Topic: passwords on subfolders

[freediver]

I would like to set up a subfolder so that it is hidden from the public and requires a password to view the subfolder and any files and sub folders within it. What is the easiest way to set this up? I would want to be able to stop people gaining access by typing in the URL directly, eg:

http://ozpolitic.com/album/

I also saw in the FAQ that it is possible to view a slideshow and add watermakrs. How do I do that?

[Mike Bobbitt]

Hi freediver,

You might be able to set per-sub-album passwords by using a local album.cfg, placed in that sub-album. For example, see this note on how to change the sort order per album:

http://dev.bobbitt.ca/forums/index.php/topic,380.0.html

The same idea holds for the passwords. Having said that, it may not work for all cases... you may be able to browse into the album using the droplist album selector (for example) so give it a thorough test before you trust it.

Here's a post on watermarking (using post upload processing):

http://dev.bobbitt.ca/forums/index.php/topic,566.0.html

And for slideshows, have a look at the ways you can invoke a slideshow by clicking a specific URL:

http://dev.bobbitt.ca/forums/index.php/topic,524.0.html

Once you find the one you want, you can easily add this to your template to show it on every page, if desired.


Cheers
Mike

[freediver]

Thanks. I ended up creating a new album folder elsewhere. I think that is easier. I copied and renamed the album.pl file and the configuration file and pointed the new album.pl at the new config file by changing one of the first few lines. Then I configured it as normal to point to the new directory. Have I done anything silly there?

I've got an album password on the album and another one on the folder with the images, so you have to login twice to view via the album. The album software is able to get the filenames out of the folder for some reason even if you haven't entered the .htaccess password.

How 'hackproof' is this?



I found the slideshow option in the config settings, but that makes it a slideshow by default which is a bit annoying. I'll check that link.

[freediver]

I just tried on a different PC and it didn't ask for the album password, only the .htaccess password. I checked the config file and couldn't see an obvious cause.

EDIT - I fixed this by turning off authentication (authentication_type = 0). However I would like to be able to use the album password and the authentication at the same time. Is this possible? I can't move the files around without authentication, even if I set default_admin to all.

[frister]

Instead of using passwords on sub-folders, I did it by setting membership levels for the sub-folders: owner, full member, junior member, guest
(On my site they're labeled owner, family, friend, anyone)
These choices appear whenever I create or edit any folder and photo.
If, when you are logged in as the administrator, and you try to create an album or edit descriptions, you can see the "Who can view this photo" pulldown, then you can use this approach.

[freediver]

Where are the file names stored? The htaccess security doesn't seem to stop the viewing of the file names. The actual pictures and thumbnails themselves are blocked. I thought maybe they are kept in the cgi bin directory and I should move the relevant file in with the images. Hope I'm not getting out of my depth.

[Mike Bobbitt]

Sorry, which file names do you mean? The file names for the photos? Those are just picked up each time you run album.pl... it scans the album dir to see what's there.

[freediver]

Yes I mean the photo file names. I'm trying to figure out why it shows you the file names on the thumbnails (but not the actual images) before the htaccess popup appears.

Maybe I should just move the pl file into the same folder as the photos. Is that easy to do?

[Mike Bobbitt]

The filenames are read by the script, so it bypasses the .htaccess, which is only invoked when the image itself is displayed to the user. I don't think you can use .htaccess to hide the names from a user, unfortunately.