We are using Jomsocial 3.2.1 with Joomla 3.3.1 and are in final phase to relaunching our new page
but are stucked now because of a critical issue.

In our community we have many photo albums and they are accessible for registered users only.

We want to make some advertisement for the photos and our community and have created a static page with thumbnails for all albums and placed the direct URL link to every album in the format:

domain.xx/photos/album?albumid=119&groupid=33

What we are now expecting (since this is a closed community), that when a user is clicking on the thumbnail that they will be redirected to the registration page to first create an account in order to be able to grant access to the photos.

But instead everyone can access the photo album and even more ....they can then navigate to the underlying group under which we have placed the photos as well as the member list etc. without being logged in as a user.

This is bypassing the security rules and the fact that this is internal community.

We have exactly the same setup in place on our current production environment with Joomla 2.5.22 and old Jomsocial Release 2.8.
And here it works as expected...when clicking on a direct link to a photo album as visitor on the page, the user is first being re-directed to the registration page - which is correct behaviour.

I am strongly assuming we are facing a severe security bug on JomSocial 3.2.0.7.

Interestingly this is working fine when I remove the groupid completely and just point to the photo album with
link in form:
domain.xx/photos/album?albumid=119

Then I do get correct alert that I first need to login or register - but with the complete URL it is bypassing the security rules
and this should not be the case !!!!!

Hi Markus,

I cant access your website, seems you blocked it for my country Indonesia, please you open it during I am inspecting your issue.

thank you