#29: Corrected permission check when displaying photos linked to a label. Multiple instances of a new label are no longer duplicated (separated out the creation logic into the LabelController.)

app/Http/Controllers/Admin/LabelController.php

@@ -6,6 +6,7 @@ use App\Facade\Theme;
 use App\Http\Controllers\Controller;
 use App\Http\Requests\StoreLabelRequest;
 use App\Label;
+use App\Photo;
 use Illuminate\Support\Facades\App;
 use Illuminate\Support\Facades\View;
 use Symfony\Component\HttpFoundation\Request;
@@ -18,6 +19,38 @@ class LabelController extends Controller
         View::share('is_admin', true);
     }
 
+    /**
+     * Applies a comma-separated string of label IDs and/or new label texts to a photo. This is called from the
+     * PhotoController - not directly via a route.
+     * @param Photo $photo Photo to apply the labels to
+     * @param string $labelString CSV string of label IDs and new labels to create (e.g. "1,2,Florida,nature" would
+     *                            link label IDs 1 and 2, and create 2 new labels called Florida and nature.)
+     */
+    public function applyLabelsToPhoto(Photo $photo, $labelString)
+    {
+        foreach (explode(',', $labelString) as $labelText)
+        {
+            $labelID = intval($labelText);
+            if (intval($labelID) == 0)
+            {
+                // Check if the label already exists
+                $labelToUse = Label::where('name', $labelText)->first();
+
+                if (is_null($labelToUse))
+                {
+                    // Create new label
+                    $labelToUse = new Label();
+                    $labelToUse->name = $labelText;
+                    $labelToUse->save();
+                }
+
+                $labelID = $labelToUse->id;
+            }
+
+            $photo->labels()->attach(intval($labelID));
+        }
+    }
+
     public function delete($id)
     {
         $this->authorizeAccessToAdminPanel();

app/Http/Controllers/Admin/PhotoController.php

@@ -586,26 +586,12 @@ class PhotoController extends Controller
             $photo->fill($value);
 
             // Update the photo labels
-            $labelIDs = trim($value['labels']);
+            $labelString = trim($value['labels']);
             $photo->labels()->detach();
 
-            if (strlen($labelIDs) > 0)
+            if (strlen($labelString) > 0)
             {
-                foreach (explode(',', $labelIDs) as $labelID)
-                {
-                    if (intval($labelID) == 0)
-                    {
-                        // Create new label
-                        $newLabel = new Label();
-                        $newLabel->name = $labelID;
-                        $newLabel->save();
-
-                        $newLabel->save();
-                        $labelID = $newLabel->id;
-                    }
-
-                    $photo->labels()->attach(intval($labelID));
-                }
+                app(LabelController::class)->applyLabelsToPhoto($photo, $labelString);
             }
 
             // Save all changes

app/Http/Controllers/Gallery/LabelController.php

@@ -38,7 +38,7 @@ class LabelController extends Controller
         else if ($requestedView != 'slideshow')
         {
             $photos = $label->photos()
-                ->where('album_id', $allowedAlbumIDs)
+                ->whereIn('album_id', $allowedAlbumIDs)
                 ->orderBy(DB::raw('COALESCE(photos.taken_at, photos.created_at)'))
                 ->paginate(UserConfig::get('items_per_page'));
         }
@@ -46,12 +46,12 @@ class LabelController extends Controller
         {
             // The slideshow view needs access to all photos, not paged
             $photos = $label->photos()
-                ->where('album_id', $allowedAlbumIDs)
+                ->whereIn('album_id', $allowedAlbumIDs)
                 ->orderBy(DB::raw('COALESCE(photos.taken_at, photos.created_at)'))
                 ->get();
         }
 
-        if (count($photos) == 0)
+        if ($photos->count() == 0)
         {
             $requestedView = 'empty';
         }