAccessMap], [GalleryAccessSubscriberMap], [GalleryItem], [GalleryGroup]
	WHERE
	    [GalleryAccessSubscriberMap::itemId] IN (' . $itemIdMarkers . ')
	    AND
	    [GalleryAccessSubscriberMap::accessListId] = [GalleryAccessMap::accessListId]
	    AND
	    [GalleryItem::id] = [GalleryAccessSubscriberMap::itemId] AND [GalleryItem::ownerId] = ?
	    AND 
	    [GalleryAccessMap::userOrGroupId] = [GalleryGroup::id] AND [GalleryGroup::groupName] = ?
	    
	' . $groupBy;
    
	$data = $itemIds;
	$data[] = (int)$userId;
	array_splice($data, count($data), 0, $groupIds);
	
	//add the itemids, userid, and group name
	//to the array for insertion for the second part of the union
	$data2 = $itemIds;
	$data2[] = (int)$userId;
	$data2[] = 'ItemOwner';
	array_splice($data, count($data), 0, $data2);
	unset($data2);

So far this is working great on my gallery which has 588 albums and 5640 images, and just 4 rows in the AccessMap table (as I use only group permissions across my entire gallery).

It sucks yes, but stupid, no. It's actually good. The fewer permissions you have have set, the better. Read all about it here:
http://codex.gallery2.org/Gallery2:ACL_Performance

To make it better the entire permission system would need to be redesigned. That's not going to happen. Major development on G2 is finished. G3 is coming up next and at most only security patches will be forth coming for G2, if there are any. A security firm did a very thorough audit of G2's code prior to 2.3 being released, so it's very likely 2.3 is the last of 2.x.

The developers learned from G1 and created G2, they learned from G2 and are not focused on creating something better for G3:
http://gallery.menalto.com/gallery_3_begins
http://gallery.menalto.com/gallery_3.0_beta_1_released

I haven't dug into G3 very deeply yet, but photo level permissions are gone, see 2nd paragraph under Scope and target audience here Focusing on performance and simplicity.

I'd really suggest taking a look at User Albums. Each user has their own they can deal with.
____________________________________________
Like Gallery? Like the support? Donate now!!! See G2 live here

Argh! Looks like more edits are needed. My gallery is now live, and I've got a user who couldn't delete one of his own photos. I tracked it down to gallery calling hasItemPermission in GalleryUserHelper_simple, and if the item isn't in the sesssion cache then it doesn't allow it to be removed because it's looking up the access list ids specific to that user. I can't modify fetchAccessListIds because I don't want users to be ItemOwner members for all photos as they'd have permissions on everything, but I think I've worked around this by adding a call to the modified fetchPermissionsForItems function above before the session cache is checked. I need to test this fully yet, but in case anyone else is using this code here's the change.

In function hasItemPermission in GalleryUserHelper_simple.class, before the following line

$cacheKey = "GalleryPermissionHelper::getPermissions($itemId,$userId,$sessionPermissions)";

add the following:

//dcc mod 29/7/09 - item_owner group handling get perms into cache if not already there
$itemIds[] = $itemId;
list ($ret, $permissionsTable) =
GalleryCoreApi::fetchPermissionsForItems($itemIds, $userId, $sessionPermissions);
if ($ret) {
return $ret;
}
//dcc end mod

It's not very efficient doing it this way, but it should hopefully be a short term workaround. I'm looking into the rest of the code to see if there's anywhere else that the permissions are pulled direct rather than using the fetchPermissionsForItems function.

So far everything else seems to be working in my live gallery. It's at http://www.ageofstrife.com/gallery2.php , it's an embedded gallery in phpbb 3 using the NukedGallery integration. 5 ACLs cover 518 albums and 6245 photos, with everyone able to add/edit/delete their own images and albums

There are some issues though which might be related to this integration - users get logged out even when they tick remember me which I think is due to the Gallery session handling and using the random gallery image block, and the GalleryEmbed::Logout call when clicking Logout often results in a blank screen so I've had to comment it out until I can pick through the gallery code and figure out why it's not returning an error message if there's a problem. Both of these seem to be caused by the gallery session handling, which also suggests that it's an issue in the embedded calls but the gallery2.php looks to be doing it correctly. If I can't figure it out soon I'll be posting a new topic in this forum asking for help ;)