Describe the bug
Book cover image viewable and even deletable by user without any custom permissions (view, edit or delete) for a book.
Steps To Reproduce
Steps to reproduce the behavior:
- Create 2 books (Book A and Book B) and 2 users (Alice and Bob)
- Change custom permission: Book A so only Alice can view, edit and delete Book A
- Give Bob permission to edit Book B (through custom or default)
- Upload book cover image with Alice to Book A and save
- Login with Bob > Edit Book B > Go to Cover Image Selection
Result: Bob can view Alice's cover image for Book A but but not the book itself. With default permission 'delete' Bob can even delete Alice's Book cover completely.
Expected behavior
Book cover images uploaded to not viewable books shouldn't be viewable in the image assets selection for other book covers. The same behaviour as for images in hidden pages.
Your Configuration (please complete the following information):
- Exact BookStack Version (Found in settings): BookStack v0.24.2
- PHP Version: 7.2
- Hosting Method (Nginx/Apache/Docker): Apache2
Describe the bug
Book cover image viewable and even deletable by user without any custom permissions (view, edit or delete) for a book.
Steps To Reproduce
Steps to reproduce the behavior:
Result: Bob can view Alice's cover image for Book A but but not the book itself. With default permission 'delete' Bob can even delete Alice's Book cover completely.
Expected behavior
Book cover images uploaded to not viewable books shouldn't be viewable in the image assets selection for other book covers. The same behaviour as for images in hidden pages.
Your Configuration (please complete the following information):