If the main gallery is protected by a master password, the search dialog is still working, even if the visitor does not input anything. I recently modified the index.php of the standard theme to show a tag cloud (printAllTagsAs). Each visitor can click on the tags and it works, even if he did not input a password. Those functions should be disabled until the user input the correct password. Why you don't handle all the password stuff within the htaccess file(s)?

The search dialogs are protected by their own password.

For me it makes no sense to have a master password for the gallery, but let the search dialog open to everyone. The master password should protect everything.

Agreed. We will add the master password in the Serach page validation path.

Should make it into tonight's build.

Sorry for writing you again, but what about the rss links? They are still working, even without a password...

I'd also add that RSS and archive view/search bypass the password.

Thanks!

We know that and we are working on it.

durango99:

What do you mean by archive view/search bypassing the password? Are you running the 1.1.3 release or the nightly build?

Hi sbillard, I'm still using the 1.1.3 version. I'll assume that I should test out with the nightly build instead I'll try it out tonight. Thanks for your work and time (and time to comment)!

Yes, passwords had several problems in the base release. But, you should know that if you allow search (no password on search or on the gallery) search will return thumbs of protected items. That is by design. Clicking on the thumb will get you to the protection login.