Album permissions by group

The link "Album permissions by group" will let you display what albums are assigned exclusively to members of a particular group. To make this absolutely clear: this feature does not allow you to actually assign albums to groups, it just displays those assignements. To actually assign albums to particular groups, use the album properties dialog of individual albums.

Coppermine in standalone mode

The database table that Coppermine users are being stored in does not contain the actual user's password in plain text, but only an MD5-encrypted password hash. Think of such a hash as a checksum: in fact it's the result of a calculation: when the password is being entered on Coppermine's login screen into the form there, the browser sends the password the visitor has entered to the server. The server then calculates the hash that results out of the password the visitor has entered and finally compares the hash stored inside the database table against the has that was just calculated. If those hash values match, the password is considered to be correct and the user is authentificated, i.e. a cookie is being stored on the visitor's computer that basically says "the user with the user name XYZ has successfully authentificated". Again, no password is being stored anywhere.
With this being said it should be obvious that you can't look the password up anywhere, simply because it isn't actually stored anywhere.
But then, we're all human, so it might happen that you (as someone who runs a Coppermine gallery) or your users forget your password for whatever reason. That's why there is a mechanism to make sure you can log in again. Sadly, you can not just send a password reminder inside an email to the user, simply because the server is not aware of the password. That's why there is a link on Coppermine's login screen that is named "I forgot my password". If a visitor clicks on it, he/she will be sent to a password reminder screen where he/she can enter his/her email address. But wait a minute! Haven't you just said that the server doesn't know the password and therefore it can't send it by email? And yes, that's true. Actually, it's a three-step process: the visitor can enter his/her email address. If a user with that email address exists in Coppermine's user table, an email is being sent to that address that basically contains a link that the recipient of the email needs to click on to verify that he actually has forgotten his/her password and wants to request a new one. This is meant as a pre-caution against vandalism to make sure nobody get's locked out because someone else requested a new password for him. The link inside the email contains a token that can not be guessed or made up: it's unique. Only if that link is actually clicked the password reminder is triggered. The server then assigns a new random password for the account that corresponds to the email address and sends that new password in another email. With that new password inisde that second email the user can log in again.
This is a very elegant and fool-proof process once it is set up properly, but there are of course some things that can go wrong as well:

• The user needs to know the email address he used to create his user account
• The user needs to have access to the email address, i.e. he needs to remember the non-Coppermine password for the email account
• The email address that corresponds to the user account needs to be populated in the first place, which might not be the case for the admin if he failed to provide one for his own account
• The server needs to be configured properly to actually send emails
• The email sent by the server might mistakenly be blocked by third-party spam filtering mechanisms

If this is the case for you, i.e. if you have forgotten Coppermine's admin account and you can't use the "forgot password" feature for whatever reason, here are some things to do:

• If you have access to phpMyAdmin, simply set a new password for your Coppermine user account. Here are the instructions that were originally posted as a user contribution on the Coppermine support board:
  Once you are in the phpMyAdmin you will see the databases on the left. Click on the database that belongs to Coppermine. On the left you will see the tables.
  Click on the table named XXX_users, where XXX is the table prefix that you have chosen when installing Coppermine in the first place (out of the box, the prefix is cpg15x_, so the default table name should be cpg15x_users). You must click on the icon to the left of the text or you won't get the right screen.
  If you lost your admin password look under the column titled user_id. Look for the 1. That is admin account that you have created during initial install. To the left of that column is a pencil icon (that means edit). Click on it.
  You now should have fields you can write in.
  To the right of the row called user_pass is the encrypted password. Erase that and fill it with .
  That will make the password admin. Do not under any circumstances leave the password field blank. Go to the bottom of the page and just above the light bulb it should say Save. If it does click the go button. Exit out of phpMyAdmin by going to the exit icon at the upper left corner.
  Type in the URL of your Coppermine page. Login with your user name and the password admin. Once you have successfully logged in, you should of course change the password to something else instead of the phrase admin. Click on "My Profile", scroll to the bottom of the page and click on "Change my password". Enter the old password (admin) and your new password (you need to enter that twice) and submit the form. If all went well you will see a message that says so.
  You can do the same process for users: to access a user's profile, you log in as admin, go to the user control panel, edit the user account by clicking the edit icon next to the user's name and then enter a new password into the corresponding field.
  Another alternative using phpMyAdmin without changing anything around is to use a rainbow table site and search for the password that matches to the hash that you can retrieve using phpMyAdmin.
• If you don't have access to phpMyAdmin, you can do the following to create a new admin account:
  • Use your favorite plain text editor (notepad.exe is fine) to create a plain text file with this content: <?php define('IN_COPPERMINE', true); require('include/init.inc.php'); define('ADMIN_PHP', true); $sql="UPDATE `{$CONFIG['TABLE_USERS']}` SET user_name='tempadmin', user_active='YES', user_password='098f6bcd4621d373cade4e832627b4f6' WHERE user_id='1'"; cpg_db_query($sql); pageheader('Create admin user'); starttable('-1', 'Please delete this file after account creation!', 2); echo <<< EOT <tr> <td class="tableh2"> Username: </td> <td class="tableb"> tempadmin </td> </tr> <tr> <td class="tableh2"> Password: </td> <td class="tableb"> test </td> </tr> EOT; endtable(); pagefooter(); ?>
  • Name that file adminpass.php and upload it to your webserver into the Coppermine root folder
  • Run the file in your browser by entering the URL of the file you just uploaded (something like http://yourdomain.tld/your_coppermine_folder/adminpass.php) into the address bar of your browser
  • Important: delete the file adminpass.php from your server - it's a great danger to your site if you don't!
  • Log in with the new user that the script has created for you.
  • Immediately change the password of the user account once you have logged in.

Coppermine bridged

When Coppermine is bridged, the user management of the other application that it's bridged with "takes over", so if a visitor clicks on the login link within Coppermine he is being redirected to your bridging app's login screen. After a successfull login there, he/she might be sent back to your Coppermine-driven gallery (if your bridging app supports redirection after logging in). Coppermine is only "aware" that the user has been authentificated in your bridging app; Coppermine is not aware of the user's password. Subsequently, you can't use Coppermine mechanisms to retrieve lost user account passwords when you're bridged. If your bridging app provides mechanisms to recover from password-loss, then use those mechanisms.