41–50 of 75 posts
I developed this project in my spare time. It's a self-hosted photo-management-system and a great place to share, store and manage your photos and inspiration. I hope you guys here on HN like it. If you have any questions or feedback, just write it here :) Thanks!
1) Is there any kind of RAW file support? 2) Does the software de-duplicate uploaded images?
Earlier quoted context omitted.
All calls to the API are going through the api.php where every $_POST gets escaped. I'm not an expert when it comes to SQL injection, but I think this should prevent it. See line 61 in php/api.php. It would be great to know if this actually helps or not.
i haven't looked at the code, but you really should switch to prepared statements. they make your code cleaner and more secure (and maybe faster, but that's pretty negligible in this case). have a look at PDO.
Earlier quoted context omitted.
Simple solution, they provide a package that is the program and a friendly service contract which provide help setting it up or adding customization.
OK, seems everybody wants to pay per copy, am I rite? I think that is a pretty bad idea that will slow down adoption and development. Yes, this is an open-source project and more developers could help out. I think developers are less likely to jump on the wagon to help out a duo that gets all the money. Instead, don't try to monetize this now. Make adoption and interest grow. Then sell a hosted variant at lychee.io,…
> "Change the permissions of uploads/ and php/ to 777, including all subfolders" > https://github.com/electerious/Lychee/blob/master/docs/md/In... . I don't think this is ok
It looks like they intend everything to be in the webroot, which is a problem in and of itself. Setting everything in the uploads folder to be executable without any .htaccess directives to prevent that seems like a potential issue. If they're not validating images (properly) or sandboxing uploads, or thinking about mitigating directory traversal attacks, then there could be issues with remote code execution.
I like it very much; both the code and interface seem clean and lightweight. You should use mysqli prepared statements though, after a quick glance over the code I can't quite shake the feeling that there might be some sql injections lurking.
All calls to the API are going through the api.php where every $_POST gets escaped. I'm not an expert when it comes to SQL injection, but I think this should prevent it. See line 61 in php/api.php. It would be great to know if this actually helps or not.
I'm going to toy around a bit with it and if I like the API I may hack together something to automatically upload new pictures from iOS devices :)
Earlier quoted context omitted.
Simple solution, they provide a package that is the program and a friendly service contract which provide help setting it up or adding customization.
That's ok, but that's a services business. That means committing time. It's difficult to build a fly-wheel that way. I guess you could outsource on oDesk or similar.
if you buy something, people expect someone to be responsible for the product. This mean you got to spend time on providing service, or it get defined by most people as a cash grab.
I love it. I've been playing with ownCloud because I no longer want to store my pictures on Dropbox (I'm running out of space, and the first tier is 100GB which I don't need). I'm going to toy around a bit with it and if I like the API I may hack together something to automatically upload new pictures from iOS devices :)