PhotoArt

Your memories, online.

PhotoArt is a collaborative university project developed by BegoMdeMM and Jose Ángel Gumiel. It explores how to build and deploy an online photo-album application using the Model–View–Controller pattern, Visual Basic .NET, ASP.NET MVC and Microsoft Azure.

The application lets users register, sign in, create albums with different visibility levels, upload photographs and browse their collections. Beyond those features, the repository documents an early end-to-end web-development exercise: user interface, request routing, domain models, persistence, role-specific areas and cloud deployment.

• A server-rendered web application organised around ASP.NET MVC.
• Visual Basic .NET controllers, models and views.
• Database-first modelling with Entity Framework 5 and EDMX files.
• A separate class library for album, photograph, user and database logic.
• Registration, sign-in and session-based navigation.
• Member and administrator areas.
• Creation of public, limited and private album categories.
• Multipart image uploads and photograph-to-album associations.
• SQL Server/Azure SQL persistence.
• A historical deployment to Microsoft Azure.

The repository is especially useful as a record of how a complete web application was approached with the Microsoft stack of its time. It should be studied critically: some architectural ideas remain valuable, while the framework versions and several security decisions do not meet current requirements.

Do you want to see how this project looks? Visit PhotoArt!

flowchart LR
    U["Browser"]
    C["Controllers"]
    V["Views"]
    M["EF models"]
    L["Logic library"]
    D[("SQL Server / Azure SQL")]

    U --> C
    C --> M
    C --> L
    M --> D
    L --> D
    C --> V
    V --> U

For example, creating an album starts in Views/Socio/FormNuevoAlbum.aspx, is handled by SocioController, passes through Album_Logic and is finally persisted in SQL Server. The same separation is used for registration, sign-in and photograph uploads, although some responsibilities are mixed because this was an exploratory academic prototype.

1. Open the public landing page.
2. Register a new account.
3. Sign in with an email address and password.

1. Enter the member area.
2. Create an album and select an access category.
3. List personal albums.
4. Select an album and view its photograph records.
5. Upload new images to the selected album.

1. Enter the administrator area after sign-in.
2. Inspect the user-management view.

These flows describe the project's intent and existing screens. They are not a claim that the current authorization or privacy controls are secure.

PhotoArt/
├── AlbumFotos.sln
├── AlbumFotos/                     # ASP.NET MVC web application
│   ├── App_Data/                   # Legacy local database artifacts
│   ├── App_Start/                  # Routes, filters, bundles and auth setup
│   ├── Controllers/                # MVC request handlers
│   ├── Models/                     # EF Database First models and entities
│   ├── Views/                      # ASPX/VBHTML user interface
│   ├── Content/                    # Application styles
│   ├── Scripts/                    # Historical client-side dependencies
│   ├── Images/                     # Branding, sample and uploaded images
│   ├── Web.config                  # Legacy application configuration
│   └── AlbumFotos.vbproj
├── BibliotecaDeFunciones/          # Data-access and application-logic library
├── packages/                       # Versioned legacy NuGet packages
├── README.md
└── LICENSE

The solution contains two projects:

The repository has not undergone a complete penetration test, but source review already identifies multiple issues that prevent safe deployment.

The repository also contains overlapping authentication scaffolding and custom session-based code. A modernisation should choose one identity system rather than attempting to repair both approaches independently.

1. Revoke or rotate the exposed database credential.
2. Confirm that the historical Azure application and database are offline or access-restricted.
3. Audit the database files, uploaded images and Git history for personal data.
4. Do not reuse any password or secret that has appeared in this repository.
5. Add a security notice before accepting deployments or contributions.
6. Only after rotation, remove secrets from tracked files and decide whether to rewrite the Git history.

Running the original application is only recommended inside an isolated learning environment. Do not connect it to the historical cloud database, use real credentials or expose it publicly.

• Windows.
• Visual Studio 2012 or another environment capable of targeting .NET Framework 4.5 and ASP.NET MVC 4.
• IIS Express.
• NuGet package restore support for packages.config.
• A disposable SQL Server instance with a newly created, least-privileged account.

git clone https://github.com/jagumiel/PhotoArt.git
cd PhotoArt
nuget restore AlbumFotos.sln

Then:

1. Open AlbumFotos.sln in Visual Studio.
2. Replace every historical connection string with local, disposable configuration.
3. Recreate the required user, album and photograph schema.
4. Ensure the image-upload directories exist and are not executable.
5. Start the AlbumFotos project with IIS Express.

• Tag the original application as a legacy release.
• Disable or isolate any remaining public deployment.
• Rotate exposed credentials and inspect the repository for personal data.
• Add a Visual Studio .gitignore and stop tracking build outputs, restored packages, local databases and uploaded files.

• Create a new project on a supported .NET LTS release.
• Replace custom authentication with ASP.NET Core Identity.
• Define explicit roles, ownership rules and album-access policies.
• Store secrets outside source control using development secrets and a managed secret store in production.
• Add central error handling, secure headers, HTTPS enforcement and structured logging.

• Replace the EDMX models and hand-built SQL with Entity Framework Core.
• Introduce migrations and a reproducible development database.
• Use parameterised queries for any operation that cannot use the ORM.
• Model users, albums, photographs and sharing permissions explicitly.
• Add data-retention and account-deletion behaviour.

• Validate file signatures as well as extensions and MIME types.
• Apply strict file-size, pixel-dimension and resource limits.
• Generate random object names instead of trusting client filenames.
• Re-encode images and remove unnecessary metadata.
• Store files outside the application tree or in private object storage.
• Authorise each download and use time-limited URLs where appropriate.

• Add unit tests for domain and authorization rules.
• Add integration tests for registration, album ownership and uploads.
• Test CSRF protection and cross-user access.
• Enable dependency, secret and static-code scanning in CI.
• Build and test every pull request.

• Preserve the original PhotoArt identity and learning history.
• Rebuild the interface with accessible, responsive templates.
• Add thumbnail generation and pagination.
• Implement deliberate sharing rather than directory-based visibility.
• Publish a new deployment only after security review.

PhotoArt is preserved as a historical academic project. Maintenance work should focus first on containment and documentation; developing a secure PhotoArt 2 is preferable to incrementally exposing the legacy application.

Contributions that improve documentation, reproducibility or security analysis are welcome. Please do not submit real credentials, personal photographs or production datasets.

PhotoArt is a joint project by:

• BegoMdeMM
• Jose Ángel Gumiel (jagumiel)

The use of first-person plural in this documentation reflects that shared authorship.

PhotoArt es un proyecto universitario colaborativo desarrollado con Visual Basic .NET, ASP.NET MVC 4, Entity Framework 5, SQL Server y Microsoft Azure. La aplicación explora el patrón Modelo–Vista–Controlador mediante el registro de usuarios, la creación de álbumes y la subida de fotografías.

El repositorio se conserva por su valor formativo e histórico, pero el código actual no debe desplegarse en producción. Contiene credenciales antiguas, consultas SQL no parametrizadas, tratamiento inseguro de contraseñas, controles de autorización incompletos y subidas de archivos insuficientemente validadas. La prioridad es revocar los secretos expuestos y mantener cualquier ejecución en un entorno aislado.

This project is distributed under the MIT License. Copyright is shared by the two project authors.