Skip to content

Custom permissions do not affect book cover images #1128

Description

@Bolthier

Describe the bug
Book cover image viewable and even deletable by user without any custom permissions (view, edit or delete) for a book.

Steps To Reproduce
Steps to reproduce the behavior:

  1. Create 2 books (Book A and Book B) and 2 users (Alice and Bob)
  2. Change custom permission: Book A so only Alice can view, edit and delete Book A
  3. Give Bob permission to edit Book B (through custom or default)
  4. Upload book cover image with Alice to Book A and save
  5. Login with Bob > Edit Book B > Go to Cover Image Selection
    Result: Bob can view Alice's cover image for Book A but but not the book itself. With default permission 'delete' Bob can even delete Alice's Book cover completely.

Expected behavior
Book cover images uploaded to not viewable books shouldn't be viewable in the image assets selection for other book covers. The same behaviour as for images in hidden pages.

Your Configuration (please complete the following information):

  • Exact BookStack Version (Found in settings): BookStack v0.24.2
  • PHP Version: 7.2
  • Hosting Method (Nginx/Apache/Docker): Apache2

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions