Every user should only upload to his own album. So I set up an album for each user and set the user permissions to "Upload" and the correspondant user-album.
But it seems that the permission to the album is ignored: the user can upload to every album (and even make new albums).
Do your users have the `MANAGE_ALL_ALBUMS` rights? This permission will allow them to upload to anyone's album. Your users should only have `UPLOAD` rights if you only want them to upload to their own album. You may also want to give them `ALBUM` rights to administrate their own album.
It may also help if you provide us with the exact permissions with which you're having problems.
Users should be able to upload to any album only if he has `ADMIN_RIGHTS`, `MANAGE_ALL_ALBUM_RIGHTS`, or if the user has all albums activated in "Managed albums". Otherwise, the user should not be able to do what you're saying. You may want to just double-check your users' permissions if you're still seeing this problem.
Are you using the 1.2.9 release if not please update. If the the problem persists then opening a ticket on the bugtracker is always a good idea. Threads easily get lost.