Bug: Album password entry intermittently redirects to Admin Login (triggered by cache clear or spontaneously)

[anderooo84]

Lychee version

7.5.0

Did you check the latest Lychee version?

Yes, I did

Which PHP version are you using?

PHP 8.4

Detailed description of the problem

I am reporting a critical UX bug where the authentication flow for password-protected albums breaks, redirecting public users to the admin login page instead of the album content.

The Bug:

A visitor accesses a password-protected album.

The visitor enters the correct album password.

Instead of gaining access to the photos, Lychee redirects the user to the main admin login screen (requesting a username and password).

Observations:

Triggered: This happens consistently after running php artisan optimize:clear.

Spontaneous: It also occurs intermittently during normal operation, even when no manual cache clearing has been performed.

Granular Workaround: I found that using view:clear and route:clear instead of optimize:clear prevents the issue after manual maintenance, but doesn't fix the spontaneous redirects.

Environment & Diagnostics:

Lychee Version: 7.5.0

PHP Version: 8.4.20

DB: MySQL 8.0.42

Note: cache_enabled is set to 0 in my config, yet the issue is linked to cache-clearing commands.

Steps to reproduce the issue

Scenario 1: Consistent reproduction (after maintenance)

Access a password-protected album as a guest user.

Enter the correct album password and confirm. Verify it works.

Run php artisan optimize:clear via SSH on the server.

Refresh the album page (or navigate to it again).

Enter the correct album password.

Result: The system redirects to the main admin login mask instead of showing the photos.

Scenario 2: Intermittent spontaneous behavior

Access a password-protected album as a guest user.

Enter the correct album password.

Observe that, occasionally, the system skips the album content and redirects to the admin login page, even if no cache command was run recently.

Expected behavior:
Entering the valid album password should always display the album content, regardless of any recent background cache clearing or server maintenance.

Actual behavior:
The user is redirected to the admin login page, making it impossible for the guest to access the gallery with their album password.

Diagnostics [REQUIRED]

Smart Diagnostics

Info: Hash: 2d6f437803f85b00—6ea79db3951e8441
         2728 files and 14578 vendor files
Info: Full directory permission check is disabled
Warning: zend.assertions is enabled although Lychee is not in debug mode. Outside of debugging, code generation for assertions is recommended to be disabled for efficiency reasons
Info: Latest version of PHP is 8.5
Info: Found 2 placeholder images that have not been encoded.
         You can use php artisan lychee:encode_placeholders 2 to encode them.
Info: Found 1 placeholders that could be generated.
         You can use php artisan lychee:generate_thumbs placeholder 1 to generate them.
Warning: The policy.xml file does not exist at the expected location: /etc/ImageMagick-7/policy.xml or /etc/ImageMagick-6/policy.xml.
         Make sure to have the policy.xml file in /etc/ImageMagick-6/ or /etc/ImageMagick-7/.
         Verify that the file contains the line .

System Information

Lychee Version (release):                  7.5.0
DB Version:                                7.5.0

Docker:                                    false
composer install:                          --no-dev
APP_ENV:                                   production
APP_DEBUG:                                 false
APP_URL:                                   set
APP_DIR:                                   default
LOG_VIEWER_ENABLED:                        false

System:                                    Linux
PHP Version:                               8.4.20
PHP User agent:                            Lychee/6 (https://lycheeorg.dev/)
Timezone:                                  Europe/Berlin
Max uploaded file size:                    2G
Max post size:                             2G
Chunk size:                                51.20 MB
Max execution time:                        0
MySQL Version:                             8.0.42-0ubuntu0.22.04.1

exec() Available:                          yes
Imagick Available:                         1
Imagick Enabled:                           yes
Imagick Version:                           1691
GD Version:                                bundled (2.1.0 compatible)
Number of foreign key:                     33 found.

Config Information

version:                                   070500
check_for_updates:                         0
sorting_photos_col:                        taken_at
sorting_photos_order:                      ASC
sorting_albums_col:                        max_taken_at
sorting_albums_order:                      ASC
imagick:                                   1
skip_duplicates:                           0
small_max_width:                           0
small_max_height:                          360
medium_max_width:                          1920
medium_max_height:                         1080
lang:                                      de
image_overlay_type:                        desc
default_license:                           reserved
compression_quality:                       90
grants_full_photo_access:                  1
delete_imported:                           0
mod_frame_enabled:                         1
mod_frame_refresh:                         30
thumb_2x:                                  1
small_2x:                                  1
medium_2x:                                 1
landing_page_enable:                       0
search_public:                             0
hide_version_number:                       0
recent_age:                                1
grants_download:                           1
photos_wraparound:                         1
map_display:                               0
zip64:                                     1
map_display_public:                        0
map_provider:                              Wikimedia
map_include_subalbums:                     0
update_check_every_days:                   3
has_exiftool:                              0
share_button_visible:                      1
import_via_symlink:                        0
has_ffmpeg:                                0
location_decoding:                         0
location_decoding_timeout:                 30
location_show:                             0
location_show_public:                      0
rss_enable:                                0
rss_recent_days:                           7
rss_max_items:                             100
prefer_available_xmp_metadata:             0
editor_enabled:                            1
lossless_optimization:                     0
local_takestamp_video_formats:             .avi|.mov
log_max_num_line:                          1000
unlock_password_photos_with_url_param:     0
nsfw_visible:                              1
nsfw_blur:                                 0
nsfw_warning:                              0
nsfw_warning_admin:                        0
nsfw_banner_override:
map_display_direction:                     1
album_subtitle_type:                       oldstyle
upload_processing_limit:                   4
new_photos_notification:                   0
zip_deflate_level:                         6
default_album_protection:                  public_hidden
album_decoration:                          layers
album_decoration_orientation:              row
allow_username_change:                     1
auto_fix_orientation:                      1
random_album_id:                           highlighted
use_last_modified_date_when_no_exif_date:  0
layout:                                    justified
date_format_photo_thumb:                   M j, Y, g:i:s A e
date_format_photo_overlay:                 M j, Y, g:i:s A e
date_format_sidebar_uploaded:              M j, Y, g:i:s A e
date_format_sidebar_taken_at:              M j, Y, g:i:s A e
date_format_hero_min_max:                  F Y
date_format_hero_created_at:               M j, Y, g:i:s A T
date_format_album_thumb:                   M Y
upload_chunk_size:                         0
nsfw_banner_blur_backdrop:                 0
search_pagination_limit:                   300
search_minimum_length_required:            4
photo_layout_justified_row_height:         320
photo_layout_masonry_column_width:         300
photo_layout_grid_column_width:            250
photo_layout_square_column_width:          200
photo_layout_gap:                          12
display_thumb_album_overlay:               always
display_thumb_photo_overlay:               hover
default_album_thumb_aspect_ratio:          1/1
use_album_compact_header:                  0
back_button_enabled:                       0
back_button_text:                          Return to Home
SA_random_thumbs:                          0
login_required:                            0
enable_unsorted:                           1
enable_highlighted:                        1
enable_recent:                             1
enable_on_this_day:                        1
login_required_root_only:                  0
dark_mode_enabled:                         1
low_quality_image_placeholder:             1
show_keybinding_help_popup:                1
show_keybinding_help_button:               1
disable_se_call_for_actions:               1
enable_se_preview:                         0
slideshow_timeout:                         5
keep_original_untouched:                   1
timeline_photos_enabled:                   1
timeline_photos_public:                    0
timeline_photos_granularity:               day
timeline_photos_order:                     taken_at
timeline_photos_layout:                    square
timeline_photos_pagination_limit:          200
timeline_albums_enabled:                   1
timeline_albums_public:                    0
timeline_albums_granularity:               year
timeline_left_border_enabled:              1
timeline_photo_date_format_year:           Y
timeline_photo_date_format_month:          M Y
timeline_photo_date_format_day:            j M Y
timeline_photo_date_format_hour:           g:i
timeline_album_date_format_year:           Y
timeline_album_date_format_month:          M Y
timeline_album_date_format_day:            j M
hide_nsfw_in_smart_albums:                 1
hide_nsfw_in_frame:                        1
hide_nsfw_in_map:                          1
hide_nsfw_in_search:                       1
search_photos_layout:                      square
hide_nsfw_in_rss:                          1
hide_nsfw_in_timeline:                     1
number_albums_per_row_mobile:              3
cache_enabled:                             0
cache_ttl:                                 86400
low_number_of_shoots_per_day:              10
medium_number_of_shoots_per_day:           50
high_number_of_shoots_per_day:             100
maintenance_processing_limit:              5000
disable_recursive_permission_check:        1
exif_disabled_for_all:                     0
file_name_hidden:                          0
default_old_settings:                      0
default_expert_settings:                   0
default_all_settings:                      0
client_side_favourite_enabled:             0
disable_thumb_download:                    1
disable_thumb2x_download:                  1
disable_small_download:                    0
disable_small2x_download:                  0
disable_medium_download:                   0
disable_medium2x_download:                 0
temporary_image_link_enabled:              0
temporary_image_link_when_logged_in:       0
temporary_image_link_when_admin:           0
temporary_image_link_life_in_seconds:      86400
secure_image_link_enabled:                 0
SA_override_visibility:                    0
TA_override_visibility:                    0
enable_colour_extractions:                 0
colour_extraction_driver:                  farzai
home_page_default:                         gallery
timeline_page_enabled:                     1
timeline_quick_access_date_format_year:    Y
timeline_quick_access_date_format_month:   M
timeline_quick_access_date_format_day:     j M
timeline_quick_access_date_format_hour:    h M, g:i
flow_enabled:                              1
flow_public:                               0
flow_base:
flow_max_items:                            10
flow_strategy:                             auto
flow_include_sub_albums:                   0
flow_include_photos_from_children:         0
flow_open_album_on_click:                  0
flow_display_open_album_button:            0
flow_highlight_first_picture:              1
flow_min_max_enabled:                      1
flow_display_statistics:                   1
flow_compact_mode_enabled:                 1
flow_image_header_enabled:                 1
flow_image_header_cover:                   cover
flow_image_header_height:                  24
flow_carousel_enabled:                     1
flow_carousel_height:                      6
date_format_flow_published:                M j, Y, g:i:s A e
date_format_flow_min_max:                  F Y
flow_blur_nsfw_enabled:                    1
hide_nsfw_in_flow:                         1
skip_duplicates_early:                     1
sync_delete_missing_photos:                0
sync_delete_missing_albums:                0
sync_dry_run:                              1
gallery_header_enabled:                    0
gallery_header_logged_in_enabled:          0
gallery_header:
gallery_header_bar_transparent:            1
gallery_header_bar_gradient:               1
import_via_url_forbidden_localhost:        1
import_via_url_forbidden_local_ip:         1
import_via_url_require_https:              1
import_via_url_forbidden_ports:            1
details_links_enabled:                     0
details_links_public:                      0
is_scroll_to_navigate_photos_enabled:      1
is_swipe_vertically_to_go_back_enabled:    1
photo_thumb_tags_enabled:                  0
hide_nsfw_in_tag_albums:                   1
hide_nsfw_in_tag_listing:                  1
sorting_pinned_albums_col:                 created_at
sorting_pinned_albums_order:               DESC
copyright_text:
watermark_enabled:                         0
watermark_photo_id:
watermark_public:                          1
watermark_logged_in_users_enabled:         0
renamer_enabled:                           0
renamer_enforced:                          0
renamer_enforced_before:                   0
renamer_enforced_after:                    0
renamer_photo_title_enabled:               1
renamer_album_title_enabled:               1
extract_zip_on_upload:                     1
webshop_currency:                          EUR
webshop_default_description:               No description provided.
webshop_allow_guest_checkout:              1
webshop_terms_url:
webshop_privacy_url:
webshop_default_price_cents:               0
webshop_default_license:                   personal
webshop_default_size:                      medium
enable_untagged:                           1
photos_pagination_limit:                   500
deduplicate_pinned_albums:                 0
desktop_dock_full_transparency_enabled:    0
mobile_dock_full_transparency_enabled:     0
import_via_url_block_redirect:             1
enable_smart_album_per_owner:              0
rating_enabled:                            1
rating_public:                             0
rating_show_only_when_user_rated:          0
rating_show_avg_in_details:                1
rating_photo_view_mode:                    hover
rating_show_avg_in_photo_view:             0
rating_album_view_mode:                    hover
rating_show_avg_in_album_view:             1
album_layout:                              grid
albums_per_page:                           30
albums_pagination_ui_mode:                 infinite_scroll
albums_infinite_scroll_threshold:          10
photos_per_page:                           100
photos_pagination_ui_mode:                 infinite_scroll
photos_infinite_scroll_threshold:          10
shared_albums_visibility_default:          show
enable_unrated:                            0
enable_1_star:                             0
enable_2_stars:                            0
enable_3_stars:                            0
enable_4_stars:                            1
enable_5_stars:                            1
enable_best_pictures:                      1
best_pictures_count:                       100
enable_propagate_unlock_option:            0
enable_photo_details_always_open:          0
enable_my_rated_pictures:                  1
enable_my_best_pictures:                   1
my_best_pictures_count:                    50
gps_coordinate_display:                    0
gps_coordinate_display_public:             0
photos_star_visibility:                    editor
album_enhanced_display_enabled:            0
album_header_size:                         half_screen
album_header_landing_title_enabled:        0
watermark_optout_disabled:                 0
raw_download_enabled:                      0
contact_form_enabled:                      0
contact_form_security_question:
contact_form_security_answer:
contact_form_custom_consent_required:      0
contact_form_custom_privacy_url:
contact_form_header:
contact_form_headline:
contact_form_contact_method:
contact_form_message_label:
contact_form_message_answer:
contact_form_custom_consent_text:
contact_form_custom_submit_button_text:
contact_form_thank_you_message:
landing_background_landscape_mode:         static
landing_background_portrait_mode:          static
search_colour_distance:                    30
ftp322446-2756415@sh8-39:~/www/lychee-galerie$

Browser & System [REQUIRED]

Edge, Windwos 11

Please confirm (incomplete submissions will not be addressed)

• I have provided easy and step-by-step instructions to reproduce the bug.
• I understand my bug report will be removed if I haven't met the criteria above.
• I understand that if I am requested to provide more information, I must do so within 14 days or the bug report will be closed.