If the user does not have permission to view the album, photo or movie, redirect

to a logon page to allow the user to login.  Pass the target url as a session
variable to allow the user to be redirected where they want to go if the login
was successful.  Fixes ticket #1009.

1 files changed, 10 insertions, 11 deletions

diff --git a/modules/gallery/controllers/albums.php b/modules/gallery/controllers/albums.php
index a378f3ee..1d369b95 100644
--- a/modules/gallery/controllers/albums.php
+++ b/modules/gallery/controllers/albums.php
@@ -28,20 +28,19 @@ class Albums_Controller extends Items_Controller {
       // sure that we're actually receiving an object
       Kohana::show_404();
     }
-    $page_size = module::get_var("gallery", "page_size", 9);
+
     if (!access::can("view", $album)) {
-      if ($album->id == 1) {
-        $view = new Theme_View("page.html", "other", "login");
-        $view->page_title = t("Log in to Gallery");
-        $view->content = new View("login_ajax.html");
-        $view->content->form = auth::get_login_form("login/auth_html");
-        print $view;
-        return;
-      } else {
-        access::forbidden();
-      }
+      $view = new Theme_View("page.html", "other", "login");
+      $view->page_title = t("Log in to Gallery");
+      $view->content = new View("login_ajax.html");
+      $view->content->form = auth::get_login_form("login/auth_html");
+      // Avoid anti-phishing protection by passing the url as session variable.
+      Session::instance()->set("continue_url", url::current(true));
+      print $view;
+      return;
     }
 
+    $page_size = module::get_var("gallery", "page_size", 9);
     $input = Input::instance();
     $show = $input->get("show");