Bug: Images in auto-created OSM albums are visible to guests even though albums are marked as private

[koch2]

Plugin: piwigo-openstreetmap
Version: 1.5.d
Piwigo Version: 15.6.0
File: include/functions_map.php

---

❗ Description

When using the map interface with a bounding box query (e.g., via osmmap3.php?min_lat=...), the plugin automatically creates:

• a virtual album named "Locations",
• a subalbum like "OSM…",
• and links all visible images to the subalbum.

These albums are correctly created with status = 'private' and visible = 'false'.
However, the linked images remain visible to non-logged-in guests, especially in the “All photos” view.

This issue disappears as soon as an admin manually saves the album rights or modifies the album in the admin backend.

---

✅ Expected Behavior

Images that are only linked to private and non-visible albums should not be visible to guests.

---

🔍 Root Cause

Piwigo uses internal cache tables for permission optimization:

• user_cache
• user_cache_categories

These caches are not invalidated by the plugin after new albums and image-category links are created. As a result, outdated permission data continues to be used, and guests still see the images.

This explains why using the backend "Save permissions" button immediately fixes the visibility issue.

---

🛠️ Recommended Fix

In functions_map.php, inside the function osm_get_items(), add the following code after linking images (approx. line 203):

@include_once(PHPWG_ROOT_PATH.'include/functions_user.inc.php');
if (function_exists('invalidate_user_cache')) {
    invalidate_user_cache();
}