Album inherit permissions

[localdrunkposer]

Lychee version

5.1.2

Which PHP version are you using?

PHP 8.3

Detailed description of the problem

I created a main album and then a couple of sub-albums, but for some reason it cannot be viewed. Nothing shows up when I created the private link, but when logged in as the admin everything loads up fine. I tried to tweak the permissions around with the sub-albums, however it didn't make a difference. If I sent the link directly to the sub-album then it loaded fine without any issues.

Is there a reason why the sub-albums don't appear in the main album? Do the sub-album inherit the permissions from the main album?

View from admin

View from user

View from user with direct link to sub-album

Steps to reproduce the issue

1. Create an album
2. Create another album in that main album
3. Throw in some pictures
4. Adjust the permissions to the follow
   
5. Open incognito and try to access the album link
   

Diagnostics [REQUIRED]

Diagnostics
-----------
Warning: Dropbox import not working. dropbox_key is empty.
Warning: APP_URL is still set to default, this will break access to all your images
and assets if you are using Lychee behind a sub-domain.
Error: APP_URL (http://lo*****st) does not match the current url (http://192.********8:82).
This will break WebAuthn authentication.

System Information
------------------
    Lychee Version (release):                5.1.2
    DB Version:                              5.1.2
    
    composer install:                        --no-dev
    APP_ENV:                                 production
    APP_DEBUG:                               false
    APP_URL:                                 default
    APP_DIR:                                 default
    LOG_VIEWER_ENABLED:                      true
    LIVEWIRE_ENABLED:                        true
    
    System:                                  Linux
    PHP Version:                             8.3.3
    PHP User agent:                          Lychee/4 (https://lycheeorg.github.io/)
    Timezone:                                America/New_York
    Max uploaded file size:                  200M
    Max post size:                           200M
    Livewire chunk size:                     12.00 MB
    Max execution time:                      200
    MySQL Version:                           11.3.2-MariaDB-1:11.3.2+maria~ubu2204
    
    exec() Available:                        yes
    Imagick Available:                       1
    Imagick Enabled:                         1
    Imagick Version:                         1809
    GD Version:                              bundled (2.1.0 compatible)
    Number of foreign key:                   12 found.
 
Config Information
------------------
    version:                                 050102
    check_for_updates:                       0
    sorting_photos_col:                      taken_at
    sorting_photos_order:                    ASC
    sorting_albums_col:                      max_taken_at
    sorting_albums_order:                    ASC
    imagick:                                 1
    skip_duplicates:                         0
    small_max_width:                         0
    small_max_height:                        360
    medium_max_width:                        1920
    medium_max_height:                       1080
    lang:                                    en
    image_overlay_type:                      desc
    default_license:                         none
    compression_quality:                     90
    grants_full_photo_access:                1
    delete_imported:                         0
    mod_frame_enabled:                       1
    mod_frame_refresh:                       30
    thumb_2x:                                1
    small_2x:                                1
    medium_2x:                               1
    landing_page_enable:                     0
    site_owner:                              John Smith
    landing_title:                           John Smith
    landing_subtitle:                        Cats, Dogs & Humans Photography
    sm_facebook_url:                         https://www.facebook.com/JohnSmith
    sm_flickr_url:                           https://www.flickr.com/JohnSmith
    sm_twitter_url:                          https://www.twitter.com/JohnSmith
    sm_instagram_url:                        https://instagram.com/JohnSmith
    sm_youtube_url:                          https://www.youtube.com/JohnSmith
    landing_background:                      dist/cat.webp
    site_title:                              Lychee v5
    footer_show_copyright:                   1
    site_copyright_begin:                    2019
    site_copyright_end:                      2019
    footer_additional_text:                  
    footer_show_social_media:                0
    search_public:                           0
    SL_enable:                               0
    SL_for_admin:                            0
    recent_age:                              1
    grants_download:                         0
    photos_wraparound:                       1
    map_display:                             0
    zip64:                                   1
    map_display_public:                      0
    map_provider:                            Wikimedia
    force_32bit_ids:                         0
    map_include_subalbums:                   0
    update_check_every_days:                 3
    has_exiftool:                            1
    share_button_visible:                    0
    import_via_symlink:                      0
    has_ffmpeg:                              1
    location_decoding:                       0
    location_decoding_timeout:               30
    location_show:                           1
    location_show_public:                    0
    rss_enable:                              0
    rss_recent_days:                         7
    rss_max_items:                           100
    prefer_available_xmp_metadata:           0
    editor_enabled:                          1
    lossless_optimization:                   0
    swipe_tolerance_x:                       150
    swipe_tolerance_y:                       250
    local_takestamp_video_formats:           .avi|.mov
    log_max_num_line:                        1000
    unlock_password_photos_with_url_param:   0
    nsfw_visible:                            1
    nsfw_blur:                               0
    nsfw_warning:                            0
    nsfw_warning_admin:                      0
    nsfw_banner_override:                    
    map_display_direction:                   1
    album_subtitle_type:                     oldstyle
    upload_processing_limit:                 4
    new_photos_notification:                 0
    legacy_id_redirection:                   1
    zip_deflate_level:                       6
    SA_enabled:                              1
    default_album_protection:                1
    album_decoration:                        layers
    album_decoration_orientation:            row
    allow_username_change:                   1
    auto_fix_orientation:                    1
    use_job_queues:                          0
    random_album_id:                         starred
    use_last_modified_date_when_no_exif_date: 0
    ffmpeg_path:                             /usr/bin/ffmpeg
    ffprobe_path:                            /usr/bin/ffprobe
    layout:                                  justified
    date_format_photo_thumb:                 M j, Y, g:i:s A e
    date_format_photo_overlay:               M j, Y, g:i:s A e
    date_format_sidebar_uploaded:            M j, Y, g:i:s A e
    date_format_sidebar_taken_at:            M j, Y, g:i:s A e
    date_format_hero_min_max:                F Y
    date_format_hero_created_at:             M j, Y, g:i:s A T
    date_format_album_thumb:                 M Y
    upload_chunk_size:                       0
    nsfw_banner_blur_backdrop:               0
    search_pagination_limit:                 1000
    search_minimum_length_required:          4
    photo_layout_justified_row_height:       320
    photo_layout_masonry_column_width:       300
    photo_layout_grid_column_width:          250
    photo_layout_square_column_width:        200
    photo_layout_gap:                        12
    display_thumb_album_overlay:             always
    display_thumb_photo_overlay:             hover
    default_album_thumb_aspect_ratio:        1/1
    use_album_compact_header:                0
    login_button_position:                   left
    back_button_enabled:                     0
    back_button_text:                        Return to Home
    back_button_url:                         /

Browser & System [REQUIRED]

Chrome Version 122.0.6261.96 (Official Build) (64-bit)
Lychee on Unraid

Please confirm (incomplete submissions will not be addressed)

• I have provided easy and step-by-step instructions to reproduce the bug.
• I understand my bug report will be removed if I haven't met the criteria above.

[haivala]

every album has their own sharing permissions

[localdrunkposer]

Got it, but should the sub albums be hidden? If you're sending the direct link to share, I figured that would mean that anything in the album would be shown to the user (that's how it works with Google Drive). Not sure if this is a bug or the intended case.

[ildyria]

should the sub albums be hidden?

Yes.

the intended case.

Yes.

That allows better granularity. For example in my case I have:

--+ portraits (public)
  |
  +-- Client 1 (public & hidden)
  |
  +-- Client 2 (public & hidden)
  |
  +-- Friend A (public)
  |
  +-- Friend B (public)

I think however that you should go into your advanced settings and set default_album_protection to 3 instead of 1.

Default protection for newly created albums. 1 = private, 2 = public, 3 = inherit from parent

[localdrunkposer]

Thank you for the clarification! It makes sense and I got it working correctly now.