Ok, digging further, the code block for moving the code block for displaying the form to move the photo to another album starts on line 85:
# to move a photo need write on photo and write on parent album
set move_p [expr $write_p && $album_write_p]
# build form to move the photo if move_p is 1
if $move_p {
template::form create move_photo
template::element create move_photo photo_id -label "photo ID" \
-datatype integer -widget hidden
set albums_list [db_list_of_lists get_albums { *SQL* }]
...
the $album_write_p on line 86 is not set anywhere on the page so I'm guessing the ad_require_permission's on line 54/55 should have been something like:
set album_write_p [expr ad_permission_p $photo_id write &&ad_permission_p $old_album_id write]
My tcl is way rusty - is that correct syntax above? And is ad_permission_p the accepted api for permission checking?
Later in the code (line 96), sql query named get_albums is called but is not defined in photo.xql - could it be defined elsewhere and still be read into this page?
And then there's a stray '7' on line 124...
Looks like the code was not finished for this form and it snuck in as the undefined album_write_p means the code block to set up the form is never called and the code to display the form on photo.adp is also never called.
I will try to fix it but have no idea what the sql for getting a list of album id's would be - looks like get_children from photo-album's index-postgres.xql would do the trick using the root folder id?
Am I way off base here?
