Fix: New revision is created but no changes were made #6062

.env.example.complete

@@ -395,19 +395,6 @@ ALLOWED_IFRAME_HOSTS=null
 # Current host and source for the "DRAWIO" setting will be auto-appended to the sources configured.
 ALLOWED_IFRAME_SOURCES="https://*.draw.io https://*.youtube.com https://*.youtube-nocookie.com https://*.vimeo.com"
 
-# A list of sources/hostnames that can be loaded as CSS styles within BookStack.
-# Space separated if multiple. BookStack host domain is auto-inferred.
-# Defaults to a permissive set if not provided.
-# Example: ALLOWED_STYLE_SOURCES="https://fonts.googleapis.com"
-ALLOWED_STYLE_SOURCES=null
-
-# A list of sources/hostnames that can be loaded as image content within BookStack.
-# Space separated if multiple. BookStack host domain is auto-inferred, in addition to
-# data and blob images, due to their use for various functionality.
-# Defaults to a permissive set if not provided.
-# Example: ALLOWED_IMAGE_SOURCES="https://images.example.com"
-ALLOWED_IMAGE_SOURCES=null
-
 # A list of the sources/hostnames that can be reached by application SSR calls.
 # This is used wherever users can provide URLs/hosts in-platform, like for webhooks.
 # Host-specific functionality (usually controlled via other options) like auth

.forgejo/CODE_OF_CONDUCT.md

@@ -1,2 +0,0 @@
-Please find our community rules on our website here:
-https://www.bookstackapp.com/about/community-rules/

.forgejo/FUNDING.yml

@@ -1,4 +0,0 @@
-# These are supported funding model platforms
-
-github: [ssddanbrown]
-ko_fi: ssddanbrown

.forgejo/ISSUE_TEMPLATE/config.yml

@@ -1,13 +0,0 @@
-blank_issues_enabled: false
-contact_links:
-  - name: Community Forum Support
-    url: https://community.bookstackapp.com
-    about: Get support by talking with the BookStack team & community.
-
-  - name: Debugging & Common Issues
-    url: https://www.bookstackapp.com/docs/admin/debugging/
-    about: Find details on how to debug issues and view common issues with their resolutions.
-
-  - name: Official Support Plans
-    url: https://www.bookstackapp.com/support/
-    about: View our official support plans that offer assured support for business.

.forgejo/pull_request_template.md

@@ -1,11 +0,0 @@
-## Details
-
-<!-- Write details of your pull request in here -->
-<!-- Include references to any relevant issues/discussions -->
-
-## Checklist
-
-<!-- Put an 'x' in between the brackets below to confirm these elements -->
-
-- [ ] I have read the [BookStack community rules](https://www.bookstackapp.com/about/community-rules/).
-- [ ] This PR does not feature significant use of LLM/AI generation as per the community rules above.

.forgejo/workflows/sync-translations.yml

@@ -1,34 +0,0 @@
-name: Crowdin Action
-
-on:
-  push:
-    branches: [ development ]
-    paths:
-      - 'lang/**.php'
-  schedule:
-    - cron: '30 4 * * *'
-  workflow_dispatch:
-
-jobs:
-  synchronize-with-crowdin:
-    runs-on: docker
-    container:
-      image: docker.io/library/node:24-trixie
-
-    steps:
-      - name: Checkout
-        uses: https://code.forgejo.org/actions/checkout@v6
-
-      - name: crowdin action
-        uses: https://github.com/crowdin/github-action@v2
-        with:
-          crowdin_branch_name: development
-          upload_sources: true
-          upload_translations: false
-          download_translations: true
-          localization_branch_name: l10n_development
-          create_pull_request: false
-          github_base_url: codeberg.org
-        env:
-          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
-          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}

.github/CODE_OF_CONDUCT.md

@@ -1,2 +1,84 @@
-Please find our community rules on our website here:
-https://www.bookstackapp.com/about/community-rules/
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to making participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, gender identity and expression, level of experience,
+education, socio-economic status, nationality, personal appearance, race,
+religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or
+  advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic
+  address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+### Project Maintainer Standards
+
+Project maintainers should generally follow these additional standards:
+
+* Avoid using a negative or harsh tone in communication, Even if the other party
+is being negative themselves.
+* When providing criticism, try to make it constructive to lead the other person
+down the correct path.
+* Keep the [project definition](https://github.com/BookStackApp/BookStack#project-definition)
+in mind when deciding what's in scope of the Project.
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior. In addition, Project
+maintainers are responsible for following the standards themselves.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community. Examples of
+representing a project or community include using an official project e-mail
+address, posting via an official social media account, or acting as an appointed
+representative at an online or offline event. Representation of a project may be
+further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team at the email address shown on [the profile here](https://github.com/ssddanbrown). All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
+
+[homepage]: https://www.contributor-covenant.org

.github/ISSUE_TEMPLATE/api_request.yml

@@ -1,6 +1,6 @@
 name: New API Endpoint or API Ability
 description: Request a new endpoint or API feature be added
-labels: ["Type/API Request"]
+labels: [":nut_and_bolt: API Request"]
 body:
   - type: textarea
     id: feature

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,6 +1,6 @@
 name: Bug Report
 description: Create a report to help us fix bugs & issues in existing supported functionality
-labels: ["Type/Bug Report"]
+labels: [":bug: Bug"]
 body:
   - type: markdown
     attributes:

.github/ISSUE_TEMPLATE/config.yml

@@ -1,8 +1,8 @@
 blank_issues_enabled: false
 contact_links:
-  - name: Open Issues Here Instead
-    url: https://codeberg.org/bookstack/bookstack/issues
-    about: This project has migrated to Codeberg, please open issues there instead.
+  - name: Discord Chat Support
+    url: https://discord.gg/ztkBqR2
+    about: Realtime support & chat with the BookStack community and the team.
 
   - name: Debugging & Common Issues
     url: https://www.bookstackapp.com/docs/admin/debugging/

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,6 +1,6 @@
 name: Feature Request
 description: Request a new feature or idea to be added to BookStack
-labels: ["Type/Feature Request"]
+labels: [":hammer: Feature Request"]
 body:
   - type: textarea
     id: description
@@ -33,7 +33,7 @@ body:
     attributes:
       label: Have you searched for an existing open/closed issue?
       description: |
-        To help us keep these issues under control, please ensure you have first [searched our issue list](https://codeberg.org/bookstack/bookstack/issues) for any existing issues that cover the fundamental benefit/goal of your request.
+        To help us keep these issues under control, please ensure you have first [searched our issue list](https://github.com/BookStackApp/BookStack/issues?q=is%3Aissue) for any existing issues that cover the fundamental benefit/goal of your request.
       options:
         - label: I have searched for existing issues and none cover my fundamental request
           required: true
@@ -56,13 +56,3 @@ body:
       description: Add any other context or screenshots about the feature request here.
     validations:
       required: false
-  - type: checkboxes
-    id: ai-thoughts
-    attributes:
-      label: Have you used generative AI/LLMs to create any thoughts in this request?
-      description: |
-        We ask that no machine generated thoughts or ideas are provided, to avoid us spending time considering the ideas
-        of a machine instead of a human. Further guidance on this can be found [in the BookStack community rules](https://www.bookstackapp.com/about/community-rules/#use-of-llmsai).
-      options:
-        - label: This request only contains the thoughts & ideas of a human
-          required: true

.github/ISSUE_TEMPLATE/language_request.yml

@@ -1,6 +1,6 @@
 name: Language Request
 description: Request a new language to be added to Crowdin for you to translate
-labels: ["Focus: Translations"]
+labels: [":earth_africa: Translations"]
 assignees:
   - ssddanbrown
 body:

.github/ISSUE_TEMPLATE/support_request.yml

@@ -1,6 +1,6 @@
 name: Support Request
 description: Request support for a specific problem you have not been able to solve yourself
-labels: ["Type/Support"]
+labels: [":dog2: Support"]
 body:
   - type: checkboxes
     id: useddocs
@@ -15,11 +15,11 @@ body:
   - type: checkboxes
     id: searchissue
     attributes:
-      label: Searched Existing Issues
+      label: Searched GitHub Issues
       description: |
-        I have searched for the issue and potential resolutions within the [project's issue list](https://codeberg.org/bookstack/bookstack/issues)
+        I have searched for the issue and potential resolutions within the [project's GitHub issue list](https://github.com/BookStackApp/BookStack/issues)
       options:
-        - label: I have searched for the issue.
+        - label: I have searched GitHub for the issue.
           required: true
   - type: textarea
     id: scenario

.github/SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Supported Versions
 
-Only the [latest version](https://codeberg.org/bookstack/bookstack/releases) of BookStack is supported.
+Only the [latest version](https://github.com/BookStackApp/BookStack/releases) of BookStack is supported.
 We generally don't support older versions of BookStack due to maintenance effort and
 since we aim to provide a fairly stable upgrade path for new versions.
 
@@ -12,14 +12,16 @@ If you'd like to be notified of new potential security concerns you can [sign-up
 
 ## Reporting a Vulnerability
 
-If you've found an issue that likely has no impact to existing users (For example, an issue only in the development branch)
-feel free to raise it via a standard Codeberg bug report issue.
+If you've found an issue that likely has no impact to existing users (For example, in a development-only branch)
+feel free to raise it via a standard GitHub bug report issue.
 
 If the issue could have a security impact to BookStack instances, 
-please directly contact the lead maintainer via email Dan Brown using the [details found here](https://www.bookstackapp.com/links/contact/).
+please directly contact the lead maintainer [@ssddanbrown](https://github.com/ssddanbrown). 
+You will need to log in to be able to see the email address on the [GitHub profile page](https://github.com/ssddanbrown).
+Alternatively you can send a DM via Mastodon to [@danb@fosstodon.org](https://fosstodon.org/@danb).
 
 Please be patient while the vulnerability is being reviewed. Deploying the fix to address the vulnerability
 can often take a little time due to the amount of preparation required, to ensure the vulnerability has
 been covered, and to create the content required to adequately notify the user-base.
 
-Thank you for keeping BookStack instances safe!
+Thank you for keeping BookStack instances safe!

.github/pull_request_template.md

@@ -1,10 +0,0 @@
-**Warning:**
-
-This project has migrated to Codeberg:
-https://codeberg.org/bookstack/bookstack
-
-Please open pull requests here instead.
-
-ANY PULL REQUESTS OPENED HERE WILL BE CLOSED WITHOUT COMMENT OR MERGE.
-
----

.github/translators.txt

@@ -444,7 +444,7 @@ Irjan Olsen (Irch) :: Norwegian Bokmal
 Aleksandar Jovanovic (jovanoviczaleksandar) :: Serbian (Cyrillic)
 Red (RedVortex) :: Hebrew
 xgrug :: Chinese Simplified
-Calle Calmar (HrCalmar) :: Danish
+HrCalmar :: Danish
 Avishay Rapp (AvishayRapp) :: Hebrew
 matthias4217 :: French
 Berke BOYLU2 (berkeboylu2) :: Turkish
@@ -533,16 +533,3 @@ JanDziaslo :: Polish
 Charllys Fernandes (CharllysFernandes) :: Portuguese, Brazilian
 Ilgiz Zigangirov (inov8) :: Russian
 Max Israelsson (Blezie) :: Swedish
-Skiddybison5924 (chris-devel0per) :: German Informal; German
-Veyilla Nightwhisper (Veyilla) :: German
-João Barbosa (hypeedd) :: Portuguese
-Abcdefg Hijklmn (collatek) :: Korean
-Suthep Yonphimai (tomztt) :: Thai
-MrClock (MrClock8163) :: Hungarian
-Elena0875 :: Russian
-FelixFrizzy :: German
-Pedro de Mattia (pdmtt) :: Portuguese, Brazilian
-lonestan :: Russian
-Paul Kernstock (kernstock) :: German
-brtbr :: German; German Informal
-Ricardo Covelo (covelo12) :: Portuguese

.github/workflows/analyse-php.yml

@@ -1,7 +1,6 @@
 name: analyse-php
 
 on:
-  workflow_dispatch:
   push:
     paths:
       - '**.php'
@@ -12,17 +11,15 @@ on:
 jobs:
   build:
     if: ${{ github.ref != 'refs/heads/l10n_development' }}
-    runs-on: docker
-    container:
-      image: docker.io/library/node:24-trixie
+    runs-on: ubuntu-24.04
     steps:
-    - uses: https://code.forgejo.org/actions/checkout@v6
+    - uses: actions/checkout@v4
 
     - name: Setup PHP
-      uses: https://github.com/shivammathur/setup-php@v2
+      uses: shivammathur/setup-php@v2
       with:
-        php-version: 8.5
-        extensions: gd, mbstring, json, curl, xml, dom, mysql, ldap
+        php-version: 8.3
+        extensions: gd, mbstring, json, curl, xml, mysql, ldap
 
     - name: Get Composer Cache Directory
       id: composer-cache
@@ -30,16 +27,14 @@ jobs:
         echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
 
     - name: Cache composer packages
-      uses: https://code.forgejo.org/actions/cache@v5
+      uses: actions/cache@v4
       with:
         path: ${{ steps.composer-cache.outputs.dir }}
-        key: ${{ runner.os }}-composer-8.5
+        key: ${{ runner.os }}-composer-8.3
         restore-keys: ${{ runner.os }}-composer-
 
     - name: Install composer dependencies
       run: composer install --prefer-dist --no-interaction --ansi
-      env:
-        COMPOSER_AUTH: '{"github-oauth": {"github.com": "${{ secrets.GH_TOKEN }}"}}'
 
     - name: Run static analysis check
       run: composer check-static

.github/workflows/lint-js.yml

@@ -1,7 +1,6 @@
 name: lint-js
 
 on:
-  workflow_dispatch:
   push:
     paths:
       - '**.js'
@@ -14,11 +13,9 @@ on:
 jobs:
   build:
     if: ${{ github.ref != 'refs/heads/l10n_development' }}
-    runs-on: docker
-    container:
-      image: docker.io/library/node:24-trixie
+    runs-on: ubuntu-24.04
     steps:
-    - uses: https://code.forgejo.org/actions/checkout@v6
+    - uses: actions/checkout@v4
 
     - name: Install NPM deps
       run: npm ci

.github/workflows/lint-php.yml

@@ -1,7 +1,6 @@
 name: lint-php
 
 on:
-  workflow_dispatch:
   push:
     paths:
       - '**.php'
@@ -12,16 +11,14 @@ on:
 jobs:
   build:
     if: ${{ github.ref != 'refs/heads/l10n_development' }}
-    runs-on: docker
-    container:
-      image: docker.io/library/node:24-trixie
+    runs-on: ubuntu-24.04
     steps:
-    - uses: https://code.forgejo.org/actions/checkout@v6
+    - uses: actions/checkout@v4
 
     - name: Setup PHP
-      uses: https://github.com/shivammathur/setup-php@v2
+      uses: shivammathur/setup-php@v2
       with:
-        php-version: 8.5
+        php-version: 8.3
         tools: phpcs
 
     - name: Run formatting check

.github/workflows/test-js.yml

@@ -1,7 +1,6 @@
 name: test-js
 
 on:
-  workflow_dispatch:
   push:
     paths:
       - '**.js'
@@ -16,11 +15,9 @@ on:
 jobs:
   build:
     if: ${{ github.ref != 'refs/heads/l10n_development' }}
-    runs-on: docker
-    container:
-      image: docker.io/library/node:24-trixie
+    runs-on: ubuntu-24.04
     steps:
-    - uses: https://code.forgejo.org/actions/checkout@v6
+    - uses: actions/checkout@v4
 
     - name: Install NPM deps
       run: npm ci
@@ -29,4 +26,4 @@ jobs:
       run: npm run ts:lint
 
     - name: Run JavaScript tests
-      run: npm run test:ci
+      run: npm run test

.github/workflows/test-migrations.yml

@@ -1,7 +1,6 @@
 name: test-migrations
 
 on:
-  workflow_dispatch:
   push:
     paths:
       - '**.php'
@@ -14,36 +13,18 @@ on:
 jobs:
   build:
     if: ${{ github.ref != 'refs/heads/l10n_development' }}
-    runs-on: docker
-    container:
-      image: docker.io/library/node:24-trixie
+    runs-on: ubuntu-24.04
     strategy:
       matrix:
         php: ['8.2', '8.3', '8.4', '8.5']
-    services:
-      mysql:
-        image: docker.io/library/mariadb:12.2.2-noble
-        options: --tmpfs /var/lib/mysql:rw
-        cmd:
-          - --innodb-flush-log-at-trx-commit=0
-          - --innodb-flush-method=O_DIRECT
-          - --innodb-doublewrite=0
-          - --innodb-buffer-pool-size=256M
-          - --skip-log-bin
-          - --sync-binlog=0
-        env:
-          MARIADB_USER: bookstack-test
-          MARIADB_PASSWORD: bookstack-test
-          MARIADB_DATABASE: bookstack-test
-          MARIADB_ROOT_PASSWORD: password
     steps:
-      - uses: https://code.forgejo.org/actions/checkout@v6
+      - uses: actions/checkout@v4
 
       - name: Setup PHP
-        uses: https://github.com/shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@v2
         with:
           php-version: ${{ matrix.php }}
-          extensions: gd, mbstring, json, curl, xml, dom, mysql, ldap
+          extensions: gd, mbstring, json, curl, xml, mysql, ldap
 
       - name: Get Composer Cache Directory
         id: composer-cache
@@ -51,31 +32,34 @@ jobs:
           echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
 
       - name: Cache composer packages
-        uses: https://code.forgejo.org/actions/cache@v5
+        uses: actions/cache@v4
         with:
           path: ${{ steps.composer-cache.outputs.dir }}
           key: ${{ runner.os }}-composer-${{ matrix.php }}
           restore-keys: ${{ runner.os }}-composer-
 
+      - name: Start MySQL
+        run: |
+          sudo systemctl start mysql
+
+      - name: Create database & user
+        run: |
+          mysql -uroot -proot -e 'CREATE DATABASE IF NOT EXISTS `bookstack-test`;'
+          mysql -uroot -proot -e "CREATE USER 'bookstack-test'@'localhost' IDENTIFIED WITH mysql_native_password BY 'bookstack-test';"
+          mysql -uroot -proot -e "GRANT ALL ON \`bookstack-test\`.* TO 'bookstack-test'@'localhost';"
+          mysql -uroot -proot -e 'FLUSH PRIVILEGES;'
+
       - name: Install composer dependencies
         run: composer install --prefer-dist --no-interaction --ansi
-        env:
-          COMPOSER_AUTH: '{"github-oauth": {"github.com": "${{ secrets.GH_TOKEN }}"}}'
 
       - name: Start migration test
-        env:
-          TEST_DATABASE_URL: 'mysql://bookstack-test:bookstack-test@mysql/bookstack-test'
         run: |
           php${{ matrix.php }} artisan migrate --force -n --database=mysql_testing
 
       - name: Start migration:rollback test
-        env:
-          TEST_DATABASE_URL: 'mysql://bookstack-test:bookstack-test@mysql/bookstack-test'
         run: |
           php${{ matrix.php }} artisan migrate:rollback --force -n --database=mysql_testing
 
       - name: Start migration rerun test
-        env:
-          TEST_DATABASE_URL: 'mysql://bookstack-test:bookstack-test@mysql/bookstack-test'
         run: |
           php${{ matrix.php }} artisan migrate --force -n --database=mysql_testing

.github/workflows/test-php.yml

@@ -1,7 +1,6 @@
 name: test-php
 
 on:
-  workflow_dispatch:
   push:
     paths:
       - '**.php'
@@ -14,38 +13,18 @@ on:
 jobs:
   build:
     if: ${{ github.ref != 'refs/heads/l10n_development' }}
-    runs-on: docker
-    container:
-      image: docker.io/setupphp/node:noble
+    runs-on: ubuntu-24.04
     strategy:
       matrix:
         php: ['8.2', '8.3', '8.4', '8.5']
-    env:
-      phpextensions: gd, mbstring, json, curl, xml, dom, mysql, ldap, gmp
-      phpextensioncachekey: cache-v1
     steps:
-    - uses: https://code.forgejo.org/actions/checkout@v6
-
-    - name: Setup cache environment
-      id: extcache
-      uses: https://github.com/shivammathur/cache-extensions@v1
-      with:
-        php-version: ${{ matrix.php }}
-        extensions: ${{ env.phpextensions }}
-        key: ${{ env.phpextensioncachekey }}
-
-    - name: Cache extensions
-      uses: https://code.forgejo.org/actions/cache@v5
-      with:
-        path: ${{ steps.extcache.outputs.dir }}
-        key: ${{ steps.extcache.outputs.key }}
-        restore-keys: ${{ steps.extcache.outputs.key }}
+    - uses: actions/checkout@v4
 
     - name: Setup PHP
-      uses: https://github.com/shivammathur/setup-php@v2
+      uses: shivammathur/setup-php@v2
       with:
         php-version: ${{ matrix.php }}
-        extensions: ${{ env.phpextensions }}
+        extensions: gd, mbstring, json, curl, xml, mysql, ldap, gmp
 
     - name: Get Composer Cache Directory
       id: composer-cache
@@ -53,36 +32,30 @@ jobs:
         echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
 
     - name: Cache composer packages
-      uses: https://code.forgejo.org/actions/cache@v5
+      uses: actions/cache@v4
       with:
         path: ${{ steps.composer-cache.outputs.dir }}
         key: ${{ runner.os }}-composer-${{ matrix.php }}
         restore-keys: ${{ runner.os }}-composer-
 
-    - name: Install composer dependencies
-      run: composer install --prefer-dist --no-interaction --ansi
-      env:
-        COMPOSER_AUTH: '{"github-oauth": {"github.com": "${{ secrets.GH_TOKEN }}"}}'
-
-    - name: Start MySQL
+    - name: Start Database
       run: |
         sudo systemctl start mysql
 
-    - name: Create database & user
+    - name: Setup Database
       run: |
         mysql -uroot -proot -e 'CREATE DATABASE IF NOT EXISTS `bookstack-test`;'
         mysql -uroot -proot -e "CREATE USER 'bookstack-test'@'localhost' IDENTIFIED WITH mysql_native_password BY 'bookstack-test';"
         mysql -uroot -proot -e "GRANT ALL ON \`bookstack-test\`.* TO 'bookstack-test'@'localhost';"
         mysql -uroot -proot -e 'FLUSH PRIVILEGES;'
 
+    - name: Install composer dependencies
+      run: composer install --prefer-dist --no-interaction --ansi
+
     - name: Migrate and seed the database
-      env:
-        TEST_DATABASE_URL: 'mysql://bookstack-test:bookstack-test@localhost/bookstack-test'
       run: |
         php${{ matrix.php }} artisan migrate --force -n --database=mysql_testing
         php${{ matrix.php }} artisan db:seed --force -n --class=DummyContentSeeder --database=mysql_testing
 
     - name: Run PHP tests
-      env:
-        TEST_DATABASE_URL: 'mysql://bookstack-test:bookstack-test@localhost/bookstack-test'
       run: php${{ matrix.php }} ./vendor/bin/phpunit

.gitignore

@@ -2,7 +2,6 @@
 /node_modules
 /.vscode
 /composer
-/composer.phar
 /coverage
 Homestead.yaml
 .env

app/Access/Controllers/ForgotPasswordController.php

@@ -45,11 +45,11 @@ class ForgotPasswordController extends Controller
         );
 
         if ($response === Password::RESET_LINK_SENT) {
-            $this->logActivity(ActivityType::AUTH_PASSWORD_RESET, $request->input('email'));
+            $this->logActivity(ActivityType::AUTH_PASSWORD_RESET, $request->get('email'));
         }
 
         if (in_array($response, [Password::RESET_LINK_SENT, Password::INVALID_USER, Password::RESET_THROTTLED])) {
-            $message = trans('auth.reset_password_sent', ['email' => $request->input('email')]);
+            $message = trans('auth.reset_password_sent', ['email' => $request->get('email')]);
             $this->showSuccessNotification($message);
 
             return redirect('/password/email')->with('status', trans($response));

app/Access/Controllers/HandlesPartialLogins.php

@@ -22,10 +22,4 @@ trait HandlesPartialLogins
 
         return $user;
     }
-
-    protected function clearLastAttemptedUser(): void
-    {
-        $loginService = app()->make(LoginService::class);
-        $loginService->clearLastLoginAttempted();
-    }
 }

app/Access/Controllers/LoginController.php

@@ -32,12 +32,12 @@ class LoginController extends Controller
     {
         $socialDrivers = $this->socialDriverManager->getActive();
         $authMethod = config('auth.method');
-        $preventInitiation = $request->input('prevent_auto_init') === 'true';
+        $preventInitiation = $request->get('prevent_auto_init') === 'true';
 
         if ($request->has('email')) {
             session()->flashInput([
-                'email'    => $request->input('email'),
-                'password' => (config('app.env') === 'demo') ? $request->input('password', '') : '',
+                'email'    => $request->get('email'),
+                'password' => (config('app.env') === 'demo') ? $request->get('password', '') : '',
             ]);
         }
 
@@ -62,7 +62,7 @@ class LoginController extends Controller
     public function login(Request $request)
     {
         $this->validateLogin($request);
-        $username = $request->input($this->username());
+        $username = $request->get($this->username());
 
         // Check login throttling attempts to see if they've gone over the limit
         if ($this->hasTooManyLoginAttempts($request)) {

app/Access/Controllers/MfaBackupCodesController.php

@@ -6,7 +6,6 @@ use BookStack\Access\LoginService;
 use BookStack\Access\Mfa\BackupCodeService;
 use BookStack\Access\Mfa\MfaSession;
 use BookStack\Access\Mfa\MfaValue;
-use BookStack\Access\Mfa\MfaVerificationLimiter;
 use BookStack\Activity\ActivityType;
 use BookStack\Exceptions\NotFoundException;
 use BookStack\Http\Controller;
@@ -20,11 +19,6 @@ class MfaBackupCodesController extends Controller
 
     protected const SETUP_SECRET_SESSION_KEY = 'mfa-setup-backup-codes';
 
-    public function __construct(
-        protected MfaVerificationLimiter $limiter,
-    ) {
-    }
-
     /**
      * Show a view that generates and displays backup codes.
      */
@@ -77,12 +71,6 @@ class MfaBackupCodesController extends Controller
     public function verify(Request $request, BackupCodeService $codeService, MfaSession $mfaSession, LoginService $loginService)
     {
         $user = $this->currentOrLastAttemptedUser();
-        $this->limiter->incrementAttempts($user, $request);
-        if ($this->limiter->hasHitLimit($user, $request)) {
-            $this->clearLastAttemptedUser();
-            $this->limiter->throwException();
-        }
-
         $codes = MfaValue::getValueForUser($user, MfaValue::METHOD_BACKUP_CODES) ?? '[]';
 
         $this->validate($request, [
@@ -96,12 +84,11 @@ class MfaBackupCodesController extends Controller
             ],
         ]);
 
-        $updatedCodes = $codeService->removeInputCodeFromSet($request->input('code'), $codes);
+        $updatedCodes = $codeService->removeInputCodeFromSet($request->get('code'), $codes);
         MfaValue::upsertWithValue($user, MfaValue::METHOD_BACKUP_CODES, $updatedCodes);
 
         $mfaSession->markVerifiedForUser($user);
         $loginService->reattemptLoginFor($user);
-        $this->limiter->decrementAttempts($user, $request);
 
         if ($codeService->countCodesInSet($updatedCodes) < 5) {
             $this->showWarningNotification(trans('auth.mfa_backup_codes_usage_limit_warning'));

app/Access/Controllers/MfaController.php

@@ -51,14 +51,14 @@ class MfaController extends Controller
      */
     public function verify(Request $request)
     {
-        $desiredMethod = $request->input('method');
+        $desiredMethod = $request->get('method');
         $userMethods = $this->currentOrLastAttemptedUser()
             ->mfaValues()
             ->get(['id', 'method'])
             ->groupBy('method');
 
         // Basic search for the default option for a user.
-        // (Prioritises TOTP over backup codes)
+        // (Prioritises totp over backup codes)
         $method = $userMethods->has($desiredMethod) ? $desiredMethod : $userMethods->keys()->sort()->reverse()->first();
         $otherMethods = $userMethods->keys()->filter(function ($userMethod) use ($method) {
             return $method !== $userMethod;

app/Access/Controllers/MfaTotpController.php

@@ -5,7 +5,6 @@ namespace BookStack\Access\Controllers;
 use BookStack\Access\LoginService;
 use BookStack\Access\Mfa\MfaSession;
 use BookStack\Access\Mfa\MfaValue;
-use BookStack\Access\Mfa\MfaVerificationLimiter;
 use BookStack\Access\Mfa\TotpService;
 use BookStack\Access\Mfa\TotpValidationRule;
 use BookStack\Activity\ActivityType;
@@ -21,8 +20,7 @@ class MfaTotpController extends Controller
     protected const SETUP_SECRET_SESSION_KEY = 'mfa-setup-totp-secret';
 
     public function __construct(
-        protected TotpService $totp,
-        protected MfaVerificationLimiter $limiter,
+        protected TotpService $totp
     ) {
     }
 
@@ -88,12 +86,6 @@ class MfaTotpController extends Controller
     public function verify(Request $request, LoginService $loginService, MfaSession $mfaSession)
     {
         $user = $this->currentOrLastAttemptedUser();
-        $this->limiter->incrementAttempts($user, $request);
-        if ($this->limiter->hasHitLimit($user, $request)) {
-            $this->clearLastAttemptedUser();
-            $this->limiter->throwException();
-        }
-
         $totpSecret = MfaValue::getValueForUser($user, MfaValue::METHOD_TOTP);
 
         $this->validate($request, [
@@ -106,7 +98,6 @@ class MfaTotpController extends Controller
 
         $mfaSession->markVerifiedForUser($user);
         $loginService->reattemptLoginFor($user);
-        $this->limiter->decrementAttempts($user, $request);
 
         return redirect()->intended();
     }

app/Access/Controllers/RegisterController.php

@@ -48,7 +48,8 @@ class RegisterController extends Controller
     public function postRegister(Request $request)
     {
         $this->registrationService->ensureRegistrationAllowed();
-        $userData = $this->validator($request->all())->validate();
+        $this->validator($request->all())->validate();
+        $userData = $request->all();
 
         try {
             $user = $this->registrationService->registerUser($userData);

app/Access/Controllers/ResetPasswordController.php

@@ -48,7 +48,7 @@ class ResetPasswordController extends Controller
 
         // Here we will attempt to reset the user's password. If it is successful we
         // will update the password on an actual user model and persist it to the
-        // database. Otherwise, we will parse the error and return the response.
+        // database. Otherwise we will parse the error and return the response.
         $credentials = $request->only('email', 'password', 'password_confirmation', 'token');
         $response = Password::broker()->reset($credentials, function (User $user, string $password) {
             $user->password = Hash::make($password);
@@ -63,7 +63,7 @@ class ResetPasswordController extends Controller
         // redirect them back to where they came from with their error message.
         return $response === Password::PASSWORD_RESET
             ? $this->sendResetResponse()
-            : $this->sendResetFailedResponse($request, $response, $request->input('token'));
+            : $this->sendResetFailedResponse($request, $response, $request->get('token'));
     }
 
     /**

app/Access/Controllers/Saml2Controller.php

@@ -78,7 +78,7 @@ class Saml2Controller extends Controller
      */
     public function startAcs(Request $request)
     {
-        $samlResponse = $request->input('SAMLResponse', null);
+        $samlResponse = $request->get('SAMLResponse', null);
 
         if (empty($samlResponse)) {
             $this->showErrorNotification(trans('errors.saml_fail_authed', ['system' => config('saml2.name')]));
@@ -100,7 +100,7 @@ class Saml2Controller extends Controller
      */
     public function processAcs(Request $request)
     {
-        $acsId = $request->input('id', null);
+        $acsId = $request->get('id', null);
         $cacheKey = 'saml2_acs:' . $acsId;
         $samlResponse = null;
 

app/Access/Controllers/SocialController.php

@@ -67,7 +67,7 @@ class SocialController extends Controller
         if ($request->has('error') && $request->has('error_description')) {
             throw new SocialSignInException(trans('errors.social_login_bad_response', [
                 'socialAccount' => $socialDriver,
-                'error'         => $request->input('error_description'),
+                'error'         => $request->get('error_description'),
             ]), '/login');
         }
 

app/Access/Controllers/UserInviteController.php

@@ -67,7 +67,7 @@ class UserInviteController extends Controller
         }
 
         $user = $this->userRepo->getById($userId);
-        $user->password = Hash::make($request->input('password'));
+        $user->password = Hash::make($request->get('password'));
         $user->email_confirmed = true;
         $user->save();
 

app/Access/EmailConfirmationService.php

@@ -5,7 +5,6 @@ namespace BookStack\Access;
 use BookStack\Access\Notifications\ConfirmEmailNotification;
 use BookStack\Exceptions\ConfirmationEmailException;
 use BookStack\Users\Models\User;
-use Exception;
 
 class EmailConfirmationService extends UserTokenService
 {
@@ -17,7 +16,6 @@ class EmailConfirmationService extends UserTokenService
      * Also removes any existing old ones.
      *
      * @throws ConfirmationEmailException
-     * @throws Exception
      */
     public function sendConfirmation(User $user): void
     {

app/Access/LoginService.php

@@ -71,7 +71,7 @@ class LoginService
         }
 
         $lastLoginDetails = $this->getLastLoginAttemptDetails();
-        $this->login($user, $lastLoginDetails['method'], $lastLoginDetails['remember']);
+        $this->login($user, $lastLoginDetails['method'], $lastLoginDetails['remember'] ?? false);
     }
 
     /**
@@ -126,7 +126,7 @@ class LoginService
     /**
      * Clear the last login attempted session value.
      */
-    public function clearLastLoginAttempted(): void
+    protected function clearLastLoginAttempted(): void
     {
         session()->remove(self::LAST_LOGIN_ATTEMPTED_SESSION_KEY);
     }

app/Access/Mfa/MfaValue.php

@@ -48,16 +48,17 @@ class MfaValue extends Model
     }
 
     /**
-     * Get the decrypted MFA value for the given user and method.
+     * Easily get the decrypted MFA value for the given user and method.
      */
     public static function getValueForUser(User $user, string $method): ?string
     {
+        /** @var MfaValue $mfaVal */
         $mfaVal = static::query()
             ->where('user_id', '=', $user->id)
             ->where('method', '=', $method)
             ->first();
 
-        return $mfaVal?->getValue();
+        return $mfaVal ? $mfaVal->getValue() : null;
     }
 
     /**

app/Access/Mfa/MfaVerificationLimiter.php

@@ -1,62 +0,0 @@
-<?php
-
-namespace BookStack\Access\Mfa;
-
-use BookStack\Exceptions\NotifyException;
-use BookStack\Users\Models\User;
-use Illuminate\Cache\RateLimiter;
-use Illuminate\Http\Request;
-use Illuminate\Http\Response;
-
-/**
- * A rate limit specifically for MFA verification.
- * Limits across both the attempted user (on a tight limit) and the
- * request IP (on a less strict limit).
- */
-class MfaVerificationLimiter
-{
-    protected int $maxUserAttemptsPerMinute = 5;
-    protected int $maxIpAttemptsPerMinute = 60;
-
-    public function __construct(
-        protected RateLimiter $rateLimiter
-    ) {
-    }
-
-    public function throwException(): never
-    {
-        throw new NotifyException(
-            trans('auth.mfa_throttle', ['seconds' => 60]),
-            '/login',
-            Response::HTTP_TOO_MANY_REQUESTS
-        );
-    }
-
-    public function incrementAttempts(User $user, Request $request): void
-    {
-        $this->rateLimiter->hit($this->getUserKey($user));
-        $this->rateLimiter->hit($this->getRequestKey($request));
-    }
-
-    public function decrementAttempts(User $user, Request $request): void
-    {
-        $this->rateLimiter->decrement($this->getUserKey($user));
-        $this->rateLimiter->decrement($this->getRequestKey($request));
-    }
-
-    public function hasHitLimit(User $user, Request $request): bool
-    {
-        return $this->rateLimiter->tooManyAttempts($this->getUserKey($user), $this->maxUserAttemptsPerMinute + 1)
-            || $this->rateLimiter->tooManyAttempts($this->getRequestKey($request), $this->maxIpAttemptsPerMinute + 1);
-    }
-
-    protected function getUserKey(User $user): string
-    {
-        return "mfa-attempt::user::{$user->id}";
-    }
-
-    protected function getRequestKey(Request $request): string
-    {
-        return "mfa-attempt::request::{$request->ip()}";
-    }
-}

app/Access/Oidc/OidcJwtSigningKey.php

@@ -9,7 +9,10 @@ use phpseclib3\Math\BigInteger;
 
 class OidcJwtSigningKey
 {
-    protected PublicKey $key;
+    /**
+     * @var PublicKey
+     */
+    protected $key;
 
     /**
      * Can be created either from a JWK parameter array or local file path to load a certificate from.
@@ -17,13 +20,15 @@ class OidcJwtSigningKey
      * 'file:///var/www/cert.pem'
      * ['kty' => 'RSA', 'alg' => 'RS256', 'n' => 'abc123...'].
      *
+     * @param array|string $jwkOrKeyPath
+     *
      * @throws OidcInvalidKeyException
      */
-    public function __construct(array|string $jwkOrKeyPath)
+    public function __construct($jwkOrKeyPath)
     {
         if (is_array($jwkOrKeyPath)) {
             $this->loadFromJwkArray($jwkOrKeyPath);
-        } elseif (str_starts_with($jwkOrKeyPath, 'file://')) {
+        } elseif (is_string($jwkOrKeyPath) && strpos($jwkOrKeyPath, 'file://') === 0) {
             $this->loadFromPath($jwkOrKeyPath);
         } else {
             throw new OidcInvalidKeyException('Unexpected type of key value provided');
@@ -33,7 +38,7 @@ class OidcJwtSigningKey
     /**
      * @throws OidcInvalidKeyException
      */
-    protected function loadFromPath(string $path): void
+    protected function loadFromPath(string $path)
     {
         try {
             $key = PublicKeyLoader::load(
@@ -53,7 +58,7 @@ class OidcJwtSigningKey
     /**
      * @throws OidcInvalidKeyException
      */
-    protected function loadFromJwkArray(array $jwk): void
+    protected function loadFromJwkArray(array $jwk)
     {
         // 'alg' is optional for a JWK, but we will still attempt to validate if
         // it exists otherwise presume it will be compatible.
@@ -77,7 +82,7 @@ class OidcJwtSigningKey
             throw new OidcInvalidKeyException('A "n" parameter on the provided key is expected');
         }
 
-        $n = strtr($jwk['n'], '-_', '+/');
+        $n = strtr($jwk['n'] ?? '', '-_', '+/');
 
         try {
             $key = PublicKeyLoader::load([

app/Access/Oidc/OidcJwtWithClaims.php

@@ -102,12 +102,12 @@ class OidcJwtWithClaims implements ProvidesClaims
     protected function validateTokenStructure(): void
     {
         foreach (['header', 'payload'] as $prop) {
-            if (empty($this->$prop)) {
+            if (empty($this->$prop) || !is_array($this->$prop)) {
                 throw new OidcInvalidTokenException("Could not parse out a valid {$prop} within the provided token");
             }
         }
 
-        if (empty($this->signature)) {
+        if (empty($this->signature) || !is_string($this->signature)) {
             throw new OidcInvalidTokenException('Could not parse out a valid signature within the provided token');
         }
     }

app/Access/Oidc/OidcUserDetails.php

@@ -39,7 +39,7 @@ class OidcUserDetails
     ): void {
         $this->externalId = $claims->getClaim($idClaim) ?? $this->externalId;
         $this->email = $claims->getClaim('email') ?? $this->email;
-        $this->name = static::getUserDisplayName($displayNameClaims, $claims) ?: $this->name;
+        $this->name = static::getUserDisplayName($displayNameClaims, $claims) ?? $this->name;
         $this->groups = static::getUserGroups($groupsClaim, $claims) ?? $this->groups;
         $this->picture = static::getPicture($claims) ?: $this->picture;
     }

app/Access/RegistrationService.php

@@ -83,7 +83,7 @@ class RegistrationService
         // Email restriction
         $this->ensureEmailDomainAllowed($userEmail);
 
-        // Ensure the user does not already exist
+        // Ensure user does not already exist
         $alreadyUser = !is_null($this->userRepo->getByEmail($userEmail));
         if ($alreadyUser) {
             throw new UserRegistrationException(trans('errors.error_user_exists_different_creds', ['email' => $userEmail]), '/login');
@@ -99,7 +99,7 @@ class RegistrationService
         $newUser = $this->userRepo->createWithoutActivity($userData, $emailConfirmed);
         $newUser->attachDefaultRole();
 
-        // Assign a social account if given
+        // Assign social account if given
         if ($socialAccount) {
             $newUser->socialAccounts()->save($socialAccount);
         }
@@ -107,7 +107,7 @@ class RegistrationService
         Activity::add(ActivityType::AUTH_REGISTER, $socialAccount ?? $newUser);
         Theme::dispatch(ThemeEvents::AUTH_REGISTER, $authSystem, $newUser);
 
-        // Start the email confirmation flow if required
+        // Start email confirmation flow if required
         if ($this->emailConfirmationService->confirmationRequired() && !$emailConfirmed) {
             $newUser->save();
 

app/Access/Saml2Service.php

@@ -266,7 +266,7 @@ class Saml2Service
     /**
      * Extract the details of a user from a SAML response.
      *
-     * @return array{external_id: string, name: string, email: string|null, saml_id: string}
+     * @return array{external_id: string, name: string, email: string, saml_id: string}
      */
     protected function getUserDetails(string $samlID, $samlAttributes): array
     {
@@ -357,7 +357,7 @@ class Saml2Service
             ]);
         }
 
-        if (empty($userDetails['email'])) {
+        if ($userDetails['email'] === null) {
             throw new SamlException(trans('errors.saml_no_email_address'));
         }
 

app/Access/SocialAuthService.php

@@ -117,14 +117,14 @@ class SocialAuthService
         }
 
         // When a user is logged in and the social account exists and is already linked to the current user.
-        if ($isLoggedIn && $socialAccount->user->id === $currentUser->id) {
+        if ($isLoggedIn && $socialAccount !== null && $socialAccount->user->id === $currentUser->id) {
             session()->flash('error', trans('errors.social_account_existing', ['socialAccount' => $titleCaseDriver]));
 
             return redirect('/my-account/auth#social_accounts');
         }
 
         // When a user is logged in, A social account exists but the users do not match.
-        if ($isLoggedIn && $socialAccount->user->id != $currentUser->id) {
+        if ($isLoggedIn && $socialAccount !== null && $socialAccount->user->id != $currentUser->id) {
             session()->flash('error', trans('errors.social_account_already_used_existing', ['socialAccount' => $titleCaseDriver]));
 
             return redirect('/my-account/auth#social_accounts');

app/Activity/ActivityType.php

@@ -46,7 +46,6 @@ class ActivityType
     const USER_CREATE = 'user_create';
     const USER_UPDATE = 'user_update';
     const USER_DELETE = 'user_delete';
-    const USER_MFA_RESET = 'user_mfa_reset';
 
     const API_TOKEN_CREATE = 'api_token_create';
     const API_TOKEN_UPDATE = 'api_token_update';

app/Activity/Controllers/AuditLogController.php

@@ -17,19 +17,19 @@ class AuditLogController extends Controller
         $this->checkPermission(Permission::SettingsManage);
         $this->checkPermission(Permission::UsersManage);
 
-        $sort = $request->input('sort', 'activity_date');
-        $order = $request->input('order', 'desc');
+        $sort = $request->get('sort', 'activity_date');
+        $order = $request->get('order', 'desc');
         $listOptions = (new SimpleListOptions('', $sort, $order))->withSortOptions([
             'created_at' => trans('settings.audit_table_date'),
             'type' => trans('settings.audit_table_event'),
         ]);
 
         $filters = [
-            'event'     => $request->input('event', ''),
-            'date_from' => $request->input('date_from', ''),
-            'date_to'   => $request->input('date_to', ''),
-            'user'      => $request->input('user', ''),
-            'ip'        => $request->input('ip', ''),
+            'event'     => $request->get('event', ''),
+            'date_from' => $request->get('date_from', ''),
+            'date_to'   => $request->get('date_to', ''),
+            'user'      => $request->get('user', ''),
+            'ip'        => $request->get('ip', ''),
         ];
 
         $query = Activity::query()

app/Activity/Controllers/FavouriteController.php

@@ -20,7 +20,7 @@ class FavouriteController extends Controller
     public function index(Request $request, QueryTopFavourites $topFavourites)
     {
         $viewCount = 20;
-        $page = intval($request->input('page', 1));
+        $page = intval($request->get('page', 1));
         $favourites = $topFavourites->run($viewCount + 1, (($page - 1) * $viewCount));
 
         $hasMoreLink = ($favourites->count() > $viewCount) ? url('/favourites?page=' . ($page + 1)) : null;

app/Activity/Controllers/TagApiController.php

@@ -1,68 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace BookStack\Activity\Controllers;
-
-use BookStack\Activity\TagRepo;
-use BookStack\Http\ApiController;
-use Illuminate\Http\JsonResponse;
-use Illuminate\Http\Request;
-
-/**
- * Endpoints to query data about tags in the system.
- * You'll only see results based on tags applied to content you have access to.
- * There are no general create/update/delete endpoints here since tags do not exist
- * by themselves, they are managed via the items they are assigned to.
- */
-class TagApiController extends ApiController
-{
-    public function __construct(
-        protected TagRepo $tagRepo,
-    ) {
-    }
-
-    protected function rules(): array
-    {
-        return [
-            'listValues' => [
-                'name' => ['required', 'string'],
-            ],
-        ];
-    }
-
-    /**
-     * Get a list of tag names used in the system.
-     * Only the name field can be used in filters.
-     */
-    public function listNames(): JsonResponse
-    {
-        $tagQuery = $this->tagRepo
-            ->queryWithTotalsForApi('');
-
-        return $this->apiListingResponse($tagQuery, [
-            'name', 'values', 'usages', 'page_count', 'chapter_count', 'book_count', 'shelf_count',
-        ], [], [
-            'name'
-        ]);
-    }
-
-    /**
-     * Get a list of tag values, which have been set for the given tag name,
-     * which must be provided as a query parameter on the request.
-     * Only the value field can be used in filters.
-     */
-    public function listValues(Request $request): JsonResponse
-    {
-        $data = $this->validate($request, $this->rules()['listValues']);
-        $name = $data['name'];
-
-        $tagQuery = $this->tagRepo->queryWithTotalsForApi($name);
-
-        return $this->apiListingResponse($tagQuery, [
-            'name', 'value', 'usages', 'page_count', 'chapter_count', 'book_count', 'shelf_count',
-        ], [], [
-            'value',
-        ]);
-    }
-}

app/Activity/Controllers/TagController.php

@@ -24,9 +24,9 @@ class TagController extends Controller
             'usages' => trans('entities.tags_usages'),
         ]);
 
-        $nameFilter = $request->input('name', '');
+        $nameFilter = $request->get('name', '');
         $tags = $this->tagRepo
-            ->queryWithTotalsForList($listOptions, $nameFilter)
+            ->queryWithTotals($listOptions, $nameFilter)
             ->paginate(50)
             ->appends(array_filter(array_merge($listOptions->getPaginationAppends(), [
                 'name'   => $nameFilter,
@@ -46,7 +46,7 @@ class TagController extends Controller
      */
     public function getNameSuggestions(Request $request)
     {
-        $searchTerm = $request->input('search', '');
+        $searchTerm = $request->get('search', '');
         $suggestions = $this->tagRepo->getNameSuggestions($searchTerm);
 
         return response()->json($suggestions);
@@ -57,8 +57,8 @@ class TagController extends Controller
      */
     public function getValueSuggestions(Request $request)
     {
-        $searchTerm = $request->input('search', '');
-        $tagName = $request->input('name', '');
+        $searchTerm = $request->get('search', '');
+        $tagName = $request->get('name', '');
         $suggestions = $this->tagRepo->getValueSuggestions($searchTerm, $tagName);
 
         return response()->json($suggestions);

app/Activity/Models/Comment.php

@@ -9,7 +9,6 @@ use BookStack\Users\Models\HasCreatorAndUpdater;
 use BookStack\Users\Models\OwnableInterface;
 use BookStack\Util\HtmlContentFilter;
 use BookStack\Util\HtmlContentFilterConfig;
-use BookStack\Util\HtmlToPlainText;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
@@ -88,12 +87,6 @@ class Comment extends Model implements Loggable, OwnableInterface
         return $filter->filterString($this->html ?? '');
     }
 
-    public function getPlainText(): string
-    {
-        $converter = new HtmlToPlainText();
-        return $converter->convert($this->html ?? '');
-    }
-
     public function jointPermissions(): HasMany
     {
         return $this->hasMany(JointPermission::class, 'entity_id', 'commentable_id')

app/Activity/Notifications/Messages/CommentCreationNotification.php

@@ -24,7 +24,7 @@ class CommentCreationNotification extends BaseActivityNotification
             $locale->trans('notifications.detail_page_name') => new EntityLinkMessageLine($page),
             $locale->trans('notifications.detail_page_path') => $this->buildPagePathLine($page, $notifiable),
             $locale->trans('notifications.detail_commenter') => $this->user->name,
-            $locale->trans('notifications.detail_comment') => $comment->getPlainText(),
+            $locale->trans('notifications.detail_comment') => strip_tags($comment->html),
         ]);
 
         return $this->newMailMessage($locale)

app/Activity/Notifications/Messages/CommentMentionNotification.php

@@ -24,7 +24,7 @@ class CommentMentionNotification extends BaseActivityNotification
             $locale->trans('notifications.detail_page_name') => new EntityLinkMessageLine($page),
             $locale->trans('notifications.detail_page_path') => $this->buildPagePathLine($page, $notifiable),
             $locale->trans('notifications.detail_commenter') => $this->user->name,
-            $locale->trans('notifications.detail_comment') => $comment->getPlainText(),
+            $locale->trans('notifications.detail_comment') => strip_tags($comment->html),
         ]);
 
         return $this->newMailMessage($locale)

app/Activity/Notifications/NotificationManager.php

@@ -15,14 +15,14 @@ use BookStack\Users\Models\User;
 class NotificationManager
 {
     /**
-     * @var array<string, class-string<NotificationHandler>[]>
+     * @var class-string<NotificationHandler>[]
      */
-    protected array $handlersByActivity = [];
+    protected array $handlers = [];
 
     public function handle(Activity $activity, string|Loggable $detail, User $user): void
     {
         $activityType = $activity->type;
-        $handlersToRun = $this->handlersByActivity[$activityType] ?? [];
+        $handlersToRun = $this->handlers[$activityType] ?? [];
         foreach ($handlersToRun as $handlerClass) {
             /** @var NotificationHandler $handler */
             $handler = new $handlerClass();
@@ -35,12 +35,12 @@ class NotificationManager
      */
     public function registerHandler(string $activityType, string $handlerClass): void
     {
-        if (!isset($this->handlersByActivity[$activityType])) {
-            $this->handlersByActivity[$activityType] = [];
+        if (!isset($this->handlers[$activityType])) {
+            $this->handlers[$activityType] = [];
         }
 
-        if (!in_array($handlerClass, $this->handlersByActivity[$activityType])) {
-            $this->handlersByActivity[$activityType][] = $handlerClass;
+        if (!in_array($handlerClass, $this->handlers[$activityType])) {
+            $this->handlers[$activityType][] = $handlerClass;
         }
     }
 

app/Activity/TagRepo.php

@@ -18,10 +18,9 @@ class TagRepo
     }
 
     /**
-     * Start a query against all tags in the system, with total counts for their usage,
-     * suitable for a system interface list with listing options.
+     * Start a query against all tags in the system.
      */
-    public function queryWithTotalsForList(SimpleListOptions $listOptions, string $nameFilter): Builder
+    public function queryWithTotals(SimpleListOptions $listOptions, string $nameFilter): Builder
     {
         $searchTerm = $listOptions->getSearch();
         $sort = $listOptions->getSort();
@@ -29,34 +28,17 @@ class TagRepo
             $sort = 'value';
         }
 
-        $query = $this->baseQueryWithTotals($nameFilter, $searchTerm)
-            ->orderBy($sort, $listOptions->getOrder());
-
-        return $this->permissions->restrictEntityRelationQuery($query, 'tags', 'entity_id', 'entity_type');
-    }
-
-    /**
-     * Start a query against all tags in the system, with total counts for their usage,
-     * which can be used via the API.
-     */
-    public function queryWithTotalsForApi(string $nameFilter): Builder
-    {
-        $query = $this->baseQueryWithTotals($nameFilter, '');
-        return $this->permissions->restrictEntityRelationQuery($query, 'tags', 'entity_id', 'entity_type');
-    }
-
-    protected function baseQueryWithTotals(string $nameFilter, string $searchTerm): Builder
-    {
         $query = Tag::query()
             ->select([
                 'name',
                 ($searchTerm || $nameFilter) ? 'value' : DB::raw('COUNT(distinct value) as `values`'),
                 DB::raw('COUNT(id) as usages'),
-                DB::raw('CAST(SUM(IF(entity_type = \'page\', 1, 0)) as UNSIGNED) as page_count'),
-                DB::raw('CAST(SUM(IF(entity_type = \'chapter\', 1, 0)) as UNSIGNED) as chapter_count'),
-                DB::raw('CAST(SUM(IF(entity_type = \'book\', 1, 0)) as UNSIGNED) as book_count'),
-                DB::raw('CAST(SUM(IF(entity_type = \'bookshelf\', 1, 0)) as UNSIGNED) as shelf_count'),
+                DB::raw('SUM(IF(entity_type = \'page\', 1, 0)) as page_count'),
+                DB::raw('SUM(IF(entity_type = \'chapter\', 1, 0)) as chapter_count'),
+                DB::raw('SUM(IF(entity_type = \'book\', 1, 0)) as book_count'),
+                DB::raw('SUM(IF(entity_type = \'bookshelf\', 1, 0)) as shelf_count'),
             ])
+            ->orderBy($sort, $listOptions->getOrder())
             ->whereHas('entity');
 
         if ($nameFilter) {
@@ -75,7 +57,7 @@ class TagRepo
             });
         }
 
-        return $query;
+        return $this->permissions->restrictEntityRelationQuery($query, 'tags', 'entity_id', 'entity_type');
     }
 
     /**

app/Api/ApiDocsGenerator.php

@@ -17,14 +17,7 @@ use ReflectionMethod;
 
 class ApiDocsGenerator
 {
-    /**
-     * @var array<string, ReflectionClass>
-     */
     protected array $reflectionClasses = [];
-
-    /**
-     * @var array<string, ApiController>
-     */
     protected array $controllerClasses = [];
 
     /**
@@ -114,6 +107,7 @@ class ApiDocsGenerator
      */
     protected function getBodyParamsFromClass(string $className, string $methodName): ?array
     {
+        /** @var ApiController $class */
         $class = $this->controllerClasses[$className] ?? null;
         if ($class === null) {
             $class = app()->make($className);
@@ -159,7 +153,7 @@ class ApiDocsGenerator
         $matches = [];
         preg_match_all('/^\s*?\*\s?($|((?![\/@\s]).*?))$/m', $comment, $matches);
 
-        $text = implode(' ', $matches[1]);
+        $text = implode(' ', $matches[1] ?? []);
         return str_replace('  ', "\n", $text);
     }
 
@@ -195,12 +189,11 @@ class ApiDocsGenerator
     protected function getFlatApiRoutes(): Collection
     {
         return collect(Route::getRoutes()->getRoutes())->filter(function ($route) {
-            return str_starts_with($route->uri, 'api/');
+            return strpos($route->uri, 'api/') === 0;
         })->map(function ($route) {
             [$controller, $controllerMethod] = explode('@', $route->action['uses']);
             $baseModelName = explode('.', explode('/', $route->uri)[1])[0];
-            $controllerMethodKebab = Str::kebab($controllerMethod);
-            $shortName = $baseModelName . '-' . $controllerMethodKebab;
+            $shortName = $baseModelName . '-' . $controllerMethod;
 
             return [
                 'name'                    => $shortName,
@@ -208,7 +201,7 @@ class ApiDocsGenerator
                 'method'                  => $route->methods[0],
                 'controller'              => $controller,
                 'controller_method'       => $controllerMethod,
-                'controller_method_kebab' => $controllerMethodKebab,
+                'controller_method_kebab' => Str::kebab($controllerMethod),
                 'base_model'              => $baseModelName,
             ];
         });

app/Api/ApiEntityListFormatter.php

@@ -74,21 +74,18 @@ class ApiEntityListFormatter
 
     /**
      * Include parent book/chapter info in the formatted data.
-     * These functions are careful to not load the relation themselves, since they should
-     * have already been loaded in a more efficient manner, with permissions applied, by the time
-     * the parent fields are handled here.
      */
     public function withParents(): self
     {
         $this->withField('book', function (Entity $entity) {
-            if ($entity instanceof BookChild && $entity->relationLoaded('book') && $entity->getRelationValue('book')) {
+            if ($entity instanceof BookChild && $entity->book) {
                 return $entity->book->only(['id', 'name', 'slug']);
             }
             return null;
         });
 
         $this->withField('chapter', function (Entity $entity) {
-            if ($entity instanceof Page && $entity->relationLoaded('chapter') && $entity->getRelationValue('chapter')) {
+            if ($entity instanceof Page && $entity->chapter) {
                 return $entity->chapter->only(['id', 'name', 'slug']);
             }
             return null;

app/Api/ApiTokenGuard.php

@@ -17,14 +17,29 @@ class ApiTokenGuard implements Guard
     use GuardHelpers;
 
     /**
-     * The last auth exception thrown in this request.
+     * The request instance.
      */
-    protected ApiAuthException|null $lastAuthException = null;
+    protected $request;
 
-    public function __construct(
-        protected Request $request,
-        protected LoginService $loginService
-    ) {
+    /**
+     * @var LoginService
+     */
+    protected $loginService;
+
+    /**
+     * The last auth exception thrown in this request.
+     *
+     * @var ApiAuthException
+     */
+    protected $lastAuthException;
+
+    /**
+     * ApiTokenGuard constructor.
+     */
+    public function __construct(Request $request, LoginService $loginService)
+    {
+        $this->request = $request;
+        $this->loginService = $loginService;
     }
 
     /**
@@ -52,7 +67,7 @@ class ApiTokenGuard implements Guard
     }
 
     /**
-     * Determine if the current user is authenticated. If not, throw an exception.
+     * Determine if current user is authenticated. If not, throw an exception.
      *
      * @throws ApiAuthException
      *
@@ -106,7 +121,7 @@ class ApiTokenGuard implements Guard
             throw new ApiAuthException(trans('errors.api_no_authorization_found'));
         }
 
-        if (!str_contains($authToken, ':') || !str_starts_with($authToken, 'Token ')) {
+        if (strpos($authToken, ':') === false || strpos($authToken, 'Token ') !== 0) {
             throw new ApiAuthException(trans('errors.api_bad_authorization_format'));
         }
     }
@@ -140,7 +155,7 @@ class ApiTokenGuard implements Guard
     /**
      * {@inheritdoc}
      */
-    public function validate(array $credentials = []): bool
+    public function validate(array $credentials = [])
     {
         if (empty($credentials['id']) || empty($credentials['secret'])) {
             return false;
@@ -160,7 +175,7 @@ class ApiTokenGuard implements Guard
     /**
      * "Log out" the currently authenticated user.
      */
-    public function logout(): void
+    public function logout()
     {
         $this->user = null;
     }

app/Api/ListingResponseBuilder.php

@@ -18,13 +18,6 @@ class ListingResponseBuilder
      */
     protected array $fields;
 
-    /**
-     * Which fields are filterable.
-     * When null, the $fields above are used instead (Allow all fields).
-     * @var string[]|null
-     */
-    protected array|null $filterableFields = null;
-
     /**
      * @var array<callable>
      */
@@ -61,7 +54,7 @@ class ListingResponseBuilder
     {
         $filteredQuery = $this->filterQuery($this->query);
 
-        $total = $filteredQuery->getCountForPagination();
+        $total = $filteredQuery->count();
         $data = $this->fetchData($filteredQuery)->each(function ($model) {
             foreach ($this->resultModifiers as $modifier) {
                 $modifier($model);
@@ -84,14 +77,6 @@ class ListingResponseBuilder
         $this->resultModifiers[] = $modifier;
     }
 
-    /**
-     * Limit filtering to just the given set of fields.
-     */
-    public function setFilterableFields(array $fields): void
-    {
-        $this->filterableFields = $fields;
-    }
-
     /**
      * Fetch the data to return within the response.
      */
@@ -109,7 +94,7 @@ class ListingResponseBuilder
     protected function filterQuery(Builder $query): Builder
     {
         $query = clone $query;
-        $requestFilters = $this->request->input('filter', []);
+        $requestFilters = $this->request->get('filter', []);
         if (!is_array($requestFilters)) {
             return $query;
         }
@@ -129,11 +114,10 @@ class ListingResponseBuilder
     protected function requestFilterToQueryFilter($fieldKey, $value): ?array
     {
         $splitKey = explode(':', $fieldKey);
-        $field = strtolower($splitKey[0]);
+        $field = $splitKey[0];
         $filterOperator = $splitKey[1] ?? 'eq';
 
-        $filterFields = $this->filterableFields ?? $this->fields;
-        if (!in_array($field, $filterFields)) {
+        if (!in_array($field, $this->fields)) {
             return null;
         }
 
@@ -156,8 +140,8 @@ class ListingResponseBuilder
         $defaultSortName = $this->fields[0];
         $direction = 'asc';
 
-        $sort = $this->request->input('sort', '');
-        if (str_starts_with($sort, '-')) {
+        $sort = $this->request->get('sort', '');
+        if (strpos($sort, '-') === 0) {
             $direction = 'desc';
         }
 
@@ -176,9 +160,9 @@ class ListingResponseBuilder
     protected function countAndOffsetQuery(Builder $query): Builder
     {
         $query = clone $query;
-        $offset = max(0, $this->request->input('offset', 0));
+        $offset = max(0, $this->request->get('offset', 0));
         $maxCount = config('api.max_item_count');
-        $count = $this->request->input('count', config('api.default_item_count'));
+        $count = $this->request->get('count', config('api.default_item_count'));
         $count = max(min($maxCount, $count), 1);
 
         return $query->skip($offset)->take($count);

app/Api/UserApiTokenController.php

@@ -48,11 +48,11 @@ class UserApiTokenController extends Controller
         $secret = Str::random(32);
 
         $token = (new ApiToken())->forceFill([
-            'name'       => $request->input('name'),
+            'name'       => $request->get('name'),
             'token_id'   => Str::random(32),
             'secret'     => Hash::make($secret),
             'user_id'    => $user->id,
-            'expires_at' => $request->input('expires_at') ?: ApiToken::defaultExpiry(),
+            'expires_at' => $request->get('expires_at') ?: ApiToken::defaultExpiry(),
         ]);
 
         while (ApiToken::query()->where('token_id', '=', $token->token_id)->exists()) {
@@ -100,8 +100,8 @@ class UserApiTokenController extends Controller
 
         [$user, $token] = $this->checkPermissionAndFetchUserToken($userId, $tokenId);
         $token->fill([
-            'name'       => $request->input('name'),
-            'expires_at' => $request->input('expires_at') ?: ApiToken::defaultExpiry(),
+            'name'       => $request->get('name'),
+            'expires_at' => $request->get('expires_at') ?: ApiToken::defaultExpiry(),
         ])->save();
 
         $this->logActivity(ActivityType::API_TOKEN_UPDATE, $token);

app/App/PwaManifestBuilder.php

@@ -10,7 +10,7 @@ class PwaManifestBuilder
         // does not start a session, so we won't have current user context.
         // This was attempted but removed since manifest calls could affect user session
         // history tracking and back redirection.
-        // Context: https://codeberg.org/bookstack/bookstack/issues/4649
+        // Context: https://github.com/BookStackApp/BookStack/issues/4649
         $darkMode = (bool) setting()->getForCurrentUser('dark-mode-enabled');
         $appName = setting('app-name');
 

app/Config/app.php

@@ -72,17 +72,6 @@ return [
     // Current host and source for the "DRAWIO" setting will be auto-appended to the sources configured.
     'iframe_sources' => env('ALLOWED_IFRAME_SOURCES', 'https://*.draw.io https://*.youtube.com https://*.youtube-nocookie.com https://*.vimeo.com'),
 
-    // A list of style sources/hostnames that can be loaded styles within BookStack.
-    // Space separated if multiple. BookStack host domain is auto-inferred.
-    // If not set, a permissive default set is used to reduce potential breakage.
-    'style_sources' => env('ALLOWED_STYLE_SOURCES', null),
-
-    // A list of sources/hostnames that can be loaded as image content within BookStack.
-    // Space separated if multiple. BookStack host domain is auto-inferred, in addition to
-    // data and blob images, due to their use for various functionality.
-    // If not set, a permissive default set is used to reduce potential breakage.
-    'image_sources' => env('ALLOWED_IMAGE_SOURCES', null),
-
     // A list of the sources/hostnames that can be reached by application SSR calls.
     // This is used wherever users can provide URLs/hosts in-platform, like for webhooks.
     // Host-specific functionality (usually controlled via other options) like auth

app/Config/database.php

@@ -81,6 +81,7 @@ return [
             'strict'         => false,
             'engine'         => null,
             'options'        => extension_loaded('pdo_mysql') ? array_filter([
+                // @phpstan-ignore class.notFound
                 (PHP_VERSION_ID >= 80500 ? \Pdo\Mysql::ATTR_SSL_CA : \PDO::MYSQL_ATTR_SSL_CA) => env('MYSQL_ATTR_SSL_CA'),
             ]) : [],
         ],

app/Config/exports.php

@@ -68,7 +68,7 @@ return [
          * Times-Roman, Times-Bold, Times-BoldItalic, Times-Italic,
          * Symbol, ZapfDingbats.
          */
-        'font_dir' => storage_path('fonts/dompdf'),  // advised by dompdf (https://github.com/dompdf/dompdf/pull/782)
+        'font_dir' => storage_path('fonts/'),  // advised by dompdf (https://github.com/dompdf/dompdf/pull/782)
 
         /**
          * The location of the DOMPDF font cache directory.
@@ -78,7 +78,7 @@ return [
          *
          * Note: This directory must exist and be writable by the webserver process.
          */
-        'font_cache' => storage_path('fonts/dompdf/cache'),
+        'font_cache' => storage_path('fonts/'),
 
         /**
          * The location of a temporary directory.

app/Console/Commands/AssignSortRuleCommand.php

@@ -32,7 +32,7 @@ class AssignSortRuleCommand extends Command
      */
     public function handle(BookSorter $sorter): int
     {
-        $sortRuleId = intval($this->argument('sort-rule'));
+        $sortRuleId = intval($this->argument('sort-rule')) ?? 0;
         if ($sortRuleId === 0) {
             return $this->listSortRules();
         }

app/Console/Commands/CopyShelfPermissionsCommand.php

@@ -32,7 +32,6 @@ class CopyShelfPermissionsCommand extends Command
     {
         $shelfSlug = $this->option('slug');
         $cascadeAll = $this->option('all');
-        $noInteraction = boolval($this->option('no-interaction'));
         $shelves = null;
 
         if (!$cascadeAll && !$shelfSlug) {
@@ -42,16 +41,14 @@ class CopyShelfPermissionsCommand extends Command
         }
 
         if ($cascadeAll) {
-            if (!$noInteraction) {
-                $continue = $this->confirm(
-                    'Permission settings for all shelves will be cascaded. ' .
-                    'Books assigned to multiple shelves will receive only the permissions of it\'s last processed shelf. ' .
-                    'Are you sure you want to proceed?',
-                );
+            $continue = $this->confirm(
+                'Permission settings for all shelves will be cascaded. ' .
+                        'Books assigned to multiple shelves will receive only the permissions of it\'s last processed shelf. ' .
+                        'Are you sure you want to proceed?'
+            );
 
-                if (!$continue) {
-                    return 0;
-                }
+            if (!$continue && !$this->hasOption('no-interaction')) {
+                return 0;
             }
 
             $shelves = $queries->start()->get(['id']);

app/Console/Commands/InstallModuleCommand.php

@@ -213,23 +213,15 @@ class InstallModuleCommand extends Command
                 $redirectLocation = $resp->getHeaderLine('Location');
                 if ($redirectLocation) {
                     $redirectUrl = parse_url($redirectLocation);
-                    $redirectOriginMatches = ($originalUrl['host'] ?? '') === ($redirectUrl['host'] ?? '')
+                    if (
+                        ($originalUrl['host'] ?? '') === ($redirectUrl['host'] ?? '')
                         && ($originalUrl['scheme'] ?? '') === ($redirectUrl['scheme'] ?? '')
-                        && ($originalUrl['port'] ?? '') === ($redirectUrl['port'] ?? '');
-
-                    if (!$redirectOriginMatches) {
-                        $redirectOrigin = ($redirectUrl['scheme'] ?? '') . '://' . ($redirectUrl['host'] ?? '') . (isset($redirectUrl['port']) ? ':' . $redirectUrl['port'] : '');
-                        $this->info("The download URL is redirecting to a different site: {$redirectOrigin}");
-                        $shouldContinue = $this->confirm("Do you trust downloading the module from this site?");
-                        if (!$shouldContinue) {
-                            $this->error("Stopping module installation");
-                            return null;
-                        }
+                        && ($originalUrl['port'] ?? '') === ($redirectUrl['port'] ?? '')
+                    ) {
+                        $currentLocation = $redirectLocation;
+                        $redirectCount++;
+                        continue;
                     }
-
-                    $currentLocation = $redirectLocation;
-                    $redirectCount++;
-                    continue;
                 }
             }
 

app/Entities/Controllers/BookController.php

@@ -144,7 +144,7 @@ class BookController extends Controller
 
         View::incrementFor($book);
         if ($request->has('shelf')) {
-            $this->shelfContext->setShelfContext(intval($request->input('shelf')));
+            $this->shelfContext->setShelfContext(intval($request->get('shelf')));
         }
 
         $this->setPageTitle($book->getShortName());
@@ -263,7 +263,7 @@ class BookController extends Controller
         $this->checkOwnablePermission(Permission::BookView, $book);
         $this->checkPermission(Permission::BookCreateAll);
 
-        $newName = $request->input('name') ?: $book->name;
+        $newName = $request->get('name') ?: $book->name;
         $bookCopy = $cloner->cloneBook($book, $newName);
         $this->showSuccessNotification(trans('entities.books_copy_success'));
 

app/Entities/Controllers/BookshelfApiController.php

@@ -49,7 +49,7 @@ class BookshelfApiController extends ApiController
         $this->checkPermission(Permission::BookshelfCreateAll);
         $requestData = $this->validate($request, $this->rules()['create']);
 
-        $bookIds = $request->input('books', []);
+        $bookIds = $request->get('books', []);
         $shelf = $this->bookshelfRepo->create($requestData, $bookIds);
 
         return response()->json($this->forJsonDisplay($shelf));
@@ -88,7 +88,7 @@ class BookshelfApiController extends ApiController
         $this->checkOwnablePermission(Permission::BookshelfUpdate, $shelf);
 
         $requestData = $this->validate($request, $this->rules()['update']);
-        $bookIds = $request->input('books', null);
+        $bookIds = $request->get('books', null);
 
         $shelf = $this->bookshelfRepo->update($shelf, $requestData, $bookIds);
 

app/Entities/Controllers/BookshelfController.php

@@ -94,7 +94,7 @@ class BookshelfController extends Controller
             'tags'             => ['array'],
         ]);
 
-        $bookIds = explode(',', $request->input('books', ''));
+        $bookIds = explode(',', $request->get('books', ''));
         $shelf = $this->shelfRepo->create($validated, $bookIds);
 
         return redirect($shelf->getUrl());
@@ -196,7 +196,7 @@ class BookshelfController extends Controller
             unset($validated['image']);
         }
 
-        $bookIds = explode(',', $request->input('books', ''));
+        $bookIds = explode(',', $request->get('books', ''));
         $shelf = $this->shelfRepo->update($shelf, $validated, $bookIds);
 
         return redirect($shelf->getUrl());

app/Entities/Controllers/ChapterApiController.php

@@ -64,7 +64,7 @@ class ChapterApiController extends ApiController
     {
         $requestData = $this->validate($request, $this->rules['create']);
 
-        $bookId = $request->input('book_id');
+        $bookId = $request->get('book_id');
         $book = $this->entityQueries->books->findVisibleByIdOrFail(intval($bookId));
         $this->checkOwnablePermission(Permission::ChapterCreate, $book);
 

app/Entities/Controllers/ChapterController.php

@@ -203,7 +203,7 @@ class ChapterController extends Controller
         $this->checkOwnablePermission(Permission::ChapterUpdate, $chapter);
         $this->checkOwnablePermission(Permission::ChapterDelete, $chapter);
 
-        $entitySelection = $request->input('entity_selection', null);
+        $entitySelection = $request->get('entity_selection', null);
         if ($entitySelection === null || $entitySelection === '') {
             return redirect($chapter->getUrl());
         }
@@ -248,7 +248,7 @@ class ChapterController extends Controller
     {
         $chapter = $this->queries->findVisibleBySlugsOrFail($bookSlug, $chapterSlug);
 
-        $entitySelection = $request->input('entity_selection') ?: null;
+        $entitySelection = $request->get('entity_selection') ?: null;
         $newParentBook = $entitySelection ? $this->entityQueries->findVisibleByStringIdentifier($entitySelection) : $chapter->getParent();
 
         if (!$newParentBook instanceof Book) {
@@ -259,7 +259,7 @@ class ChapterController extends Controller
 
         $this->checkOwnablePermission(Permission::ChapterCreate, $newParentBook);
 
-        $newName = $request->input('name') ?: $chapter->name;
+        $newName = $request->get('name') ?: $chapter->name;
         $chapterCopy = $cloner->cloneChapter($chapter, $newParentBook, $newName);
         $this->showSuccessNotification(trans('entities.chapters_copy_success'));
 

app/Entities/Controllers/PageApiController.php

@@ -74,9 +74,9 @@ class PageApiController extends ApiController
         $this->validate($request, $this->rules['create']);
 
         if ($request->has('chapter_id')) {
-            $parent = $this->entityQueries->chapters->findVisibleByIdOrFail(intval($request->input('chapter_id')));
+            $parent = $this->entityQueries->chapters->findVisibleByIdOrFail(intval($request->get('chapter_id')));
         } else {
-            $parent = $this->entityQueries->books->findVisibleByIdOrFail(intval($request->input('book_id')));
+            $parent = $this->entityQueries->books->findVisibleByIdOrFail(intval($request->get('book_id')));
         }
         $this->checkOwnablePermission(Permission::PageCreate, $parent);
 
@@ -133,9 +133,9 @@ class PageApiController extends ApiController
 
         $parent = null;
         if ($request->has('chapter_id')) {
-            $parent = $this->entityQueries->chapters->findVisibleByIdOrFail(intval($request->input('chapter_id')));
+            $parent = $this->entityQueries->chapters->findVisibleByIdOrFail(intval($request->get('chapter_id')));
         } elseif ($request->has('book_id')) {
-            $parent = $this->entityQueries->books->findVisibleByIdOrFail(intval($request->input('book_id')));
+            $parent = $this->entityQueries->books->findVisibleByIdOrFail(intval($request->get('book_id')));
         }
 
         if ($parent && !$parent->matches($page->getParent())) {

app/Entities/Controllers/PageController.php

@@ -88,7 +88,7 @@ class PageController extends Controller
 
         $page = $this->pageRepo->getNewDraftPage($parent);
         $this->pageRepo->publishDraft($page, [
-            'name' => $request->input('name'),
+            'name' => $request->get('name'),
         ]);
 
         return redirect($page->getUrl('/edit'));
@@ -408,7 +408,7 @@ class PageController extends Controller
         $this->checkOwnablePermission(Permission::PageUpdate, $page);
         $this->checkOwnablePermission(Permission::PageDelete, $page);
 
-        $entitySelection = $request->input('entity_selection', null);
+        $entitySelection = $request->get('entity_selection', null);
         if ($entitySelection === null || $entitySelection === '') {
             return redirect($page->getUrl());
         }
@@ -453,7 +453,7 @@ class PageController extends Controller
         $page = $this->queries->findVisibleBySlugsOrFail($bookSlug, $pageSlug);
         $this->checkOwnablePermission(Permission::PageView, $page);
 
-        $entitySelection = $request->input('entity_selection') ?: null;
+        $entitySelection = $request->get('entity_selection') ?: null;
         $newParent = $entitySelection ? $this->entityQueries->findVisibleByStringIdentifier($entitySelection) : $page->getParent();
 
         if (!$newParent instanceof Book && !$newParent instanceof Chapter) {
@@ -464,7 +464,7 @@ class PageController extends Controller
 
         $this->checkOwnablePermission(Permission::PageCreate, $newParent);
 
-        $newName = $request->input('name') ?: $page->name;
+        $newName = $request->get('name') ?: $page->name;
         $pageCopy = $cloner->clonePage($page, $newParent, $newName);
         $this->showSuccessNotification(trans('entities.pages_copy_success'));
 

app/Entities/Controllers/PageRevisionController.php

@@ -34,7 +34,6 @@ class PageRevisionController extends Controller
      */
     public function index(Request $request, string $bookSlug, string $pageSlug)
     {
-        $this->checkPermission(Permission::RevisionViewAll);
         $page = $this->pageQueries->findVisibleBySlugsOrFail($bookSlug, $pageSlug);
         $listOptions = SimpleListOptions::fromRequest($request, 'page_revisions', true)->withSortOptions([
             'id' => trans('entities.pages_revisions_sort_number')
@@ -66,8 +65,6 @@ class PageRevisionController extends Controller
      */
     public function show(string $bookSlug, string $pageSlug, int $revisionId)
     {
-        $this->checkPermission(Permission::RevisionViewAll);
-
         $page = $this->pageQueries->findVisibleBySlugsOrFail($bookSlug, $pageSlug);
         /** @var ?PageRevision $revision */
         $revision = $page->revisions()->where('id', '=', $revisionId)->first();
@@ -97,8 +94,6 @@ class PageRevisionController extends Controller
      */
     public function changes(string $bookSlug, string $pageSlug, int $revisionId)
     {
-        $this->checkPermission(Permission::RevisionViewAll);
-
         $page = $this->pageQueries->findVisibleBySlugsOrFail($bookSlug, $pageSlug);
         /** @var ?PageRevision $revision */
         $revision = $page->revisions()->where('id', '=', $revisionId)->first();
@@ -134,7 +129,6 @@ class PageRevisionController extends Controller
      */
     public function restore(string $bookSlug, string $pageSlug, int $revisionId)
     {
-        $this->checkPermission(Permission::RevisionViewAll);
         $page = $this->pageQueries->findVisibleBySlugsOrFail($bookSlug, $pageSlug);
         $this->checkOwnablePermission(Permission::PageUpdate, $page);
 
@@ -150,7 +144,6 @@ class PageRevisionController extends Controller
      */
     public function destroy(string $bookSlug, string $pageSlug, int $revId)
     {
-        $this->checkPermission(Permission::RevisionViewAll);
         $page = $this->pageQueries->findVisibleBySlugsOrFail($bookSlug, $pageSlug);
         $this->checkOwnablePermission(Permission::PageDelete, $page);
 

app/Entities/Controllers/PageTemplateController.php

@@ -21,8 +21,8 @@ class PageTemplateController extends Controller
      */
     public function list(Request $request)
     {
-        $page = $request->input('page', 1);
-        $search = $request->input('search', '');
+        $page = $request->get('page', 1);
+        $search = $request->get('search', '');
         $count = 10;
 
         $query = $this->pageQueries->visibleTemplates()

app/Entities/Models/Book.php

@@ -17,7 +17,7 @@ use Illuminate\Support\Collection;
  *
  * @property string                                   $description
  * @property string                                   $description_html
- * @property ?int                                     $image_id
+ * @property int                                      $image_id
  * @property ?int                                     $default_template_id
  * @property ?int                                     $sort_rule_id
  * @property \Illuminate\Database\Eloquent\Collection $chapters

app/Entities/Models/Entity.php

@@ -479,7 +479,6 @@ abstract class Entity extends Model implements
             'chapter' => new Chapter(),
             'book' => new Book(),
             'bookshelf' => new Bookshelf(),
-            default => throw new \InvalidArgumentException("Invalid entity type: {$type}"),
         };
     }
 }

app/Entities/Models/Page.php

@@ -23,7 +23,7 @@ use Illuminate\Database\Eloquent\Relations\HasOne;
  * @property bool         $draft
  * @property int          $revision_count
  * @property string       $editor
- * @property Chapter|null $chapter
+ * @property Chapter      $chapter
  * @property Collection   $attachments
  * @property Collection   $revisions
  * @property PageRevision $currentRevision

app/Entities/Repos/BaseRepo.php

@@ -16,7 +16,6 @@ use BookStack\References\ReferenceUpdater;
 use BookStack\Sorting\BookSorter;
 use BookStack\Uploads\ImageRepo;
 use BookStack\Util\HtmlDescriptionFilter;
-use BookStack\Util\HtmlToPlainText;
 use Illuminate\Http\UploadedFile;
 
 class BaseRepo
@@ -152,10 +151,9 @@ class BaseRepo
         }
 
         if (isset($input['description_html'])) {
-            $plainTextConverter = new HtmlToPlainText();
             $entity->descriptionInfo()->set(
                 HtmlDescriptionFilter::filterFromString($input['description_html']),
-                $plainTextConverter->convert($input['description_html']),
+                html_entity_decode(strip_tags($input['description_html']))
             );
         } else if (isset($input['description'])) {
             $entity->descriptionInfo()->set('', $input['description']);

app/Entities/Repos/PageRepo.php

@@ -60,7 +60,7 @@ class PageRepo
             $page->book_id = $parent->id;
         }
 
-        $defaultTemplate = $page->chapter?->defaultTemplate()->get() ?? $page->book->defaultTemplate()->get();
+        $defaultTemplate = $page->chapter?->defaultTemplate()->get() ?? $page->book?->defaultTemplate()->get();
         if ($defaultTemplate) {
             $page->forceFill([
                 'html'  => $defaultTemplate->html,
@@ -118,27 +118,29 @@ class PageRepo
      */
     public function update(Page $page, array $input): Page
     {
-        // Hold the old details to compare later
+        // Hold the old details to compare later.
         $oldName = $page->name;
         $oldHtml = $page->html;
         $oldMarkdown = $page->markdown;
 
         $this->updateTemplateStatusAndContentFromInput($page, $input);
-        $page = $this->baseRepo->update($page, $input);
 
-        // Update with new details
-        $page->revision_count++;
-        $page->save();
-
-        // Remove all update drafts for this user and page.
-        $this->revisionRepo->deleteDraftsForCurrentUser($page);
-
-        // Save a revision after updating
+        // Values used to determine if a change has been made.
         $summary = trim($input['summary'] ?? '');
-        $htmlChanged = isset($input['html']) && $input['html'] !== $oldHtml;
+        $htmlChanged = isset($page->html) && $page->html !== $oldHtml;
         $nameChanged = isset($input['name']) && $input['name'] !== $oldName;
-        $markdownChanged = isset($input['markdown']) && $input['markdown'] !== $oldMarkdown;
+        $markdownChanged = isset($page->markdown) && $page->markdown !== $oldMarkdown;
+
+        // Update with new details, only if the page really changed.
         if ($htmlChanged || $nameChanged || $markdownChanged || $summary) {
+            $page = $this->baseRepo->update($page, $input);
+
+            $page->revision_count++;
+            $page->save();
+
+            // Remove all update drafts for this user and page.
+            $this->revisionRepo->deleteDraftsForCurrentUser($page);
+
             $this->revisionRepo->storeNewForPage($page, $summary);
         }
 

app/Entities/Tools/PageContent.php

@@ -16,7 +16,6 @@ use BookStack\Users\Models\User;
 use BookStack\Util\HtmlContentFilter;
 use BookStack\Util\HtmlContentFilterConfig;
 use BookStack\Util\HtmlDocument;
-use BookStack\Util\HtmlToPlainText;
 use BookStack\Util\WebSafeMimeSniffer;
 use Closure;
 use DOMElement;
@@ -304,8 +303,8 @@ class PageContent
     public function toPlainText(): string
     {
         $html = $this->render(true);
-        $converter = new HtmlToPlainText();
-        return $converter->convert($html);
+
+        return html_entity_decode(strip_tags($html));
     }
 
     /**
@@ -360,7 +359,7 @@ class PageContent
     {
         $contentHash = md5($html);
         $contentId = $this->page->id;
-        $contentTime = $this->page->updated_at->timestamp ?? time();
+        $contentTime = $this->page->updated_at?->timestamp ?? time();
         $appVersion = AppVersion::get();
         $filterConfig = config('app.content_filtering') ?? '';
         return "page-content-cache::{$filterConfig}::{$appVersion}::{$contentId}::{$contentTime}::{$contentHash}";

app/Entities/Tools/PermissionsUpdater.php

@@ -20,8 +20,8 @@ class PermissionsUpdater
      */
     public function updateFromPermissionsForm(Entity $entity, Request $request): void
     {
-        $permissions = $request->input('permissions', null);
-        $ownerId = $request->input('owned_by', null);
+        $permissions = $request->get('permissions', null);
+        $ownerId = $request->get('owned_by', null);
 
         $entity->permissions()->delete();
 
@@ -47,7 +47,7 @@ class PermissionsUpdater
     {
         if (isset($data['role_permissions'])) {
             $entity->permissions()->where('role_id', '!=', 0)->delete();
-            $rolePermissionData = $this->formatPermissionsFromApiRequestToEntityPermissions($data['role_permissions'], false);
+            $rolePermissionData = $this->formatPermissionsFromApiRequestToEntityPermissions($data['role_permissions'] ?? [], false);
             $entity->permissions()->createMany($rolePermissionData);
         }
 

app/Exceptions/Handler.php

@@ -25,7 +25,6 @@ class Handler extends ExceptionHandler
     protected $dontReport = [
         NotFoundException::class,
         StoppedAuthenticationException::class,
-        NotifyException::class,
     ];
 
     /**

app/Exceptions/NotifyException.php

@@ -6,22 +6,18 @@ use Exception;
 use Illuminate\Contracts\Support\Responsable;
 use Symfony\Component\HttpKernel\Exception\HttpExceptionInterface;
 
-/**
- * An exception that is thrown to notify the user of something which went wrong.
- * Typically these should be translated messages since they will be shown to the end user
- * via a pop up notification error message in the UI.
- *
- * This exception is not intended to be used for internal system/application errors,
- * and therefore will not be logged by the exception handler.
- */
 class NotifyException extends Exception implements Responsable, HttpExceptionInterface
 {
-    public function __construct(
-        string $message,
-        public string $redirectLocation = '/',
-        protected int $status = 500
-    ) {
+    public $message;
+    public string $redirectLocation;
+    protected int $status;
+
+    public function __construct(string $message, string $redirectLocation = '/', int $status = 500)
+    {
         $this->message = $message;
+        $this->redirectLocation = $redirectLocation;
+        $this->status = $status;
+
         parent::__construct();
     }
 

app/Exports/ExportFormatter.php

@@ -11,7 +11,6 @@ use BookStack\Entities\Tools\PageContent;
 use BookStack\Uploads\ImageService;
 use BookStack\Util\CspService;
 use BookStack\Util\HtmlDocument;
-use BookStack\Util\HtmlToPlainText;
 use DOMElement;
 use Exception;
 use Throwable;
@@ -209,7 +208,7 @@ class ExportFormatter
         preg_match_all("/\<img.*?src\=(\'|\")(.*?)(\'|\").*?\>/i", $htmlContent, $imageTagsOutput);
 
         // Replace image src with base64 encoded image strings
-        if (count($imageTagsOutput[0]) > 0) {
+        if (isset($imageTagsOutput[0]) && count($imageTagsOutput[0]) > 0) {
             foreach ($imageTagsOutput[0] as $index => $imgMatch) {
                 $oldImgTagString = $imgMatch;
                 $srcString = $imageTagsOutput[2][$index];
@@ -226,7 +225,7 @@ class ExportFormatter
         preg_match_all("/\<a.*href\=(\'|\")(.*?)(\'|\").*?\>/i", $htmlContent, $linksOutput);
 
         // Update relative links to be absolute, with instance url
-        if (count($linksOutput[0]) > 0) {
+        if (isset($linksOutput[0]) && count($linksOutput[0]) > 0) {
             foreach ($linksOutput[0] as $index => $linkMatch) {
                 $oldLinkString = $linkMatch;
                 $srcString = $linksOutput[2][$index];
@@ -243,13 +242,24 @@ class ExportFormatter
 
     /**
      * Converts the page contents into simple plain text.
-     * We re-generate the plain text from HTML at this point, post-page-content rendering.
+     * This method filters any bad looking content to provide a nice final output.
      */
     public function pageToPlainText(Page $page, bool $pageRendered = false, bool $fromParent = false): string
     {
         $html = $pageRendered ? $page->html : (new PageContent($page))->render();
-        $contentText = (new HtmlToPlainText())->convert($html);
-        return $page->name . ($fromParent ? "\n" : "\n\n") . $contentText;
+        // Add proceeding spaces before tags so spaces remain between
+        // text within elements after stripping tags.
+        $html = str_replace('<', " <", $html);
+        $text = trim(strip_tags($html));
+        // Replace multiple spaces with single spaces
+        $text = preg_replace('/ {2,}/', ' ', $text);
+        // Reduce multiple horrid whitespace characters.
+        $text = preg_replace('/(\x0A|\xA0|\x0A|\r|\n){2,}/su', "\n\n", $text);
+        $text = html_entity_decode($text);
+        // Add title
+        $text = $page->name . ($fromParent ? "\n" : "\n\n") . $text;
+
+        return $text;
     }
 
     /**
@@ -257,7 +267,7 @@ class ExportFormatter
      */
     public function chapterToPlainText(Chapter $chapter): string
     {
-        $text = $chapter->name . "\n" . $chapter->descriptionInfo()->getPlain();
+        $text = $chapter->name . "\n" . $chapter->description;
         $text = trim($text) . "\n\n";
 
         $parts = [];

app/Exports/PdfGenerator.php

@@ -4,8 +4,6 @@ namespace BookStack\Exports;
 
 use BookStack\Exceptions\PdfExportException;
 use Dompdf\Dompdf;
-use FontLib\Font;
-use Illuminate\Support\Str;
 use Knp\Snappy\Pdf as SnappyPdf;
 use Symfony\Component\Process\Exception\ProcessTimedOutException;
 use Symfony\Component\Process\Process;
@@ -62,65 +60,12 @@ class PdfGenerator
         $domPdf = new Dompdf($options);
         $domPdf->setBasePath(base_path('public'));
 
-        $fontMetrics = $domPdf->getFontMetrics();
-        $userFontfamilies = $this->getUserDomPdfFontFamilies();
-        foreach ($userFontfamilies as $fontFamily => $fonts) {
-            try {
-                $fontMetrics->setFontFamily($fontFamily, $fonts);
-            } catch (\Exception $exception) {
-                $expectedPath = storage_path('fonts/dompdf');
-                throw new PdfExportException("Failed to create required font data in {$expectedPath}, Ensure all content in this location is writable by the web server");
-            }
-        }
-
         $domPdf->loadHTML($this->convertEntities($html));
         $domPdf->render();
 
         return (string) $domPdf->output();
     }
 
-    /**
-     * @return array<string, array<string, string>>
-     */
-    protected function getUserDomPdfFontFamilies(): array
-    {
-        $fontStore = storage_path('fonts/dompdf');
-        if (!is_dir($fontStore)) {
-            return [];
-        }
-
-        $fontFamilies = [];
-        $fontFiles = glob($fontStore . DIRECTORY_SEPARATOR . '*.ttf');
-        foreach ($fontFiles as $fontFile) {
-            $fontFileName = basename($fontFile, '.ttf');
-            $expectedUfm = $fontStore . DIRECTORY_SEPARATOR . $fontFileName . '.ufm';
-            if (!file_exists($expectedUfm)) {
-                $font = Font::load($fontFile);
-                $font->parse();
-                try {
-                    $font->saveAdobeFontMetrics($expectedUfm);
-                } catch (\Exception $exception) {
-                    throw new PdfExportException("Failed to create required font data at $expectedUfm, Ensure this location is writable by the web server");
-                }
-            }
-
-            $nameParts = explode('-', $fontFileName);
-            if (count($nameParts) === 1 || $nameParts[1] === 'Regular') {
-                $nameParts[1] = 'Normal';
-            }
-
-            $family = trim(strtolower(preg_replace('/([A-Z])/', ' $1', $nameParts[0])));
-            $variation = Str::snake($nameParts[1]);
-            if (!isset($fontFamilies[$family])) {
-                $fontFamilies[$family] = [];
-            }
-
-            $fontFamilies[$family][$variation] = $fontStore . DIRECTORY_SEPARATOR . $fontFileName;
-        }
-
-        return $fontFamilies;
-    }
-
     /**
      * @throws PdfExportException
      */

app/Exports/ZipExports/Models/ZipExportAttachment.php

@@ -45,7 +45,7 @@ final class ZipExportAttachment extends ZipExportModel
         $rules = [
             'id'    => ['nullable', 'int', $context->uniqueIdRule('attachment')],
             'name'  => ['required', 'string', 'min:1'],
-            'link'  => ['required_without:file', 'nullable', 'string', 'max:2000', 'safe_url'],
+            'link'  => ['required_without:file', 'nullable', 'string'],
             'file'  => ['required_without:link', 'nullable', 'string', $context->fileReferenceRule()],
         ];
 

app/Exports/ZipExports/ZipImportRunner.php

@@ -82,8 +82,10 @@ class ZipImportRunner
             $entity = $this->importBook($exportModel, $reader);
         } else if ($exportModel instanceof ZipExportChapter) {
             $entity = $this->importChapter($exportModel, $parent, $reader);
-        } else {
+        } else if ($exportModel instanceof ZipExportPage) {
             $entity = $this->importPage($exportModel, $parent, $reader);
+        } else {
+            throw new ZipImportException(['No importable data found in import data.']);
         }
 
         $this->references->replaceReferences();
@@ -130,7 +132,7 @@ class ZipImportRunner
             'name' => $exportBook->name,
             'description_html' => $exportBook->description_html ?? '',
             'image' => $exportBook->cover ? $this->zipFileToUploadedFile($exportBook->cover, $reader) : null,
-            'tags' => $this->exportTagsToInputArray($exportBook->tags),
+            'tags' => $this->exportTagsToInputArray($exportBook->tags ?? []),
         ]);
 
         if ($book->coverInfo()->getImage()) {
@@ -149,7 +151,7 @@ class ZipImportRunner
         foreach ($children as $child) {
             if ($child instanceof ZipExportChapter) {
                 $this->importChapter($child, $book, $reader);
-            } else {
+            } else if ($child instanceof ZipExportPage) {
                 $this->importPage($child, $book, $reader);
             }
         }
@@ -164,7 +166,7 @@ class ZipImportRunner
         $chapter = $this->chapterRepo->create([
             'name' => $exportChapter->name,
             'description_html' => $exportChapter->description_html ?? '',
-            'tags' => $this->exportTagsToInputArray($exportChapter->tags),
+            'tags' => $this->exportTagsToInputArray($exportChapter->tags ?? []),
         ], $parent);
 
         $exportPages = $exportChapter->pages;
@@ -197,7 +199,7 @@ class ZipImportRunner
             'name' => $exportPage->name,
             'markdown' => $exportPage->markdown ?? '',
             'html' => $exportPage->html ?? '',
-            'tags' => $this->exportTagsToInputArray($exportPage->tags),
+            'tags' => $this->exportTagsToInputArray($exportPage->tags ?? []),
         ]);
 
         $this->references->addPage($page, $exportPage);
@@ -300,7 +302,7 @@ class ZipImportRunner
             array_push($chapters, ...$exportModel->chapters);
         } else if ($exportModel instanceof ZipExportChapter) {
             $chapters[] = $exportModel;
-        } else {
+        } else if ($exportModel instanceof ZipExportPage) {
             $pages[] = $exportModel;
         }
 

app/Exports/ZipExports/ZipReferenceParser.php

@@ -68,6 +68,10 @@ class ZipReferenceParser
         $matches = [];
         preg_match_all($referenceRegex, $content, $matches);
 
+        if (count($matches) < 3) {
+            return $content;
+        }
+
         for ($i = 0; $i < count($matches[0]); $i++) {
             $referenceText = $matches[0][$i];
             $type = strtolower($matches[1][$i]);

app/Http/ApiController.php

@@ -20,14 +20,10 @@ abstract class ApiController extends Controller
      * Provide a paginated listing JSON response in a standard format
      * taking into account any pagination parameters passed by the user.
      */
-    protected function apiListingResponse(Builder $query, array $fields, array $modifiers = [], array $filterableFields = []): JsonResponse
+    protected function apiListingResponse(Builder $query, array $fields, array $modifiers = []): JsonResponse
     {
         $listing = new ListingResponseBuilder($query, request(), $fields);
 
-        if (count($filterableFields) > 0) {
-            $listing->setFilterableFields($filterableFields);
-        }
-
         foreach ($modifiers as $modifier) {
             $listing->modifyResults($modifier);
         }

app/Http/Controller.php

@@ -62,7 +62,7 @@ abstract class Controller extends BaseController
      */
     protected function checkPermission(string|Permission $permission): void
     {
-        if (!user()->can($permission)) {
+        if (!user() || !user()->can($permission)) {
             $this->showPermissionError();
         }
     }

app/Permissions/JointPermissionBuilder.php

@@ -61,7 +61,8 @@ class JointPermissionBuilder
             return;
         }
 
-        if ($entity instanceof BookChild) {
+        /** @var BookChild $entity */
+        if ($entity->book) {
             $entities[] = $entity->book;
         }
 

app/Permissions/Permission.php

@@ -118,8 +118,6 @@ enum Permission: string
     case PageViewAll = 'page-view-all';
     case PageViewOwn = 'page-view-own';
 
-    case RevisionViewAll = 'revision-view-all';
-
     /**
      * Get the generic permissions which may be queried for entities.
      */

app/Search/SearchApiController.php

@@ -40,9 +40,9 @@ class SearchApiController extends ApiController
     {
         $this->validate($request, $this->rules['all']);
 
-        $options = SearchOptions::fromString($request->input('query') ?? '');
-        $page = intval($request->input('page', '0')) ?: 1;
-        $count = min(intval($request->input('count', '0')) ?: 20, 100);
+        $options = SearchOptions::fromString($request->get('query') ?? '');
+        $page = intval($request->get('page', '0')) ?: 1;
+        $count = min(intval($request->get('count', '0')) ?: 20, 100);
 
         $results = $this->searchRunner->searchEntities($options, 'all', $page, $count);
         $this->resultsFormatter->format($results['results']->all(), $options);

app/Search/SearchController.php

@@ -24,7 +24,7 @@ class SearchController extends Controller
     {
         $searchOpts = SearchOptions::fromRequest($request);
         $fullSearchString = $searchOpts->toString();
-        $page = intval($request->input('page', '0')) ?: 1;
+        $page = intval($request->get('page', '0')) ?: 1;
         $count = setting()->getInteger('lists-page-count-search', 18, 1, 1000);
 
         $results = $this->searchRunner->searchEntities($searchOpts, 'all', $page, $count);
@@ -49,7 +49,7 @@ class SearchController extends Controller
      */
     public function searchBook(Request $request, int $bookId)
     {
-        $term = $request->input('term', '');
+        $term = $request->get('term', '');
         $results = $this->searchRunner->searchBook($bookId, $term);
 
         return view('entities.list', ['entities' => $results]);
@@ -60,7 +60,7 @@ class SearchController extends Controller
      */
     public function searchChapter(Request $request, int $chapterId)
     {
-        $term = $request->input('term', '');
+        $term = $request->get('term', '');
         $results = $this->searchRunner->searchChapter($chapterId, $term);
 
         return view('entities.list', ['entities' => $results]);
@@ -72,9 +72,9 @@ class SearchController extends Controller
      */
     public function searchForSelector(Request $request, QueryPopular $queryPopular)
     {
-        $entityTypes = $request->filled('types') ? explode(',', $request->input('types')) : ['page', 'chapter', 'book'];
-        $searchTerm = $request->input('term', false);
-        $permission = $request->input('permission', 'view');
+        $entityTypes = $request->filled('types') ? explode(',', $request->get('types')) : ['page', 'chapter', 'book'];
+        $searchTerm = $request->get('term', false);
+        $permission = $request->get('permission', 'view');
 
         // Search for entities otherwise show most popular
         if ($searchTerm !== false) {
@@ -93,7 +93,7 @@ class SearchController extends Controller
      */
     public function templatesForSelector(Request $request)
     {
-        $searchTerm = $request->input('term', false);
+        $searchTerm = $request->get('term', false);
 
         if ($searchTerm !== false) {
             $searchOptions = SearchOptions::fromString($searchTerm);
@@ -119,7 +119,7 @@ class SearchController extends Controller
      */
     public function searchSuggestions(Request $request)
     {
-        $searchTerm = $request->input('term', '');
+        $searchTerm = $request->get('term', '');
         $entities = $this->searchRunner->searchEntities(SearchOptions::fromString($searchTerm), 'all', 1, 5)['results'];
 
         foreach ($entities as $entity) {
@@ -136,8 +136,8 @@ class SearchController extends Controller
      */
     public function searchSiblings(Request $request, SiblingFetcher $siblingFetcher)
     {
-        $type = $request->input('entity_type', null);
-        $id = $request->input('entity_id', null);
+        $type = $request->get('entity_type', null);
+        $id = $request->get('entity_id', null);
 
         $entities = $siblingFetcher->fetch($type, $id);
 

app/Search/SearchIndex.php

@@ -119,7 +119,7 @@ class SearchIndex
      * Create a scored term array from the given text, where the keys are the terms
      * and the values are their scores.
      *
-     * @return array<string, float>
+     * @return array<string, int>
      */
     protected function generateTermScoreMapFromText(string $text, float $scoreAdjustment = 1): array
     {
@@ -136,7 +136,7 @@ class SearchIndex
      * Create a scored term array from the given HTML, where the keys are the terms
      * and the values are their scores.
      *
-     * @return array<string, float>
+     * @return array<string, int>
      */
     protected function generateTermScoreMapFromHtml(string $html): array
     {
@@ -177,7 +177,7 @@ class SearchIndex
      *
      * @param Tag[] $tags
      *
-     * @return array<string, float>
+     * @return array<string, int>
      */
     protected function generateTermScoreMapFromTags(array $tags): array
     {
@@ -277,9 +277,9 @@ class SearchIndex
      * For the given term data arrays, Merge their contents by term
      * while combining any scores.
      *
-     * @param array<string, float>[] ...$scoreMaps
+     * @param array<string, int>[] ...$scoreMaps
      *
-     * @return array<string, float>
+     * @return array<string, int>
      */
     protected function mergeTermScoreMaps(...$scoreMaps): array
     {

app/Search/SearchOptions.php

@@ -51,7 +51,7 @@ class SearchOptions
         }
 
         if ($request->has('term')) {
-            return static::fromString($request->input('term'));
+            return static::fromString($request->get('term'));
         }
 
         $instance = new SearchOptions();
@@ -121,11 +121,13 @@ class SearchOptions
         foreach ($patterns as $termType => $pattern) {
             $matches = [];
             preg_match_all($pattern, $searchString, $matches);
-            foreach ($matches[1] as $index => $value) {
-                $negated = str_starts_with($matches[0][$index], '-');
-                $terms[$termType][] = $constructors[$termType]($value, $negated);
+            if (count($matches) > 0) {
+                foreach ($matches[1] as $index => $value) {
+                    $negated = str_starts_with($matches[0][$index], '-');
+                    $terms[$termType][] = $constructors[$termType]($value, $negated);
+                }
+                $searchString = preg_replace($pattern, '', $searchString);
             }
-            $searchString = preg_replace($pattern, '', $searchString);
         }
 
         // Unescape exacts and backslash escapes
@@ -259,7 +261,7 @@ class SearchOptions
         $userFilters = ['updated_by', 'created_by', 'owned_by'];
         $unsupportedFilters = ['is_template', 'sort_by'];
         foreach ($this->filters->all() as $filter) {
-            if (in_array($filter->getKey(), $userFilters, true) && $filter->value && $filter->value !== 'me') {
+            if (in_array($filter->getKey(), $userFilters, true) && $filter->value !== null && $filter->value !== 'me') {
                 $options[] = $filter;
             } else if (in_array($filter->getKey(), $unsupportedFilters, true)) {
                 $options[] = $filter;

app/Search/SearchRunner.php

@@ -120,14 +120,8 @@ class SearchRunner
             $filter = function (EloquentBuilder $query) use ($exact) {
                 $inputTerm = str_replace('\\', '\\\\', $exact->value);
                 $query->where('name', 'like', '%' . $inputTerm . '%')
-                    ->orWhere(function (EloquentBuilder $query) use ($inputTerm) {
-                        $query->whereNotNull('description')
-                            ->where('description', 'like', '%' . $inputTerm . '%');
-                    })
-                    ->orWhere(function (EloquentBuilder $query) use ($inputTerm) {
-                        $query->whereNotNull('text')
-                            ->where('text', 'like', '%' . $inputTerm . '%');
-                    });
+                    ->orWhere('description', 'like', '%' . $inputTerm . '%')
+                    ->orWhere('text', 'like', '%' . $inputTerm . '%');
             };
 
             $exact->negated ? $entityQuery->whereNot($filter) : $entityQuery->where($filter);
@@ -290,7 +284,7 @@ class SearchRunner
                 $query->where('name', '=', $tagParts['name']);
             }
 
-            if (is_numeric($tagParts['value']) && is_finite($tagParts['value']) && $tagParts['operator'] !== 'like') {
+            if (is_numeric($tagParts['value']) && $tagParts['operator'] !== 'like') {
                 // We have to do a raw sql query for this since otherwise PDO will quote the value and MySQL will
                 // search the value as a string which prevents being able to do number-based operations
                 // on the tag values. We ensure it has a numeric value and then cast it just to be sure.

app/Settings/AppSettingsStore.php

@@ -44,7 +44,7 @@ class AppSettingsStore
         }
 
         // Clear icon image if requested
-        if ($request->input('app_icon_reset')) {
+        if ($request->get('app_icon_reset')) {
             $this->destroyExistingSettingImage('app-icon');
             setting()->remove('app-icon');
             foreach ($sizes as $size) {
@@ -67,7 +67,7 @@ class AppSettingsStore
         }
 
         // Clear logo image if requested
-        if ($request->input('app_logo_reset')) {
+        if ($request->get('app_logo_reset')) {
             $this->destroyExistingSettingImage('app-logo');
             setting()->remove('app-logo');
         }