Hide image upload options in Image Manager when user lacks permission #6213

Open

ps816 wants to merge 1 commit from ps816/bookstack:fix-image-upload-permissions into development

pull from: ps816/bookstack:fix-image-upload-permissions

merge into: bookstack:development

bookstack:development

bookstack:l10n_development

bookstack:release

bookstack:v26-05-branch

bookstack:progress_indicator

bookstack:snyk-action

bookstack:ci_and_static

bookstack:mfa_key

bookstack:phpstan_june26

bookstack:llm_only

bookstack:vectors

bookstack:captcha_example

Conversation 2 Commits 1 Files changed 4 +40 -2

ps816 commented 2026-09-13 13:20:28 +02:00

First-time contributor

Copy link

Fixes #6148

Details

Hi Dan, this reported permission issue page has been fixed by removing upload button for not-authorized users and keeping a text "You do not have permission to upload new images.".

Changes:

resources/views/pages/parts/image-manager.blade.php - checks upload permission, passes it to the JS component
resources/js/components/image-manager.js - hides the upload button/hint and disables drag-and-drop when permission is missing
lang/en/components.php - added the "no permission" message text
tests/Uploads/ImageTest.php - test covering both permission states

Everything stays the same for users who do have permission.

I have tested before and after the changes using my local instance and shared screenshots for your reference. Please let me know if any corrections required.

Thanks

Regards
Samy
PS816.

Checklist

• I have read the BookStack community rules.
• This PR does not feature significant use of LLM/AI generation as per the community rules above.

Fixes #6148 ## Details Hi Dan, this reported permission issue page has been fixed by removing upload button for not-authorized users and keeping a text "You do not have permission to upload new images.". Changes: resources/views/pages/parts/image-manager.blade.php - checks upload permission, passes it to the JS component resources/js/components/image-manager.js - hides the upload button/hint and disables drag-and-drop when permission is missing lang/en/components.php - added the "no permission" message text tests/Uploads/ImageTest.php - test covering both permission states Everything stays the same for users who do have permission. I have tested before and after the changes using my local instance and shared screenshots for your reference. Please let me know if any corrections required. Thanks Regards Samy PS816. ## Checklist <!-- Put an 'x' in between the brackets below to confirm these elements --> - [x] I have read the [BookStack community rules](https://www.bookstackapp.com/about/community-rules/). - [x] This PR does not feature significant use of LLM/AI generation as per the community rules above.

before_fixing.png

39 KiB

after_fix.png

56 KiB

ps816 added 1 commit 2026-09-13 13:20:30 +02:00

Hide image upload options in Image Manager when user lacks permission ... 3b80e3fd64

Fixes #6148

danb commented 2026-09-13 14:25:36 +02:00

Owner

Copy link

Thanks for offering this @ps816, is looking good from a quick look over.

If the text/button control does not need to be dynamic (does not change via JavaScript at any point) I'd probably prefer them to simply be controlled on the PHP/blade side, which would mean there's less options/references to pass through and handle/control on the JavaScript side, and therefore have a simpler result.

Thanks for offering this @ps816, is looking good from a quick look over. If the text/button control does not need to be dynamic (does not change via JavaScript at any point) I'd probably prefer them to simply be controlled on the PHP/blade side, which would mean there's less options/references to pass through and handle/control on the JavaScript side, and therefore have a simpler result.

ps816 commented 2026-09-14 01:25:53 +02:00

Author

First-time contributor

Copy link

Thanks Dan,

Makes sense. Controlling the show/hide behaviour purely on the Blade side keeps things in one place rather than split between PHP and JS.

I will move that logic to Blade and update the PR.

Thanks Dan, Makes sense. Controlling the show/hide behaviour purely on the Blade side keeps things in one place rather than split between PHP and JS. I will move that logic to Blade and update the PR.

Some checks are pending

Hide checks

analyse-php / build (pull_request) Blocked by required conditions

Details

lint-js / build (pull_request) Blocked by required conditions

Details

lint-php / build (pull_request) Blocked by required conditions

Details

test-js / build (pull_request) Blocked by required conditions

Details

test-migrations / build (8.2) (pull_request) Blocked by required conditions

Details

test-migrations / build (8.3) (pull_request) Blocked by required conditions

Details

test-migrations / build (8.4) (pull_request) Blocked by required conditions

Details

test-migrations / build (8.5) (pull_request) Blocked by required conditions

Details

test-php / build (8.2) (pull_request) Blocked by required conditions

Details

test-php / build (8.3) (pull_request) Blocked by required conditions

Details

test-php / build (8.4) (pull_request) Blocked by required conditions

Details

test-php / build (8.5) (pull_request) Blocked by required conditions

Details

This pull request can be merged automatically.

Some workflows are waiting to be reviewed.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u fix-image-upload-permissions:ps816-fix-image-upload-permissions

git switch ps816-fix-image-upload-permissions

Merge

Merge the changes and update on Forgejo.

git switch development

git merge --no-ff ps816-fix-image-upload-permissions

git switch ps816-fix-image-upload-permissions

git rebase development

git switch development

git merge --ff-only ps816-fix-image-upload-permissions

git switch ps816-fix-image-upload-permissions

git rebase development

git switch development

git merge --no-ff ps816-fix-image-upload-permissions

git switch development

git merge --squash ps816-fix-image-upload-permissions

git switch development

git merge --ff-only ps816-fix-image-upload-permissions

git switch development

git merge ps816-fix-image-upload-permissions

git push origin development

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

Focus: A11y

Accessibility

  

Focus: Admin/Meta

  

Focus: Authentication

  

Focus: Back-End

  

Focus: Database

  

Focus: Design & UX

  

Focus: Editor - Markdown

  

Focus: Editor - WYSIWYG

  

Focus: Export System

  

Focus: Front-End

  

Focus: Translations

  

Focus: View Customization

  

Is: Docs Update

  

Is: Enhancement

  

Is: Priority

  

Is: Security

  

Is: Upstream

  

Status

Blocked

  

Status

Open to discussion

  

Status

Out of scope

  

Status

Pending Validation

  

Type

API Request

  

Type

Bug Report

  

Type

Feature Request

  

Type

Happy feedback

  

Type

Maintenance

  

Type

Question

  

Type

Support

No labels

Focus: A11y

Focus: Admin/Meta

Focus: Authentication

Focus: Back-End

Focus: Database

Focus: Design & UX

Focus: Editor - Markdown

Focus: Editor - WYSIWYG

Focus: Export System

Focus: Front-End

Focus: Translations

Focus: View Customization

Is: Docs Update

Is: Enhancement

Is: Priority

Is: Security

Is: Upstream

Status

Blocked

Status

Open to discussion

Status

Out of scope

Status

Pending Validation

Type

API Request

Type

Bug Report

Type

Feature Request

Type

Happy feedback

Type

Maintenance

Type

Question

Type

Support

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

bookstack/bookstack!6213

No description provided.