http://atutor.ca/atutor/mantis/view.php?id=4632

The fix will manually check for member_id to verify.  If no member_id, then permission denied.
I don't think this is the best way to fix it.  Please check the mantis comment for more details.

diff --git a/docs/mods/_standard/photos/addComment.php b/docs/mods/_standard/photos/addComment.php
index cc47b77..99157ad 100644 (file)
--- a/docs/mods/_standard/photos/addComment.php
+++ b/docs/mods/_standard/photos/addComment.php
@@ -16,6 +16,13 @@ define('AT_INCLUDE_PATH', '../../../include/');
 require (AT_INCLUDE_PATH.'vitals.inc.php');
 include (AT_PA_INCLUDE.'classes/PhotoAlbum.class.php');
 
+//quit if this is not a member
+if(!(isset($_SESSION['member_id']) && $_SESSION['member_id'] > 0)){
+       $msg->addError('ACCESS_DENIED');
+       header('Location: index.php');
+       exit;
+}
+
 //check what comment this is for. Album or Photo.
 $pid = intval($_POST['pid']);
 $aid = intval($_POST['aid']);

diff --git a/docs/mods/_standard/photos/create_album.php b/docs/mods/_standard/photos/create_album.php
index 1c2dc30..e5b29f0 100644 (file)
--- a/docs/mods/_standard/photos/create_album.php
+++ b/docs/mods/_standard/photos/create_album.php
@@ -17,6 +17,13 @@ require (AT_INCLUDE_PATH.'vitals.inc.php');
 include (AT_PA_INCLUDE.'classes/PhotoAlbum.class.php');
 $_custom_css = $_base_path . AT_PA_BASENAME . 'module.css'; // use a custom stylesheet
 
+//quit if this is not a member
+if(!(isset($_SESSION['member_id']) && $_SESSION['member_id'] > 0)){
+       $msg->addError('ACCESS_DENIED');
+       header('Location: index.php');
+       exit;
+}
+
 //instantiate obj
 $pa = new PhotoAlbum();
 

diff --git a/docs/mods/_standard/photos/profile_album.php b/docs/mods/_standard/photos/profile_album.php
index ae4af17..ec4eafd 100644 (file)
--- a/docs/mods/_standard/photos/profile_album.php
+++ b/docs/mods/_standard/photos/profile_album.php
@@ -14,6 +14,14 @@
 $_user_location = 'public';
 define('AT_INCLUDE_PATH', '../../../include/');
 require (AT_INCLUDE_PATH.'vitals.inc.php');
+
+//quit if this is not a member
+if(!(isset($_SESSION['member_id']) && $_SESSION['member_id'] > 0)){
+       $msg->addError('ACCESS_DENIED');
+       header('Location: index.php');
+       exit;
+}
+
 include (AT_PA_INCLUDE.'profile_album.inc.php');
 exit;
 ?>