Lightroom for web: "Stop Sharing" doesn't work

  • 1
  • Problem
  • Updated 1 month ago
  • (Edited)
I go to my Lightroom page, select a shared Collection that I have shared, and now want to stop sharing, I click on the Share Settings icon, and get this:
But ONLY when I set it to Anyone Can View (on Invite Only you don't get Stop Sharing button, weird.) BUT, when you click Stop Sharing



And click THAT Stop Sharing button, THE COLLECTION IS STILL SHARED ONLINE! (Yeah, I emptied the cache). How do I REALLY stop sharing please?
Photo of Carlos Cardona

Carlos Cardona

  • 433 Posts
  • 92 Reply Likes

Posted 2 months ago

  • 1
Photo of Richard Coencas

Richard Coencas, Senior Quality Engineer

  • 141 Posts
  • 20 Reply Likes
Hi Carlos, 
When you stop sharing a public album (anyone can view) they switch to Invite Only. The logged in owner can always view the shares in that case. Can you try the share link in a different browser window and verify that you can still see it publicly? If you do not wish people to be able to request access and want it to be totally private, also go to the Settings section and toggle Allow Access Requests to off. 
If your issue continues, please respond back and we can look for other solutions.
Best,
Richard
Photo of Carlos Cardona

Carlos Cardona

  • 433 Posts
  • 92 Reply Likes
I tried the in in a different browser completely (Firefox), still works! Allow Access Requests was already off. Stop Sharing should erase the link completely as an option. In Lightroom, if I right-click on the Collection I can see Make Collection Public, where's Make Collection Private?
Photo of Richard Coencas

Richard Coencas, Senior Quality Engineer

  • 141 Posts
  • 20 Reply Likes
Can you share a link with me (privately) and I can have an engineer take a look as to why it is still available. If you have stopped sharing and access requests are off the correct behavior would be that a user who is not you and logged in will see a page that indicates it is private, like the screenshot.
Photo of Richard Coencas

Richard Coencas, Senior Quality Engineer

  • 141 Posts
  • 20 Reply Likes
One other thing to check, when you're in the browser is there an avatar in the upper right corner and if you click it does it say "sign out"? That would indicate that you are viewing the album as the owner and not as a visitor the page would.
Photo of Carlos Cardona

Carlos Cardona

  • 433 Posts
  • 92 Reply Likes
Richard you are correct! The avatar does say "Sign Out", and when I did, I got "the album is private" icon.
Photo of Carlos Cardona

Carlos Cardona

  • 433 Posts
  • 92 Reply Likes
How do I send you the link privately?
Photo of Carlos Cardona

Carlos Cardona

  • 433 Posts
  • 92 Reply Likes
Nonetheless when you Stop Sharing, the link should disappear altogether, and the collection should say Private.
Photo of Richard Coencas

Richard Coencas, Senior Quality Engineer

  • 141 Posts
  • 20 Reply Likes
  Just click on my name and you should be able to see my email address. We don't destroy links, so you have the option to reshare without losing your previous invites.
Photo of Richard Coencas

Richard Coencas, Senior Quality Engineer

  • 141 Posts
  • 20 Reply Likes
Glad you can see the private view now. Let us know if you have any more questions.
Photo of Carlos Cardona

Carlos Cardona

  • 433 Posts
  • 92 Reply Likes
Uh, the problem isn't solved. I CAN logout and then can't access the photos, but the Collection is still Shared, not Private, and I don't see a way to make it Private, short of deleting the collection (which I don't want to do). Also: clicking on your name does not show your email, so I can send you the link (so your engineers can see for themselves).
Photo of Carlos Cardona

Carlos Cardona

  • 433 Posts
  • 92 Reply Likes
PS-this is still a serious security issue, people can still see the page, even if not the photos.
Photo of Victoria Bampton - Lightroom Queen

Victoria Bampton - Lightroom Queen, Champion

  • 4973 Posts
  • 1934 Reply Likes
Am I missing something here Carlos? If people can't see the photos, where are you seeing the security risk? 
Photo of Carlos Cardona

Carlos Cardona

  • 433 Posts
  • 92 Reply Likes
Yesterday I was still seeing the name of the collection, with the "please sign in to see the photos" image. Today, I can see the photos, even though I'm NOT signed in, check out the screenshot, notice that it says "Sign In", not "Sign Out".

And you can still see the photos (I tried it on a different browser, Chrome, just in case there was a cookie keeping me signed in.) No difference, you can see the photos, check it out for yourself: https://adobe.ly/2TBSUpd
Photo of Richard Coencas

Richard Coencas, Senior Quality Engineer

  • 141 Posts
  • 20 Reply Likes
Hi Carlos, that link shows private for me. I'm going to ask an engineer to chime in. 
Photo of Carlos Cardona

Carlos Cardona

  • 433 Posts
  • 92 Reply Likes
OK, NOW it says "you must sign in to view this album" again (in a different browser, and it doesn't say the name of the client, so I guess it's not a security risk). Weird how it changes back and forth?
(Edited)
Photo of Alex Dixon

Alex Dixon, Company Admin

  • 72 Posts
  • 41 Reply Likes
Thanks for the screenshot Carlos, and thanks much for reporting this. It does look like we have a bug here -- we should be reloading the page since you're signed out. I think what happened is that there were valid credentials cached when the page was loaded, and we haven't updated our logic for private shares (when all shares were "anyone can view" this was less of an issue).
I do want to double-check on a couple of things you mentioned though (and be sure I'm not missing something more serious). Can you answer these questions for me:

  1. How are you logging out?
  2. You mentioned trying a different browser. Is it possible you'd been logged in to Lightroom Web recently on that browser?
  3. If you log in on one of those 2 browsers, does it look like you're logged in on the other automatically? (this would actually be a little surprising to me, but I want to rule it out)
Thanks again, and apologies for the confusion/bug!
(Edited)
Photo of Alex Dixon

Alex Dixon, Company Admin

  • 72 Posts
  • 41 Reply Likes
Also, just to be sure, did you end up clicking the "Make collection public" button in Lightroom Classic? That could explain or be related to what you were seeing (particularly if there was a delay in syncing or making another change to make it private again).
Photo of Carlos Cardona

Carlos Cardona

  • 433 Posts
  • 92 Reply Likes
1. I clicked Sign Out in the browser window that showed me the shared collection.

2. No, I never opened that link before my test (or any other LR link) in Chrome OR Firefox.

3. No, I'm logged into Safari, but when I copy the URL to Chrome it says "you need to log in..." and "Sign In" shows in the upper right.

4. No, I made it public (shared) by going to my Lightroom.adobe.com page and clicking Share there (which is how I've always done it). I noticed you changed the design of the share sheet, moved it to the right, etc., that's probably when the bug started. It worked fine before, when I stopped sharing the link disappeared, now it persists (it should go back to "This album is private", like all of the other private albums.

Also noticed: in the left pane album list, that JS Interiors album doesn't say "Shared" under the name, like my other Shared albums do.
(Edited)
Photo of Alex Dixon

Alex Dixon, Company Admin

  • 72 Posts
  • 41 Reply Likes
That additional info was really useful -- thanks! We've done some additional investigations, and I have some suspicious about what happened, and have ruled out some things I was hoping to rule out.
One last thing I'd like to confirm is that at some point the share was set to the "Anyone can View" permission. If this album was shared prior to the UI changes, that would definitely be true.
My theory right now is that there was a delay between when we updated the UI and actually made the change. One thing we do in Lightroom Web (and in general in our Lightroom apps), is try to update the UI immediately upon changes, even if there are server calls needed. It looks like this could affect the public/private status of the share. My best guess is that there was an unusually long delay in updating the share status to the server. I don't have a good handle on why that might have happened though, which is vexing. Regardless, if this is what happened, we should re-work our UI to make it clear when the album is *really* unshared.
Also, I'd like to elaborate on a few of the UI changes we made with the addition of private sharing.
  • Prior to our update, if you unshared an album, we'd internally mark it to private (so that you wouldn't lose the link). So there hasn't been any change to how the link persists -- the addition of private sharing.
  • Because we now have private sharing, we've modified our 404 page to ask the user to log in. Our UI default to a "Something might be here" state, even though there's no difference in the response for a share marked private, and a link to something that doesn't exist at all. So while it looks like we're advertising that something is there, there really shouldn't be any difference here.
If you do see something like this again though, please let us know. Assuming my theory is correct, the longer delay in updating is concerning.
Thanks,Alex