Featured folder photos from passworded galleries not showing to visitors

dancorder · October 5, 2013

It appears that a featured photo for a folder will not appear to visitors if it is chosen from a password protected gallery that has external embedding turned off.

This comment appears to confirm that this is the current behavior: http://www.dgrin.com/showpost.php?p=1905990&postcount=20

As a concrete example go to my home page http://dancorder.smugmug.com/ and note that the Family folder has a broken image for visitors.

As the similar behavior for password protected gallery featured photos was treated as a bug (see linked thread above) I hope that this behavior is also a bug. I would rather not have to turn on external embedding to have my folder featured photos display to my visitors.

lynnor · October 13, 2013

I want to chime in as well. I, too, am experiencing this and, despite what SmugMug help claims, this is NOT how it used to work and making people go an change permissions on hundreds (or more) galleries is NOT acceptable. SmugMug Help seems to think this is acceptable (note thread: http://www.dgrin.com/showthread.php?t=237259&highlight=%22feature+photo%22+embedding) where they marked the issue as fixed despite people saying - uh, no - not good.

dancorder · October 13, 2013

Just to be clear, this thread is about featured photos on folders.

As lynnor says, the thread he/she linked to about photos on password protected galleries doesn't seem to be completely fixed - I created a separate thread about that here: http://www.dgrin.com/showthread.php?t=241555

Allen · October 13, 2013

It's been like this forever, external links or whatever it's call on NewSmug has to be on for any photo to show outside its gallery.

dancorder · October 14, 2013

Thanks for the reply. When you say "forever" do you mean on the old SmugMug too?

That may be correct as I only used categories rather than folders before (categories no longer exist though correct?), but on the old site the category link showed featured images even from password protected galleries.

Either way it would be good to know whether this will be fixed or not. I haven't seen a definitive answer one way or the other.

WinsomeWorks · October 14, 2013

dancorder wrote: »

Thanks for the reply. When you say "forever" do you mean on the old SmugMug too?

That may be correct as I only used categories rather than folders before (categories no longer exist though correct?), but on the old site the category link showed featured images even from password protected galleries.

Either way it would be good to know whether this will be fixed or not. I haven't seen a definitive answer one way or the other.

Categories are simply now called folders, so if you didn't need to have external embedding turned on before for a PW-protected gallery's photo to show up as the featured image (for a gallery OR for a folder/category), it still should work that same way now. But it seems that in New Smug, it's not working the same way. Whatever was "fixed" isn't really fixed, for anyone expecting it to work as before and expecting to not need to change settings in hundreds of galleries. And once again, there haven't been adequate responses to this from SmugMug; so far there's not much sign they're grasping the concept that this is a bug to their long-time users.

mbonocore · October 15, 2013

Hi All,

I am not able to reproduce this. My folder feature images appear, even though they are being taken from a password gallery with external links turned off. Dan did you change anything on your end?

Allen · October 15, 2013

mbonocore wrote: »

Hi All,

I am not able to reproduce this. My folder feature images appear, even though they are being taken from a password gallery with external links turned off. Dan did you change anything on your end?

Are you sure they are not drawing from your browser cache? Otherwise there's a big
security hole if photos can be shown outside a passworded gallery with external links off.

dancorder · October 15, 2013

mbonocore wrote: »

Hi All,

I am not able to reproduce this. My folder feature images appear, even though they are being taken from a password gallery with external links turned off. Dan did you change anything on your end?

I can't reproduce this any more either, I haven't made any changes, so I guess it's been fixed. Thanks for investigating.

Are you sure they are not drawing from your browser cache? Otherwise there's a big
security hole if photos can be shown outside a passworded gallery with external links off.

I tested on my wife's phone which has never visited my site let alone logged in and it showed the featured photos.

There does seem to be a bit of hole here unfortunately (investigated on my PC using Firefox private browsing window as a phone's too fiddly for doing this). The thumbnails appear to be just the "small" size photo from the gallery (rather than a specially generated thumbnail or anything else). By changing the size in the URL of the thumbnail image I can access the original size image even when not logged in. e.g. my York gallery has the thumbnail URL (which anyone can see) of:

http://dancorder.smugmug.com/Travel/York/i-VTT2CLz/0/S/DSC_6739-S.jpg

This gallery is password protected and has external embedding turned off but it looks like anyone can click the link below that I created by changing the S to L to get the large version of the image. (O for original also works)

http://dancorder.smugmug.com/Travel/York/i-VTT2CLz/0/L/DSC_6739-S.jpg

Personally I'm not very worried about this, but ideally it wouldn't be possible, and I can see that this might be a bigger deal for other people.

dancorder · October 15, 2013

Hmm, it seems that I can also see other photos from my York gallery without logging in, e.g.

http://dancorder.smugmug.com/Travel/York/i-QSR5Xr2/0/L/DSC_6471-L.jpg

I believe that these URLs aren't really guessable, so practically I don't think anyone's going to be able to see my pictures, but I wouldn't expect this to work. It also seems to make the external embedding setting redundant.

Perhaps a bug has been introduced into the permissions/password system that is making the featured photos work as a side effect? Or perhaps there's something wrong with my testing.

Featured folder photos from passworded galleries not showing to visitors

Comments