Announcement

#1 2021-03-05 23:10:17

drdr66
Member
2021-03-05
4

Permissions seem snarled up somehow

Hi,

Since the latest upgrade, I don't seem to be able to control permissions any more. Basically this is a private site for family only, and the whole site was set to allow access to the group "family" only.

After the update, I noticed that about half the second-level albums were visible without a login (i.e. were public)

I removed the family group permission and no albums are visible.

I removed the family group and re-created it.

I added the family permission to the root album, and now the entire album and all sub-albums are public.

So I've had to remove the family permission and no photos are visible (even with a login).

Are there any debug settings?

There is also one user that has become lost - 4 users are visible in the user management, but when I try to re-create the 5th user ("ruth") I'm told that the user already exists. But they don't show.

Help appreciated,

Derek


    Piwigo 11.3.0 Check for upgrade
    Operating system: Linux
    PHP: 7.3.27-1~deb10u1 (Show info) [2021-03-05 22:02:27]
    MySQL: 8.0.23 [2021-03-05 22:02:27]
    Graphics Library: GD 2.2.5

Piwigo URL: http://camroberts.org.uk/album

Offline

 

#2 2021-03-06 18:25:07

erAck
Only trying to help
2015-09-06
2029

Re: Permissions seem snarled up somehow

It's a bit unclear to me if by "added the family permission to the root album" (whatever "the root" album might be) you mean you added a group family to the album and applied it also to the subalbums, or only to the one album, or added only that album as authorised to the group. Make sure the albums that shall not be visible to guests are set to private and move those albums for the group family from forbidden to authorised (or add the group to each individually or apply to subalbums of root album). Then again, if a root album is private and the group family (that would have permission to view it) is not applied then it and its subalbums can not be viewed, so that sounds right for "the root" album. I think either you had added user guest to the group family (which would explain all albums were visible even without login) or your albums' public/private settings are not right and thus also not the forbidden/authorised albums within the group, or some mix thereof.

However, the described behaviour with the "lost" user (unless you typed something into the Search field that narrows the user display) sounds like your database is screwed. If when creating 'ruth' it says it would already exist then in the database table piwigo_user an entry with that username should exist. Note the id number. In table piwigo_user_infos then should be a record with the same number in user_id. If it is not that might be the reason. In that case maybe adding a record would be possible, copying initially from user guest and adjusting the id. Whatever you change, backup before!

Also, the webadmin account usually has id 1 and guest id 2 (check it in table piwigo_user) and table piwigo_user_group has the associations of user ids to group ids. The guest user's id should not show up there.

Table piwigo_groups contains the group names and ids, table piwigo_group_access the association of group ids to authorised category ids, check that all piwigo_groups, piwigo_user_group and piwigo_group_access are aligned with what you expect.

If the database is further broken I have no good recipe to fix it, apart from restoring everything from the last known good backup and trying the upgrade again. Backup before! Maybe tools maintenance's integrity check or Repair and optimise database helps, but maybe also messes up things more. Backup before! Before changing things even further maybe compare the database dump of the good backup with a dump of the current state regarding user and category tables, maybe something catches your eye.


Running Piwigo at https://erack.net/gallery/

Offline

 

#3 2021-03-08 00:04:06

drdr66
Member
2021-03-05
4

Re: Permissions seem snarled up somehow

I had a good look around the database with phpmyadmin and it was clear that there were problems in the user tables. I was able to manually fix the "ruth" entry, and this then appeared in the user management pages as expected.

However the permissions problem persisted. I tracked this down to another user; removing this user's permission to view files caused the whole album structure to go from being invisible to non-logged in users to fully visible to non-logged in users. This doesn't make any sense to me at all. Checking the top level album, no albums are public.

So I bit the bullet and built a new database. This seems to have solved the permissions problems. What it hasn't solved is the persistent 504 Gateway Timeout that seems to pop up for many operations.

For example under "Album List Management" I have "Add album" and "Camera", the latter contains 28116 photos and 580 sub albums. Attempting to "edit" this album creates a 504 error after a few seconds. So it's currently impossible for me to say what permissions are set on this.

Offline

 

#4 2021-03-08 12:17:59

flop25
Piwigo Team
2006-07-06
7037

Re: Permissions seem snarled up somehow

Hello

that's sounds like a database corruption but I hope it's not from Piwigo

About your 504 issue could I have an admin access sent to flop25 at gmail dot com please?


To get a better help : Politeness like Hello-A link-Your past actions precisely described
Check my extensions : more than 30 available
who I am and what I do : http://fr.gravatar.com/flop25
My gallery : an illustration of how to integrate Piwigo in your website

Offline

 

#5 2021-03-08 21:24:21

drdr66
Member
2021-03-05
4

Re: Permissions seem snarled up somehow

Before I send an access, I note that the following is present in the apache error log

[Mon Mar 08 20:15:07.122007 2021] [proxy_fcgi:error] [pid 21718:tid 140039891711744] (70007)The timeout specified has expired: [client 192.168.10.24:47400] AH01075: Error dispatching request to : (polling), referer: https://camroberts.org.uk/album/admin.php?page=cat_list

If I descend one level and choose an album with fewer sub-albums, all completes as expected.

Any idea what sets the timeout value? It seems to be about 15 seconds, which might be a bit short for the operation if it's having to scan the entire database.

Offline

 

#6 2021-03-09 02:03:16

erAck
Only trying to help
2015-09-06
2029

Re: Permissions seem snarled up somehow

That's the max_execution_time value from a php.ini, check which are pulled in your webserver environment by invoking Show info under Admin -> Tools -> Maintenance (behind the PHP: ... version).

Usually database operations aren't the bottleneck but the PHP code working on a large result set is.


Running Piwigo at https://erack.net/gallery/

Offline

 

#7 2021-03-09 10:15:59

drdr66
Member
2021-03-05
4

Re: Permissions seem snarled up somehow

PHP max_execution_time was set to 30, and Apache was timing out after 15 secs. Your suggestion led to the obvious next step of checking Apache timeouts, and the master Timeout in httpd.conf was also set to 30 secs.

Grepping the whole config structure for Timeout revealed another: "ProxyTimeout" was set to 15 in site-specific config (which was an old inherited config). Changing this to 30 reveals that the "Edit" operation on the top level album takes around 16 or 17 seconds. Just long enough to trip the ProxyTimeout value and present a 504 error.

If you have an FAQ somewhere, it seems that 504 errors are most likely caused by a long piwigo PHP operation tripping this timeout value.

All good now, thanks flop25 and erAck for making helpful suggestions.

Offline

 

#8 2021-03-09 10:27:35

flop25
Piwigo Team
2006-07-06
7037

Re: Permissions seem snarled up somehow

thanks for sharing!

We note that admin.php?page=cat_list may need some optimization for big galleries on a weak server


To get a better help : Politeness like Hello-A link-Your past actions precisely described
Check my extensions : more than 30 available
who I am and what I do : http://fr.gravatar.com/flop25
My gallery : an illustration of how to integrate Piwigo in your website

Offline

 

Board footer

Powered by FluxBB

github twitter newsletter Donate Piwigo.org © 2002-2024 · Contact