What should I know before starting a translation?

All existing complete or uncomplete translations are included in the Zenphoto release package. The language selector on the backend options indicates the status of a current translation. 

It would be good if you were quite confident in written English and quite comfortable with Zenphoto itself and with web developement in general, although no coding is required to make a translation.
 
Keep in mind that if you volunteer to make translations there will be the need of updating the languages files at least for every official release since Zenphoto is a work in progress. You may make your translation based on the current release of zenphoto.

Submitting a translation

If you made a translation file, you can of course host it as you like and offer as a download. In that case just let us know about it via the forum.

You also can submit it for inclusion into the Zenphoto package. You will need a free GitHub account and have to create a Git controlled Zenphoto installation of the GitHub development version, preferably on a local server using WAMP, LAMP or MAMP. 

If you update the languages there you can directly update them via GitHub using a pull request. See instructions here: https://help.github.com/articles/using-pull-requests

Translator entry on our site

If you prove to be a reliable and frequently committed translation contributor we also may ask you if you would like to get a translator entry on our Zenphoto team page. Generally we add anyone who is contributing significantly to the contributors page with the public info you provided via your contact anyway.

We really do appreciate the time and work – two of our core team members maintain the Dutch and German translation and know about this – that needs to be put into a frequently updated translation and would like to honor frequent contribution this way.

Development build or official release?

It is recommended to make your translation against the development build on GitHub. This way it will be ready for and matched up to the next release of Zenphoto.The work will be outdated initially since there are changes all the time otherwise.

Currently there are over 4600 strings that need to be translated so it does not really make sense to start with an older Zenphoto version. Some of these strings are only single words, some are doubled for specific reasons. Since we change strings here and there all the time we recommend doing updates frequently at least once a week, so it will be much easier to match a given release date of the next version. You simply will have less work that way than doing all at once. So better think twice before your volunteer... :-) More on that in detail later.

License of your translation

Just to note: Since a translation falls under copyright, your submitted translation should be provided under a open license compatible to Zenphoto's GPL v2 or later license. If no special license note is attached, we will assume GPL.

How does Zenphoto's translation work?

Zenphoto uses the gettext technology to provide translation and localization capability. Currently this requires native gettext support, meaning gettext needs to be installed as a binary PHP extension on your server. 

Zenphoto uses the message-level for translation. We use the standard gettext functions gettext() and ngettext() to translate strings. If you are working with Zenphoto you might have spotted strings that look like this in the code:

Singular:

Plural (actually rarely used):

If a translation is found, "some text" will be replaced by the translation string. If no...

All included official themes have been marked as deprecated since Zenphoto 1.6. A note is added on the backend. This leads to some confusion especially with new users.

These themes all are quite old and outdated and it does not make sense to update or rework them as their base is quite old. They will be removed with the next major release which is sadly still quite a while away. Untill then these themes will only get bugfixes and no actual feature updates anymore like special layouts. They will get the occasional plugin support if it is just a function to add. There will be at least one new official all-purpose theme included in the future.

There are also these third party themes with "limited support" from us. That means we roughly maintain and fix issues – primarily if made aware of theme – on these themes to keep them compatible with the latest Zenphoto release:

• https://www.zenphoto.org/theme/zpBootstrap/
• https://www.zenphoto.org/theme/zpbase/
• https://www.zenphoto.org/theme/zenji/
• https://www.zenphoto.org/theme/libratus/

We welcome bug reports and/or pull requests with fixes.

There are also some good maintained third party themes you can use

• https://www.zenphoto.org/theme/multiverse/ (the author bic is ZP team member so this is basically "half-official")
• https://www.zenphoto.org/theme/paradigm/
• https://www.zenphoto.org/theme/collections/

Tests showed a rather random behaviour regarding the position of the $ within the password. On some hosts it matters and on some it does not. Also some hosts like our own do not allow the $ sign (and even some other chars) at all.

If you encounter issues best contact your host or simply don't use the $ sign. If needed you can always try to escape characters in the config file manually. 

Here is a basic form that submits some data:

<form id="myform" action="<?php echo html_encode(getRequestURI()); ?>" method="post" accept-charset="UTF-8">
   <?php XSRFToken('myformaction'); // use a unique name of the action ?>
   <input type="text" name="mytext" value="">
   <input type="submit" value="Submit">
</form>

The line <?php XSRFToken('myformaction'); ?> prints an input field with the token. If you need the token itself, in a URL query for example, you can use $token = getXSRFToken('myformaction');.

On processing the form data you would also have to check that XSRFtoken using XSRFdefender('myformaction');

If the token does not match this will stop the process. If it succeeds you can afterwards fetch your $_POST or $_GET data.

Always sanitize the data before using it:

$mytext = sanitize($_POST['mytext'], 3);

If you know your value will be numeric you can also use:

$mytext = sanitize_numeric($_POST['mytext']);

If you need to output fetched and sanitized data always use html_encode().

This article will just focus on the ways that are available to protect your site.

Make your site non public via htaccess

This is actually the only really reliable way to cover all the different AI bots. Using the  gallery protection of Zenphoto is a way but this is not a server side level protection for folders so bots may bypass that.

But using htaccess to password protect your site is on server level. Drawback is of course that this blocks everything and everyone including search engines and visitors you actually want to visit your site.

There are lots of tools and descriptions out there to help you like: https://www.web2generators.com/apache-tools/htpasswd-generator 

[DONATE]

Block bots via htaccess

This actually works pretty well but you need to know the name of every bot you want to block. Sadly lots of new AI tools appear every day. A htaccess example for a few known bots will look like this:

RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} (CCBot|ChatGPT|GPTBot|anthropic-ai|Omgilibot|Omgili|FacebookBot) [NC]
RewriteRule ^ – [F]

You can add that to Zenphoto's htaccess. We have not included this because it is likey to frequently require changes.

Block bots via robots.txt

You can also advise bots via robots.txt just like with search engines. Here an example with some known bots:

User-agent: CCBot
Disallow: /
User-agent: ChatGPT-User
Disallow: /
User-agent: GPTBot
Disallow: /
User-agent: Google-Extended
Disallow: /
User-agent: anthropic-ai
Disallow: /
User-agent: Omgilibot
Disallow: /
User-agent: Omgili
Disallow: /
User-agent: FacebookBot
Disallow: /

We also have not included this because it is likey to frequently require updates.

This is basically a recommendation and no bot has to comply with it as the big search engines do (voluntary as well).

Spawning's ai.txt

There is also the Initiative Spawning that aims to create tools to provide a way to block or consent AI access by opting out. There you can add yourself to a registry and create a specific ai.txt which is similar to robots.txt: https://site.spawning.ai/spawning-ai-txt#ai-text-generator.

Sadly it is  more a concept of an opt-out infrastructure and so far only two AI companies seems to follow that registry. And the ai.text  is no more a secure way of protection than a robots.txt as no one needs to comply with it.

Use html meta for blocking AI

You can use something like this code via the HTML head on your site:

The html_meta_tags plugin included in Zenphoto 1.6.1 does include options for this now.

This is a recommendation and no bot has to comply with it.

Exif/IPTC: Use copyright notes

Some sites also recommend to indicate via EXIF/IPTC metadata that your images are copyrighted and AI usage is not allowed. There are plans to add an extra IPTC field specifially for AI. Note that only the Imagick library can preserve metadata in resizing and processing images!

Of course metadata will not make a bot comply but it may be useful for legal conflicts at some time.

Image modifications

Another recommendation is to use a watermark on the images itself. Of course a predominant watermark may disturb the image itself. But generally an indication of the source within a larger image size itself is not a bad idea.

There are also various research projects that "posion" images with additions that should confuse AI usages like the projects Glaze and Nightshade of the University Of Chicago.

Add legal info

It does not keep any bot from crawling but for any legal issue it might be a good idea to add a legal notice  on our legal/imprint page to prohibit usage of your content by bots. Some jurisdictions have paragraphs within their laws (e.g. the EU/German intellectual propertty rights).

Extra note: Social media

Note that if you are posting your images on social media platforms you may grant rights to use these for AI training. For example X formerly known as Twitter has this condition in its terms of...

Since Zenphoto 1.6 it is possible to set the debug modes you need directly in your zp-data/zenphoto.cfg.php file.

Any of the following debug modes may be used. The default is false for all. Add a define anywhere in your zenphoto.cfg.php file (exept where it says "Do not edit above/below this line")

• $conf['test_release'] = true; – Enables test release mode, supports the markRelease plugin. All PHP errors are written into the Debug log.
  • This enableds three debug modes: debug_error, debug_image_err and debug_404.This can be overridden by setting a mode explicitly to false.
  • test_release mode is automatically enabled if the release is a pre-release version. This can be disabled by setting $conf['test_release'] = false; (since 1.6.6)
• $conf['debug_login'] = true; – Log admin saves and login attempts.
• $conf['debug_error'] = true; – Log the calling sequence with zp_error messages.
• $conf['debug_image'] = true; – Log image processing information.
• $conf['debug_image_err'] = true; – Flag image processing errors.
• $conf['debug_404'] = true; – Log 404 error processing debug information
• $conf['debug_exif'] = true; – Log start/finish of exif processing.
• $conf['debug_plugins'] = true; – Log plugin load sequence.
• $conf['debug_filters'] = true; – Log filter application sequence.
• $conf['explain_selects'] = true; – Log the "EXPLAIN" of SELECT queries.
• $conf['debug_locale'] = true; – Used for examining language selection problems.
• $conf['debug_mail'] = true; – Used for examining language selection problems (since 1.7a)
• $conf['display_errors'] = true; – Enable displaying errors on the site itself and therefore not recommended for production sites (since 1.6.6)

These modes do not display more "error" notes. They primarily provide some more extra info within the process to hopefully help narrow down the issue you may be encountering.

Debug logs

Zenphoto has two logs enabled by default. The Debug log and Setup log. By activating the security-logger plugin you can also enable the Security log.

All log files are located in the zp-data folder, in the root of your installation. The log files are created automatically when an error or action triggers them. So when there are no PHP errors or setup is not run, these log files are not yet present. When log files are present they can be viewed on the backend under the Logs tab, which is only visible when you are logged-in with full admin rights.

• Debug log: logs all PHP errors, warnings and notices, following PHP's E_ALL reporting level. Note that very early PHP errors may occur before Zenphoto is triggered. These errors can only be viewed in the PHP error log on your server. Ask your host where to find this.
• Setup log: logs all system checks, the loading of themes, plugins and extensions.
• Security log: logs the following:
  • IP address of the client browser (the IP may be anonymized as defined on the related option)
  • type of entry/action
  • user ID/user name
  • success/failure of an action (installation, login, etc.)
  • authority granting/denying the request
  • Additional information, for instance on failure, the password used

There are options to set a max file size for the Debug and Security logs in Options -> General (debug log limit and security log limit). Additional log files will be created sequentialy when their specified size is exceeded.
There is no need to have an option for a max file size for the Setup log since this file is refreshed each...

Translations work if the mod_perl module is disabled and Zenphoto does not require Perl anyway. Should you notice this and have control over your server disable it or contact your host about it.

More info about this issue: https://www.claudiokuenzler.com/blog/1023/php-gettext-translations-not-working-apache-mod_php-cli-works

ZenphotoCMS generally works out of the box with these tools. But it is important that you configure them to use the standard web ports instead of other default ports they may have set. Here is an example from MAMP (it may be similar with the other tools):

*Since we work on Mac we use MAMP ourselves for years

That has been done on numerous sites already in the past months. You’ll find info about it on the official EU GDPR website: https://eugdpr.org/.

You will surely find numerous good articles in your own language about how to comply with your website. In any case we can’t and are not allowed, not being lawyers, to provide any legal advice how it applies to your website as every website is different anyway.  But we can tell you a bit about Zenphoto and data privacy.

Zenphoto as the CMS on your site

Some features mentioned here are only available in Zenphoto 1.5. Zenphoto does not store much personal user data by itself. Of course it does use cookies and session cookies, primarily for login status or for keeping the search context within search results. You can read more about which cookies Zenphoto may use on https://www.zenphoto.org/news/cookies/.

If you have enabled the search cache it caches search queries and their results in the database. But it does not cache any data about who performed the search.

Also a Zenphoto install does not “phone home”. There is a plugin to check for new releases and a plugin that can display the latest news from our site. But both just use the RSS feed from our site. We don’t collect any data from anyone.

Zenphoto sites in general

It is strongely recommended to setup your site with SSL which is a good idea anyway since it is becoming a SEO ranking factor now. Ask your host if your webspace supports it. Maybe it even supports the free Let’s Encrypt certificates. We also use them. More info on those on https://letsencrypt.org.

Including CSS or JS scripts from external sources can be a privacy issue since every request transfers data. This also applies to embeded webfonts. However it is not clear yet if this is really an issue. In any case you can easily host yourself if you must.
But any widget using external scripts from social media platforms like Facebook, Twitter and the likes could be privacy problematic.

You can easily check if a theme or plugin does load from exernal sources by using web inspectors all modern browser include or one of the various tracking script blocker plugins available for all browsers.

Enable the “Anyonymize IP” option on the Options > Security. The IP address is considered private information and it is strongely recommended to anonymize it (hashing may not be enough!). Some plugins may use it and also cookies may store it if you enabled the “IP tied cookies” option.

Add a privacy policy page - either statically or via the Zenpage CMS plugin in capable themes - and note detailed what data you store and process. Also define that page in the general privacy policy page option so it may appear on form plugins.

User accounts

User accounts of a Zenphoto site only store the info you can see on the user account. If you run a multi-user Zenphoto site also make sure that all users have “User” rights assigned so they can access their own acccount to change it and also export their own user data. “User” rights is the minimum rights any user should have and you should have good reasons to revoke this right.

Plugins

Especially form plugins involve user data being submitted and stored:

• comment_form: May also store the IP of a commenter
• contact_form
• register_user

If you use these you should enable the new privacy confirmation option to add a checkbox for users to agree with data storage and usages. It is also recommended to limit the required form fields to the absolute minimum needed for the purpose. For example for a contact form an e-mail address, subject and the message itself would be enough. Data economy is the key word here.

Several official plugins may be problematic as they do use external scripts and/or store IP’s in order to work:

• class-Webdocs: Uses external services to display certain file formats.
• GoogleMaps: Uses Google scripts from Google’s servers and requires registering for an API key. So it may also collect some data from visitors. The openstreetmap plugin is an alternative.
• hitcounter: Storing a list of full IP’s to ignore could be problematic but it is optional.
• Matomo (formerly Piwik): This plugin itself does not do much but Matomo as a separate statistic tool collects various data. But you can set it up to comply with privacy: ...

For all URL's to actual items (albums, image, news and pages) you should rather use Zenphoto's object model framework or the related template functions.

Available constants

ALBUMFOLDER

/albums/ – stores all albums and images. If you use a custom name it of course stores that name.

ALBUM_FOLDER_WEBPATH

http(s)://yourdomain.com/albums/ – full webpath to the /albums folder

ALBUM_FOLDER_SERVERPATH

/var/www/html/zenphoto/albums/ – The path to the albums folder but with the full server path if you installed in a subfolder "zenphoto" (exact path depends on the host)

BACKUPFOLDER

/backup/ – stores the database backup made with the backup utility

CACHEFOLDER

/cache/ – stores all the cached images

COMMON_FOLDER

/zp-core/zp-extensions/common/ – stores some files that several official plugins make use of

DATA_FOLDER

/zp-data/ – stores the configuration and log files

FULLWEBPATH

The full web path to your installation, e.g. http://www.yourdomain.com/zenphoto/ if you installed Zenphoto in a folder "zenphoto".

PLUGIN_FOLDER

/zp-core/zp-extensions/ – stores all officially included plugins

PROTOCOL

http or https – The server protocol as set on its option. If you use it you need to add ://

SERVER_HTTP_HOST

The host part of the url, e.g. http://www.yourdomain.com

SERVERPATH

The full path on your server. e.g. /var/www/html/zenphoto if you installed in a subfolder "zenphoto" (the exact path depends on the host)

STATIC_CACHE_FOLDER

/cache_html/ – stores all the cached static HTML files of your site pages if using the static_html_cache plugin and also the RSS feeds if the RSS cache is enabled.

THEMEFOLDER

/themes/ – stores all themes

UPLOAD_FOLDER

/uploaded/ – the default folder for general non gallery files

USER_PLUGIN_FOLDER

/plugins/ – stores all 3rd party plugins

UTILITES_FOLDER

/zp-core/utilities/ – stores offcially included utiltiy plugins which appear as buttons on the main overview page on the backend.

WEBPATH

stores the path to your install. If you installed in a folder called "zenphoto" resolves to zenphoto.

ZENFOLDER

/zp-core/ – The Zenphoto core folder

Usage

Note: The constants do not include the slashes.

Path to a 3rd party plugin:
FULLWEBPATH.'/'.USER_PLUGIN_FOLDER.'/yourplugin.php

Path to an included plugin:
FULLWEBPATH.'/'.ZENFOLDER.'/'.PLUGIN_FOLDER.'/officialplugin.phpIf you print out URL's using these constants, don't forget to escape them using html_encode() to be sure.