Please see topic viewtopic.php?f=101&t=3893

Guests have permissions that are not granted to them, even to albums where they have no access at all.

In the table `phpbb_gallery_users` the fields 'all user_permissions' and 'user_permissions_changed' are all the same for all users. This causes a security risk as a guest can delete all pictures.

permissions_changed is just a timestamp which tells you when the permissions were modified the last time.

You're right. Do you have a solution for the permissions problem?

I can not reproduce the problem here. you might try to delete all data from phpbb_gallery_roles and phpbb_gallery_permissions, and clear all permission caches with:

Code: Select all

UPDATE phpbb_gallery_users SET user_permissions = '' AND user_permissions_changed = DATE()

Afterwards you need to create the permissions in ACP > MODs > phpBB Gallery > Permissions >
again.

Thank just, just empty those two tables?

BTW, I made a donation (few weeks back), thank you for your work!