Announcement

  •  » Engine
  •  » How to determine photo vs album?

#16 2018-01-30 13:22:16

eliz82
Member
Romania
2016-04-27
237

Re: How to determine photo vs album?

Hey windracer, sorry for offtopic but i see you are active here.
I see you are into physical albums, maybe you got some experience with them.
Are you interested in creating an extension that will let admin upload images to physical albums from web browser? Something like "Physical-browser uploader"

I find annoying that I need to use a FTP client to upload pictures to physical albums.

https://developer.mozilla.org/en-US/doc … input/file
Just a simple html form with an select element that sent a album path and a input file.

On the client side you need a plugin option page will generate a tree only of the physical directories (not also virtual)

Code:

<form method="post" enctype="multipart/form-data" action="upload.php">
  <select id="album_id" name="album_id">
    <option value="galleries/">--Root--</option>
    <option value="galleries/album">album</option>
    <option value="galleries/album/subalbum1">album / subalbum1</option>
    <option value="galleries/album/subalbum2">album / subalbum2</option>
    ...
  </select>
    <input type="file" id="image_uploads" name="image_uploads" accept=".jpg, .jpeg, .png" multiple>
    <input type="submit" value="Submit">
</form>

You also need a php script on the server side (they are examples on internet) to move the files to the specified directory.  After photos are uploaded maybe do a automatic redirect to Synchronization page, or show a link admin.php?page=site_update&site=1

this plugin is doing something similar with my idea but it's uploading files as virtual.
http://piwigo.org/ext/extension_view.php?eid=861

Last edited by eliz82 (2018-01-30 13:25:34)

Offline

 

#17 2018-01-30 22:22:50

windracer
Member
St. Pete, FL
2014-12-28
218

Re: How to determine photo vs album?

Interesting idea.

I run Piwigo locally so I can just dump my new photos on my NAS (file copy) and then run the synchronization to get them added. But I have had the odd time when I'm out of the house (i.e., not on my local home network) when I've wanted to upload a photo to my physical albums, so I can see the appeal of a plugin like that. And it does seem to dovetail in with the work I've already done with Physical Photo Move.

I'll definitely think about it!

Offline

 

#18 2018-01-31 04:52:37

reddn
Member
DC, USA
2015-09-29
29

Re: How to determine photo vs album?

windracer wrote:

Interesting idea.

I run Piwigo locally so I can just dump my new photos on my NAS (file copy) and then run the synchronization to get them added. But I have had the odd time when I'm out of the house (i.e., not on my local home network) when I've wanted to upload a photo to my physical albums, so I can see the appeal of a plugin like that. And it does seem to dovetail in with the work I've already done with Physical Photo Move.

I'll definitely think about it!

Sorry to go off topic here, but @windracer I do the same thing.  My FreeNAS box runs piwigo in a jail, and I just have a 'folder sync' app on my phone to copy my photos/movies to my NAS. 

I haven't messed with Piwigo beyond making creation dates in the db for each mp4 (the sync does not add it, I use a ridicious 3 variant regex to get it)

I need to add to the cron to sync the pics and make thumbnails, just need to get around to digging through the code to reverse engineer it.

Although I really like plg's VideoJS plugin, need to automate that too.

Soon I am going to re-encode my phone videos, they are too big for any type of streaming.  I will probably make another table and move the originals elsewehre.

Offline

 

#19 2018-01-31 09:24:37

eliz82
Member
Romania
2016-04-27
237

Re: How to determine photo vs album?

windracer wrote:

And it does seem to dovetail in with the work I've already done with Physical Photo Move.

Yeah... that's why I asked.


And to be ontopic and give you some reports about Physical photo move:
-In some specific conditions Batch Manager can give some error

You know you are able to add (virtual) photos to physical albums from admin interface? For example you have some physical albums, go to "admin->photos->add" and you can select a physical album -> upload photos . Now the photos are in piwigo/upload/ folder (so they are not physical). But if you go to client font end they are showed in the same album as the physical photos. So you can combine the virtual photos and physical ones in a physical album.

Now if you go to Admin->Batch Manager->Add filter->Predefined filter->With no virtual albums

Well ... this also show both virtual and physical photos. Seems to me there is no way to filter only physical photos from a physical album.
If you select a virtual one by mistake and you try to move it => error

Code:

Warning: [mysql error 1064] You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 3

SELECT *
  FROM piwigo_categories
  WHERE id = 
; in /www/local/piwigo/include/dblayer/functions_mysqli.inc.php on line 845

Fatal error: Call to a member function fetch_assoc() on boolean in /www/local/piwigo/include/dblayer/functions_mysqli.inc.php on line 226

Offline

 

#20 2018-01-31 14:58:57

windracer
Member
St. Pete, FL
2014-12-28
218

Re: How to determine photo vs album?

eliz82 wrote:

If you select a virtual one by mistake and you try to move it => error

Yep, you're right ... looks like I need to check in the batch manager if a virtual-only photo is selected and work around that. Thanks for pointing this out.

[Github] Piwigo-physical_photo_move issue #10

Offline

 

#21 2018-02-03 20:43:01

eliz82
Member
Romania
2016-04-27
237

Re: How to determine photo vs album?

windracer wrote:

I'll definitely think about it!

No need anymore, I have built it myself
http://piwigo.org/forum/viewtopic.php?id=28503
Your plugin code was a inspiration how to get a directory path from a category id.

Last edited by eliz82 (2018-02-03 21:51:29)

Offline

 

#22 2018-02-04 03:32:05

windracer
Member
St. Pete, FL
2014-12-28
218

Re: How to determine photo vs album?

eliz82 wrote:

No need anymore, I have built it myself

Ha, you beat me to it! I started the framework for PPU (Physical Photo Upload) but you were quicker than I was. I will definitely check this out!

Offline

 

#23 2018-02-04 08:27:08

eliz82
Member
Romania
2016-04-27
237

Re: How to determine photo vs album?

You still can do that plugin if you want, mine only does basic stuff. Maybe you have the skills to make it more complex then mine.

Ideas:
- make it upload the file data to the database. My plugin only upload the photo and if succeed then it show a link to "Synchronize", but your plugin can add also the file data to the database, without the need to synchronize after upload.

- check permissions of chosen upload directory and chown/chmod before and after the file upload (i also plan to do this to my plugin in the future)

- give user option to create a new physical directory from the web interface

- give option to put titles/description to images before uploading

- use a professional upload framework, example https://fineuploader.com/demos.html

Last edited by eliz82 (2018-02-04 08:27:59)

Offline

 

#24 2018-02-04 12:07:21

flop25
Piwigo Team
2006-07-06
6851

Re: How to determine photo vs album?

to both of you, a very important message:
don't use another upload script than the one already used by Piwigo
use tokens on ALL your form, especially when dealing the upload of files

@eliz82 please consider deleting your first version and then upload a more secure one


To get a better help : Politeness like Hello-A link-Your past actions precisely described
Check my extensions : more than 30 available
who I am and what I do : http://fr.gravatar.com/flop25
My gallery : an illustration of how to integrate Piwigo in your website

Online

 

#25 2018-02-04 18:32:48

eliz82
Member
Romania
2016-04-27
237

Re: How to determine photo vs album?

flop25 wrote:

@eliz82 please consider deleting your first version and then upload a more secure one

if you explain more where is the security hole i can take into consideration deleting the plugin

i already thinked a little bit on the security when i builded the plugin

1) pwigo/plugins/physical_browser_uploader/admin.php (this process the POST) cannot be run directly, because it need to run included in another PHP file, because it check for a PWG constant at the start => so it cannot process a direct POST request.

2) so the attacker need to make a POST request to the main file /piwigo/admin.php?page=plugin-physical_browser_uploader. but my plugin admin.php check first the "check_status(ACCESS_ADMINISTRATOR);" before processing the POST

3) that means if an attacker can POST something he need to have admin cookie credentials (that is possible with man in the middle attack if server is using http not https).

4) if it has cookie credentials he can upload a bad file with image extension? not sure if the file will actually be executed like this guy say http://nullcandy.com/php-image-upload-s … -to-do-it/
but i somehow i doubt a properly configured modern webserver execute php code from inside a image file

maybe i should try this kind of check

Code:

if (!getimagesize($_FILES['imagefile']['tmp_name'])) { 
  echo "Invalid Image File...";
  exit();
}

Last edited by eliz82 (2018-02-04 18:35:08)

Offline

 

#26 2018-02-04 18:34:04

flop25
Piwigo Team
2006-07-06
6851

Re: How to determine photo vs album?


To get a better help : Politeness like Hello-A link-Your past actions precisely described
Check my extensions : more than 30 available
who I am and what I do : http://fr.gravatar.com/flop25
My gallery : an illustration of how to integrate Piwigo in your website

Online

 

#27 2018-02-04 21:30:30

eliz82
Member
Romania
2016-04-27
237

Re: How to determine photo vs album?

this
"1- don't use a GET/POST or anything that the user can manipulate, directly in an url, for safety reasons ( check XSS)"

so you are saying the $_POST can have bad data? I first believed you have refereed to $_FILES can contain bad data (that was and still is my main concern).

to be sincere i still don't fully understand how XSS works. i'm still a noob in programing.
so the computer/browser of the Piwigo admin is hacked and a injected javascript can access cookie credentials and bypass this verification "check_status(ACCESS_ADMINISTRATOR);" from my plugin admin.php
if can bypass that verification then he can make a POST request with bad data that can compromise the Piwigo website itself?
that is what are you saying?

i can add pattern verification to POST data (check_input_parameter...) before execute, is a good idea.

Offline

 

#28 2018-02-05 20:55:04

windracer
Member
St. Pete, FL
2014-12-28
218

Re: How to determine photo vs album?

eliz82 wrote:

-In some specific conditions Batch Manager can give some error
...
If you select a virtual one by mistake and you try to move it => error

By the way, I've fixed this in v2.02a of the extension. :)


Uploaded Images

Last edited by windracer (2018-02-05 20:57:39)

Offline

 
  •  » Engine
  •  » How to determine photo vs album?

Board footer

Powered by FluxBB

github twitter facebook google+ newsletter Donate Piwigo.org © 2002-2018 · Contact