Interesting idea.

I run Piwigo locally so I can just dump my new photos on my NAS (file copy) and then run the synchronization to get them added. But I have had the odd time when I'm out of the house (i.e., not on my local home network) when I've wanted to upload a photo to my physical albums, so I can see the appeal of a plugin like that. And it does seem to dovetail in with the work I've already done with Physical Photo Move.

I'll definitely think about it!

windracer wrote:

And it does seem to dovetail in with the work I've already done with Physical Photo Move.

Yeah... that's why I asked.


And to be ontopic and give you some reports about Physical photo move:
-In some specific conditions Batch Manager can give some error

You know you are able to add (virtual) photos to physical albums from admin interface? For example you have some physical albums, go to "admin->photos->add" and you can select a physical album -> upload photos . Now the photos are in piwigo/upload/ folder (so they are not physical). But if you go to client font end they are showed in the same album as the physical photos. So you can combine the virtual photos and physical ones in a physical album.

Now if you go to Admin->Batch Manager->Add filter->Predefined filter->With no virtual albums

Well ... this also show both virtual and physical photos. Seems to me there is no way to filter only physical photos from a physical album.
If you select a virtual one by mistake and you try to move it => error

Warning: [mysql error 1064] You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 3

SELECT *
  FROM piwigo_categories
  WHERE id = 
; in /www/local/piwigo/include/dblayer/functions_mysqli.inc.php on line 845

Fatal error: Call to a member function fetch_assoc() on boolean in /www/local/piwigo/include/dblayer/functions_mysqli.inc.php on line 226

windracer wrote:

I'll definitely think about it!

No need anymore, I have built it myself
http://piwigo.org/forum/viewtopic.php?id=28503
Your plugin code was a inspiration how to get a directory path from a category id.

Last edited by eliz82 (2018-02-03 21:51:29)

You still can do that plugin if you want, mine only does basic stuff. Maybe you have the skills to make it more complex then mine.

Ideas:
- make it upload the file data to the database. My plugin only upload the photo and if succeed then it show a link to "Synchronize", but your plugin can add also the file data to the database, without the need to synchronize after upload.

- check permissions of chosen upload directory and chown/chmod before and after the file upload (i also plan to do this to my plugin in the future)

- give user option to create a new physical directory from the web interface

- give option to put titles/description to images before uploading

- use a professional upload framework, example https://fineuploader.com/demos.html

Last edited by eliz82 (2018-02-04 08:27:59)

flop25 wrote:

@eliz82 please consider deleting your first version and then upload a more secure one

if you explain more where is the security hole i can take into consideration deleting the plugin

i already thinked a little bit on the security when i builded the plugin

1) pwigo/plugins/physical_browser_uploader/admin.php (this process the POST) cannot be run directly, because it need to run included in another PHP file, because it check for a PWG constant at the start => so it cannot process a direct POST request.

2) so the attacker need to make a POST request to the main file /piwigo/admin.php?page=plugin-physical_browser_uploader. but my plugin admin.php check first the "check_status(ACCESS_ADMINISTRATOR);" before processing the POST

3) that means if an attacker can POST something he need to have admin cookie credentials (that is possible with man in the middle attack if server is using http not https).

4) if it has cookie credentials he can upload a bad file with image extension? not sure if the file will actually be executed like this guy say http://nullcandy.com/php-image-upload-s … -to-do-it/
but i somehow i doubt a properly configured modern webserver execute php code from inside a image file

maybe i should try this kind of check

if (!getimagesize($_FILES['imagefile']['tmp_name'])) { 
  echo "Invalid Image File...";
  exit();
}

Last edited by eliz82 (2018-02-04 18:35:08)

this
"1- don't use a GET/POST or anything that the user can manipulate, directly in an url, for safety reasons ( check XSS)"

so you are saying the $_POST can have bad data? I first believed you have refereed to $_FILES can contain bad data (that was and still is my main concern).

to be sincere i still don't fully understand how XSS works. i'm still a noob in programing.
so the computer/browser of the Piwigo admin is hacked and a injected javascript can access cookie credentials and bypass this verification "check_status(ACCESS_ADMINISTRATOR);" from my plugin admin.php
if can bypass that verification then he can make a POST request with bad data that can compromise the Piwigo website itself?
that is what are you saying?

i can add pattern verification to POST data (check_input_parameter...) before execute, is a good idea.