Does it support PHP 7.0 or newer?

The new notification mechanism (with auth key in the URL) is really cool.

I think it lacks a few explanation, though. From what I read in the code, the auth key is valid only 3 days, configurable with $conf['auth_key_duration'].

There could be a mention of it like "the notification email contains a link that will auto-login the user, valid for 3 days" in the page admin.php?page=album-XXX-notification so that the owner of the gallery understands better what's going on (and can answer questions from visitors like "it worked yesterday, but today it doesn't" more easily).

plg wrote:

mmoy wrote:

There could be a mention of it like "the notification email contains a link that will auto-login the user, valid for 3 days" in the page admin.php?page=album-XXX-notification so that the owner of the gallery understands better what's going on (and can answer questions from visitors like "it worked yesterday, but today it doesn't" more easily).

Good idea. I will implement it.

Ideally, there would also be an easy way to configure this from the web interface. In my case, an auth token without expiry would actually be better than this 3-days.

I'd also appreciate having a link that I could cut-and-paste in an email I would send by myself. That would have the at least the following advantages:

* Emails I send manually are less likely to be considered as spam (currently all mails sent by piwigo.com are considered as spam by gmail it seems, which makes the feature unusable in practice).

* I could send the same link to multiple persons (sometimes I have a piwigo user who actually correspond to a group of physical persons).

* I could send the link as part of another message (e.g. replying to someone and add the link as part of the conversation).

Nothing that should block 2.8 release, just throwing out ideas.

plg wrote:

An auth key with no expiration sound quite poor in term of security.

Not much worse than "BTW, shall I remind you that your password is XXX" that I'm currently using most of the time. Yes, I know, there's a password recovery mechanism, but my visitors usually don't use it, they just keep the password I've set for them and ask me "can you tell me what my password is?" if they forgot their password.

I don't have any real secret within my pictures. I just don't want some of them to be easily indexed by search engine and publicly available. But the content of my gallery is less secret than the content of emails I send to my visitors.

Hello,

If I may add my 2cts?
The plugin User Collections although limited to collections ;) features already the framework for private keyed links (but not thru autologin). It features adaptable validity and even passwords if needed, link encrypting is automatic and can be customised, sent by mail or copied even deleted.
The only missing (may be not possible) is to adapt it to albums and set of picts because picture selection is a bit complicated  in the current plugin.

DéHème
http://piwigo.us/beta/deheme/index.php? … 6a75f6beb1

Last edited by deheme (2016-01-25 16:55:02)