Steps I took on Demo site: I logged in as Admin, uploaded a picture. Logged off, Logged in as Demo user, rated the picture, commented on the picture. Logged off. went to Photos, Latest, Top Rated and Most Discussed, picture appeared in all lists. Logged in to Admin, changed Privacy, Photo Albums, to Only Me, Saved. Logged off. from public view, picture now not on Latest list, but still appears on Most Discussed. Logged into Demo user, same thing, picture does not appear on Latest list, but does appear on Most Discussed.
but I can't roll this out with such a glaring hole in security. Can someone point me in the direction of where in the code the privacy is tested, so I can make a temporary Code Modification until the problem is fixed ?