ISSUE SUMMARY:
If a member likes or comments on a friends Album or pictures, this information , plus a link to the photo and the actual photo itself, is displayed on the stream. All friends of that member can see the stream post AND picture, even if they aren't friends with the person whose photo is being commented on.

This issue was discussed in this support request:


The fix provided from that support request is still present in JS 4.0.9, but it no longer works (i assume due to the new code)

STEPS TO REPLICATE:
Jomsocial privacy setup:
Profile Privacy: Members
Friends privacy: Self
Photos Privacy: Friends
Video Privacy: Friends
Group List: Members

Step 1: Create 3 users (user 1, user2 and user3)
Step 2: Login as User 1 and request a connection with user2
Step 3: Create a new album and upload some pictures.
Step 4: Logout
Step 5: Login as User3 and request a connection with user2
Step 6: Logout
Step 7: Login as User2 and accept both connection requests
Step 8: On the activity wall, User2 can see the User1 "Shared photos" activity. Click on the link to go view the album
Step 9: On the Album, make the following comment: User2 has made an album comment
Step 10: Logout
Step 11: Login as user 3 and view the activity stream
There will be an activity listed with the attached picture. This will show user2 activity (User2 has made an album comment) PLUS the album details (picture, name and description of the Album.

The issue is not that user3 can view user2 comments, but rather that the Album (or photo) details are attached to the comment. This way user 3 gets to see content that the owner (user1) did not give them access to view.

Apologies.
This is an error on our side.
Seems that some of my older photos still have a permissions status of 0 instead of 30.
Comments on newer photo's work correctly.