Help with password system please

gwmbox

Hi guys

Trying to get my head around the password access system, even to the point I have reconsidered dropping the use of ZP over another CMS.... but would prefer to stay with ZP if I can get it to work.

So anyway my situation and need.

We have both public and private albums. The private albums have their own menu item and when accessed the visitor is shown some info and a log-in box. They can also see any published albums that exist but show a lock on them, which is not quite what I need but lets get back to that later.

So they log-in with the username and password given to them (we are using the user groups plugin as well) which enables them to login, which works, however they can now access ALL private albums, not just theirs!

So how and what can I add or change so that ONLY the album to which they have access to is shown, including on the private album page instead of showing every published album that exists (even though it has a lock on it), how do I get it to ONLY show 'published' albums if they are logged in and then only show those albums that they DO have access to.

I have tried in vane for days trying to figure this out, the documentation and user guide has not helped me, regardless of if that is due to my lack of understanding of it or the documentation not being complete... the end result is that I cannot get it to work as I feel it should.

So, if anyone has the private albums system working as I describe above or if you can let me know how to achieve that please it will be greatly appreciated and will save me from having to ditch ZP altogether.

Thanks

GW

gwmbox

LOL, isn't it always the case when you make a post like the above you find the solution.... arghhhh!

Anyway here is the answer in case anyone else is looking for it. Note I am also using the User Groups plugin, and this assumes you have already created your login form on the relevant page.

So anyway what I have done is (album.php)

`
<?php while (next_album()):
if (isProtectedAlbum() == false) { ?>

THE ALBUMS THUMB-NAILS HTML

<?php } else {
if (isProtectedAlbum() == true) {
if (zp_loggedin() == true) {
if ($_zp_current_album->getUser() == $_zp_current_admin_obj->getUser()) { ?>

THE ALBUMS THUMB-NAILS HTML

<?php } else {}}}}
endwhile; ?>
`
So what this does is check if it is protected, if not then show, if is, then check if logged in, if not end and none shown, if they are logged in, check user against album password, if correct then show album thumbnail with link to album.

Hope that helps someone took my days to figure this one out so it would work as I specified above.

GW

acrylian

Good that you got it working. There is also a function named `isMyAlbum()` (see documentation for exact name/usage). Btw, I believe your 2nd `if (isProtectedAlbum() == true) {` is not necessary as you already have a `if/else` clause for that.

sbillard

Glad this works for you. But I think some general comments are in order:

First. Pagination will probably not work correctly. Zenphoto pagination presumes that all the album thumbnails produced by the `next_album()` loop are displayed. Your code overrides this, so the number of thumbnails displayed on a page will vary depending on how many candidates are actually displayed.

Second: The data stored in `album->getUser()` is only mappable to an admin user if you have been careful to do so on the back-end. In particular, these `users` are "guest" users typically and would have a priori relation to Zenphoto users.

I'm still unclear as to why you need to do this. Albums which are not published are shown only to Zenphoto or guest users who have access rights to them. Albums which are protected may be accessed only by those same users.

gwmbox

sbillard I understand what you are saying and I tried a lot of variations of doing what I needed but no matter what I tried the logged in user would also see the albums of the other protected albums that they should not be able to see and even know they exist.

So what was I trying to do (since you asked)

Basically we have a set of albums of which are private to the respective client. They come to our site to view proofs before ordering their prints or digital finals. They go to our menu item 'client albums' and they are greeted with a login screen. They then login and then (if they login correctly) they can see their album(s) only, they cannot see ANY other albums in that area, not even with a lock on it, they simply only see their own and nothing else exists as far as they are concerned.

They can then click on their album(s) and browse them and order what they want - simple really.

Not sure about the pagination issue, but I do not suspect it will be an issue as each client is probably only going to have a max of 5 albums each.

Cheers

GW

acrylian

Sine we don't know your site's structure at all, I think sbillard referred to the normal gallery view generated by the next_album loop. If you manually "hide" albums within that via such a check the pagination will look weird. If you don't use that because you use another structure this might work of course.

Generally if an album is password protected, assigned to users and also unpublished no one without the rights to see that album should be able to see it or know it exists.

sbillard

If you have given "view all" rights to your users, of course they will see all unpublished albums.

Anyway. To reiterate. The way it works is as follows.

Visibility: Published items are available to be seen by the public in general. Unpublished items may be viewed only by Zenphoto users who have the appropriate rights to the item.

Accessability: Unprotected items may be accessed by the public. Protected items may be accessed by 1) guest users who have supplied the appropriate user/password. 2) Zenphoto users who have the appropriate access rights.

So to accomplish what you want you shoule be setting all albums you do not want publicly seen to un-published. Then no thumbnails will appear for these items for the public or for users without appropriate rights. If you want to be sure that no one un-auhorized can visit the album (they could only do so if they know the link.) then you also password protect the album.

With the above, the public cannot see nor access these albums. For your users you will have to decide what rights they need. But the minimal setup would be to grand a user album rights and assign him as managed albums those un-published/protected albums you want him to see. For those albums, remove the edit and upload rights if you do not want him doing those things.