Registered users allowed to upload Photo Gallery photos on other member profiles

We are recently having a problem similar to this post: Display problem with cb_gallery into the profile tab . In that post they were able to solve the problem but there were no specifics about how it was solved.

We have 2 different types of members, each type of member is assigned to a different usergroup and have access to different subscription plans. We also have a different Photo Gallery field for each type of member that is set to a specific asset reference for each type of member. We have essentially set these up with identical settings except for the asset and the conditional that determines which type of member that the specific Photo Gallery field is visible.

One of these works perfectly. The user is able to upload photos to their own gallery and is able to view photos in the profile gallery of other users.

The other member type, however, is able to upload photos to their own gallery but also to the gallery on other user profiles of the same member type.

We have tried every possible combination of settings under Photo Gallery plugin, settings for the specific CB field for the profile gallery but we cannot solve this issue.

Can you give us some idea where we should be looking in terms of settings for a solution? And if you need to know more about specific settings, please tell us which settings we should show you.

We did not have this problem a while ago and only noticed it recently but we cannot say for sure when it started. You did give us some advice about asset settings ( CB Gallery module suddenly stopped showing photos ). Could that possibly be connected to this issue?

For reference, the asset for the one that works correctly is "user" (no quotes) and the asset for the one that is giving problems is host.[user_id]...

That's working as expected. You're using a global gallery asset, which in your other topic as I understood is what you wanted. It won't check profile access permissions for a global gallery asset like that. As for "user" working that's because it's just being converted to "profile.[user_id]" which "user" is a shorthand for, which is a profile specific asset. You might be able to do something like the below.

profile.[user_id].host

Then in your module use.

profile.%.host

But this might just cause your original issue in your module all over again with access checks.