Restricted books visible in list view #2111

New issue

Closed

opened 2020-05-10 19:42:29 +02:00 by Usinouv · 1 comment

Usinouv commented

2020-05-10 19:42:29 +02:00

(Migrated from github.com)

Describe the bug
On the shelf view, in list view, it is possible to see all the books, including the ones you can't access.
However, the home screen displays only the good books.

Steps To Reproduce
Steps to reproduce the behavior:

Giving restricted rights to a book
Login with a user with restricted rights
Click on "Shelves" from any page or add /shelves to the site url.
Switch to list view

Expected behavior
Only authorized books should be visible whatever the view.

Your Configuration (please complete the following information):

Exact BookStack Version (Found in settings): 0.29.2
Hosting Method (Nginx/Apache/Docker): Docker - LinuxServer

**Describe the bug** On the shelf view, in list view, it is possible to see all the books, including the ones you can't access. However, the home screen displays only the good books. **Steps To Reproduce** Steps to reproduce the behavior: 1. Giving restricted rights to a book 2. Login with a user with restricted rights 3. Click on "Shelves" from any page or add /shelves to the site url. 4. Switch to list view **Expected behavior** Only authorized books should be visible whatever the view. **Your Configuration (please complete the following information):** - Exact BookStack Version (Found in settings): 0.29.2 - Hosting Method (Nginx/Apache/Docker): Docker - LinuxServer

ssddanbrown commented

2020-05-12 23:47:52 +02:00

(Migrated from github.com)

Thank you very much @Usinouv for reporting this security issue and apologies such a vulnerability existed.

I have just released v0.29.3 to cover this:
https://github.com/BookStackApp/BookStack/releases/tag/v0.29.3

And have published a security advisory here:
https://github.com/BookStackApp/BookStack/security/advisories/GHSA-c32x-84w6-5mxq

Thank you very much @Usinouv for reporting this security issue and apologies such a vulnerability existed. I have just released v0.29.3 to cover this: https://github.com/BookStackApp/BookStack/releases/tag/v0.29.3 And have published a security advisory here: https://github.com/BookStackApp/BookStack/security/advisories/GHSA-c32x-84w6-5mxq

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

bookstack/bookstack#2111

No description provided.

Rows
Columns