[layingback]

I have 2 separate sites at 9.1.2 (both upgrades) and both exhibit this same problem...

Logged in as both a user and as an admin selecting Admin > Coppermine then Albums & Go (or Photo Gallery > Create/Order My Albums) I get:

Code:

CMS Warning line 75: On /index.php?name=coppermine&file=albmgr While executing query "SELECT aid, title, pos, 
description, thumb FROM jbs_cpg_albums WHERE category = ORDER BY pos ASC" the following error occured: You have 
an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use 
near 'ORDER BY pos ASC' at line 1 In: /home/homes12/public_html/modules/coppermine/albmgr.php on line: 112

Clearly $cat is '' (empty) at this point. An echo statement at entry point of modules/coppermine/albmgnr.php shows that $cat had a 0 value on entry if I was logged in as Admin & user. So why did it become ''?

If I log in only as a user then Photo Gallery > Create/Order My Albums works fine. (But this doesn't help in creating a site album.)

Admin Album create worked fine before upgrade to 9.1.2.

Any ideas?

[hdsoltau]

hi there!
the update to 9.1.2.1 went smoothly, everything works, except i cant add cpg albums anymore? deleting and eduiting albums works fine, also i am able to add categories, but not albums, this used to work before.

if i run:

Code:

http://www.mydomain.de/index.php?name=coppermine&file=albmgr

the error is:

Code:

A database error has occurred
The webmaster has been notified of the error

i turned on debug, but there is no more info then the message above. also i do not get any further info about this error at all.

hmm..

[Gallowglas]

Same problem here on an fresh install ...

Code:

CMS Warning line 75: On /index.php?name=coppermine&file=albmgr While executing query 
"SELECT aid, title, pos, description, thumb FROM cms_cpg_albums WHERE category = ORDER BY 
pos ASC" the following error occured: You have an error in your SQL syntax. Check the manual 
that corresponds to your MySQL server version for the right syntax to use near 'ORDER BY pos ASC' 
at line 1 In: /homepages/29/d72673074/htdocs/GDI-Net/modules/coppermine/albmgr.php on line: 111

[sarah]

I've reproduced it, but haven't found the cause yet. Something is messing with $cat and it's not populated. This file has basically no changes, so I'm on a wondrous journey of coppermine mysteries.

I did kludgily make a workaround by repeating to read the GET and POST right above that query...

[layingback]

Sarah, Welcome to my problem!

Digging myself and getting confused. Extra info: on 9.1.1.1CVS Admin only login fails with same db crash, but ok if logged in as user as well. So problem occurred in 9.1.1.1 but has grown in 9.1.2.1.

Agreed albmgr.php has had little changed. But look at index.php. Mass of changes related to $cat! But it gets better...

If you call index.php?name=coppermine&file=index.php rather than albmgr.php it accesses the categories fine. Reason is there are 2 functions called get_subcat_data(), 1 in albmgr.php and 1 in index.php. And they have different parameters

So it looks to me as if Nano updated function in index.php, making albmgr.php redundant and out-dated, but missed the HTML link calls to it...

[Phoenix]

Nano is aware and as yet, can't find why it should be so - he has speculated that something else may be interfering with $cat.

[sarah]

functions.inc has a lot of changes... those new functions at the bottom.

The urls are constructed fine, even if you type in a properly constructed url you can see with debug on there is no cat in the GET. If I force that GET to be gotten again right before the query then it all works.

It should just be a matter of echoing $cat on a million different lines and see where it gets lost.

[hdsoltau]

aha, some progress here, thx folx!
well, albmgr.php cant be the problem, i tried using the previous one and problem persisted.

to me it looks there is something wrong with the mysql database tables infact of albums, but what do i know..

have there been security fixes to the cpg stuff at all? if not, i wonder if we couldnt simply use the old cpg modules, but i didnt have he guts yet to do it.

any help appreciated, i just installed dragonfly 4 weeks ago, and now this. oh well..

[sarah]

There's been major changes to coppermine in the new release, nothing good will come of mixing the files.

It's not a database error, it's this one variable. I'll find it soon

[sarah]

Hey Nano or Maze or anyone,

Is there anything wrong with adding this again around line 107 of albmgr.php?

Code:

$cat = intval(isset($_POST['cat']) ? $_POST['cat'] : (isset($_GET['cat']) ? $_GET['cat'] : 0));

It doesn't seem like the best way to do it, however, it does seem to fix it. Then again, as usual in coppermine I'm never totally sure if I broke something when fixing something else. It's like Whack-a-Mole.

None of my print_r in this file even work. I'm having a hard time finding where $cat gets lost. But it does work if I re-GET it right before the query.

[hdsoltau]

well, i (and probably many others) dont care much about new features, but about security. thats why we use cpgnuke and not phpnuke.

so please make sure the changes are secure!
thanks.

have there been security issues in he previous release of cpgnuke? i wonder if it would be beter to switch back to the previous version for the time beeing, until this release is tested?

[Phoenix]

The last release of cpgnuke was over 2 years ago. There is no cpgnuke 9.1.2.1.

Most users actually do care about new features - that's what drives progress. Security has always been the first priority of cpgnuke and DragonflyCMS development. On what basis are you raising the prospect of a security issue?

Nano has figured it out, as expected, and it has nothing to do with security and will provide the fix shortly.

[hdsoltau]

Phoenix wrote:

The last release of cpgnuke was over 2 years ago. There is no cpgnuke 9.1.2.1.

well, OK, it has been renamed to dragonfly, though.. you know what i mean.
the domain is still called cpgnuke.com, and btw, on your mainpage it tells "DragonflyCMS 9.1.2.1 Released" and the post is dated january 8th. this is a little confusing. it did also read january 8th as i downloaded the previous dragonfly release some weeks ago.

Phoenix wrote:

Most users actually do care about new features - that's what drives progress. Security has always been the first priority of cpgnuke and DragonflyCMS development. On what basis are you raising the prospect of a security issue?

well, if a developer posts he is unsure if the fix he provided is correct or not, and fears it might break something else, that does not sound very reliable. you should discuss such things internally in a developer corner, and not to the public audience.
just my 2 cents

Phoenix wrote:

Nano has figured it out, as expected, and it has nothing to do with security and will provide the fix shortly.

thanks.

[hdsoltau]

oh, just btw.. it would be nice if you put a note on the mainpage about this problem, so it avoids some headache to other users.
those who can live without new albums for a while feel free to upgrade, those who dont better wait a few days/hours - however it takes. take your time.

IMHO this is the only bug in the new release, everything else is actually working as it should

[hdsoltau]

sarah wrote:

Code:

$cat = intval(isset($_POST['cat']) ? $_POST['cat'] : (isset($_GET['cat']) ? $_GET['cat'] : 0));

just bumped that code in on a ocal test machine and it seems to work, thx sofar.
i will report back if anything breaks.