Added more complexity in an attempt to make ldap host failover fit

Updated ldap connections to be carried via their own class.
Extracted connection logic to its own class.
Having trouble making this new format testable.

.env.example.complete

@@ -3,10 +3,6 @@
 # Each option is shown with it's default value.
 # Do not copy this whole file to use as your '.env' file.
 
-# The details here only serve as a quick reference.
-# Please refer to the BookStack documentation for full details:
-# https://www.bookstackapp.com/docs/
-
 # Application environment
 # Can be 'production', 'development', 'testing' or 'demo'
 APP_ENV=production
@@ -83,10 +79,6 @@ MAIL_PORT=1025
 MAIL_USERNAME=null
 MAIL_PASSWORD=null
 MAIL_ENCRYPTION=null
-MAIL_VERIFY_SSL=true
-
-# Command to use when email is sent via sendmail
-MAIL_SENDMAIL_COMMAND="/usr/sbin/sendmail -bs"
 
 # Cache & Session driver to use
 # Can be 'file', 'database', 'memcached' or 'redis'
@@ -276,7 +268,6 @@ OIDC_DUMP_USER_DETAILS=false
 OIDC_USER_TO_GROUPS=false
 OIDC_GROUPS_CLAIM=groups
 OIDC_REMOVE_FROM_GROUPS=false
-OIDC_EXTERNAL_ID_CLAIM=sub
 
 # Disable default third-party services such as Gravatar and Draw.IO
 # Service-specific options will override this option
@@ -327,13 +318,6 @@ FILE_UPLOAD_SIZE_LIMIT=50
 # Can be 'a4' or 'letter'.
 EXPORT_PAGE_SIZE=a4
 
-# Set path to wkhtmltopdf binary for PDF generation.
-# Can be 'false' or a path path like: '/home/bins/wkhtmltopdf'
-# When false, BookStack will attempt to find a wkhtmltopdf in the application
-# root folder then fall back to the default dompdf renderer if no binary exists.
-# Only used if 'ALLOW_UNTRUSTED_SERVER_FETCHING=true' which disables security protections.
-WKHTMLTOPDF=false
-
 # Allow <script> tags in page content
 # Note, if set to 'true' the page editor may still escape scripts.
 ALLOW_CONTENT_SCRIPTS=false

.github/translators.txt

@@ -176,7 +176,7 @@ Alexander Predl (Harveyhase68) :: German
 Rem (Rem9000) :: Dutch
 Michał Stelmach (stelmach-web) :: Polish
 arniom :: French
-REMOVED_USER :: ; French; Dutch; Turkish
+REMOVED_USER :: ; Dutch; Turkish
 林祖年 (contagion) :: Chinese Traditional
 Siamak Guodarzi (siamakgoudarzi88) :: Persian
 Lis Maestrelo (lismtrl) :: Portuguese, Brazilian
@@ -280,50 +280,3 @@ DerLinkman (derlinkman) :: German; German Informal
 TurnArabic :: Arabic
 Martin Sebek (sebekmartin) :: Czech
 Kuchinashi Hoshikawa (kuchinashi) :: Chinese Simplified
-digilady :: Greek
-Linus (LinusOP) :: Swedish
-Felipe Cardoso (felipecardosoruff) :: Portuguese, Brazilian
-RandomUser0815 :: German Informal; German
-Ismael Mesquita (mesquitoliveira) :: Portuguese, Brazilian
-구인회 (laskdjlaskdj12) :: Korean
-LiZerui (CNLiZerui) :: Chinese Traditional
-Fabrice Boyer (FabriceBoyer) :: French
-mikael (bitcanon) :: Swedish
-Matthias Mai (schnapsidee) :: German; German Informal
-Ufuk Ayyıldız (ufukayyildiz) :: Turkish
-Jan Mitrof (jan.kachlik) :: Czech
-edwardsmirnov :: Russian
-Mr_OSS117 :: French
-shotu :: French
-Cesar_Lopez_Aguillon :: Spanish
-bdewoop :: German
-dina davoudi (dina.davoudi) :: Persian
-Angelos Chouvardas (achouvardas) :: Greek
-rndrss :: Portuguese, Brazilian
-rirac294 :: Russian
-David Furman (thefourCraft) :: Hebrew
-Pafzedog :: French
-Yllelder :: Spanish
-Adrian Ocneanu (aocneanu) :: Romanian
-Eduardo Castanho (EduardoCastanho) :: Portuguese
-VIET NAM VPS (vietnamvps) :: Vietnamese
-m4tthi4s :: French
-toras9000 :: Japanese
-pathab :: German
-MichelSchoon85 :: Dutch
-Jøran Haugli (haugli92) :: Norwegian Bokmal
-Vasileios Kouvelis (VasilisKouvelis) :: Greek
-Dremski :: Bulgarian
-Frédéric SENE (nothingfr) :: French
-bendem :: French
-kostasdizas :: Greek
-Ricardo Schroeder (brownstone666) :: Portuguese, Brazilian
-Eitan MG (EitanMG) :: Hebrew
-Robin Flikkema (RobinFlikkema) :: Dutch
-Michal Gurcik (mgurcik) :: Slovak
-Pooyan Arab (pooyanarab) :: Persian
-Ochi Darma Putra (troke12) :: Indonesian
-H.-H. Peng (Hsins) :: Chinese Traditional
-Mosi  Wang (mosiwang) :: Chinese Traditional
-骆言 (LawssssCat) :: Chinese Simplified
-Stickers Gaming Shøw (StickerSGSHOW) :: French

.github/workflows/analyse-php.yml

@@ -18,10 +18,10 @@ jobs:
     - name: Get Composer Cache Directory
       id: composer-cache
       run: |
-        echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+        echo "::set-output name=dir::$(composer config cache-files-dir)"
 
     - name: Cache composer packages
-      uses: actions/cache@v3
+      uses: actions/cache@v2
       with:
         path: ${{ steps.composer-cache.outputs.dir }}
         key: ${{ runner.os }}-composer-8.1

.github/workflows/lint-js.yml

@@ -1,16 +0,0 @@
-name: lint-js
-
-on: [push, pull_request]
-
-jobs:
-  build:
-    if: ${{ github.ref != 'refs/heads/l10n_development' }}
-    runs-on: ubuntu-22.04
-    steps:
-    - uses: actions/checkout@v1
-
-    - name: Install NPM deps
-      run: npm ci
-
-    - name: Run formatting check
-      run: npm run lint

.github/workflows/test-migrations.yml

@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-22.04
     strategy:
       matrix:
-        php: ['8.0', '8.1', '8.2']
+        php: ['7.4', '8.0', '8.1']
     steps:
       - uses: actions/checkout@v1
 
@@ -21,10 +21,10 @@ jobs:
       - name: Get Composer Cache Directory
         id: composer-cache
         run: |
-          echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+          echo "::set-output name=dir::$(composer config cache-files-dir)"
 
       - name: Cache composer packages
-        uses: actions/cache@v3
+        uses: actions/cache@v2
         with:
           path: ${{ steps.composer-cache.outputs.dir }}
           key: ${{ runner.os }}-composer-${{ matrix.php }}

.github/workflows/test-php.yml

@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-22.04
     strategy:
       matrix:
-        php: ['8.0', '8.1', '8.2']
+        php: ['7.4', '8.0', '8.1']
     steps:
     - uses: actions/checkout@v1
 
@@ -16,15 +16,15 @@ jobs:
       uses: shivammathur/setup-php@v2
       with:
         php-version: ${{ matrix.php }}
-        extensions: gd, mbstring, json, curl, xml, mysql, ldap, gmp
+        extensions: gd, mbstring, json, curl, xml, mysql, ldap
 
     - name: Get Composer Cache Directory
       id: composer-cache
       run: |
-        echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+        echo "::set-output name=dir::$(composer config cache-files-dir)"
 
     - name: Cache composer packages
-      uses: actions/cache@v3
+      uses: actions/cache@v2
       with:
         path: ${{ steps.composer-cache.outputs.dir }}
         key: ${{ runner.os }}-composer-${{ matrix.php }}

.gitignore

@@ -1,19 +1,16 @@
 /vendor
 /node_modules
-/.vscode
-/composer
 Homestead.yaml
 .env
 .idea
 npm-debug.log
 yarn-error.log
-/public/dist/*.map
+/public/dist
 /public/plugins
-/public/css/*.map
-/public/js/*.map
+/public/css
+/public/js
 /public/bower
 /public/build/
-/public/favicon.ico
 /storage/images
 _ide_helper.php
 /storage/debugbar
@@ -23,10 +20,8 @@ yarn.lock
 nbproject
 .buildpath
 .project
-.nvmrc
 .settings/
 webpack-stats.json
 .phpunit.result.cache
 .DS_Store
-phpstan.neon
-esbuild-meta.json
+phpstan.neon

LICENSE

@@ -1,6 +1,6 @@
 The MIT License (MIT)
 
-Copyright (c) 2015-2023, Dan Brown and the BookStack Project contributors.
+Copyright (c) 2015-2022, Dan Brown and the BookStack Project contributors.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

app/Actions/Activity.php

@@ -2,12 +2,10 @@
 
 namespace BookStack\Actions;
 
-use BookStack\Auth\Permissions\JointPermission;
 use BookStack\Auth\User;
 use BookStack\Entities\Models\Entity;
 use BookStack\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
-use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Database\Eloquent\Relations\MorphTo;
 use Illuminate\Support\Str;
 
@@ -42,12 +40,6 @@ class Activity extends Model
         return $this->belongsTo(User::class);
     }
 
-    public function jointPermissions(): HasMany
-    {
-        return $this->hasMany(JointPermission::class, 'entity_id', 'entity_id')
-            ->whereColumn('activities.entity_type', '=', 'joint_permissions.entity_type');
-    }
-
     /**
      * Returns text from the language files, Looks up by using the activity key.
      */

app/Actions/Favourite.php

@@ -2,9 +2,7 @@
 
 namespace BookStack\Actions;
 
-use BookStack\Auth\Permissions\JointPermission;
 use BookStack\Model;
-use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Database\Eloquent\Relations\MorphTo;
 
 class Favourite extends Model
@@ -18,10 +16,4 @@ class Favourite extends Model
     {
         return $this->morphTo();
     }
-
-    public function jointPermissions(): HasMany
-    {
-        return $this->hasMany(JointPermission::class, 'entity_id', 'favouritable_id')
-            ->whereColumn('favourites.favouritable_type', '=', 'joint_permissions.entity_type');
-    }
 }

app/Actions/Queries/WebhooksAllPaginatedAndSorted.php

@@ -1,30 +0,0 @@
-<?php
-
-namespace BookStack\Actions\Queries;
-
-use BookStack\Actions\Webhook;
-use BookStack\Util\SimpleListOptions;
-use Illuminate\Pagination\LengthAwarePaginator;
-
-/**
- * Get all the webhooks in the system in a paginated format.
- */
-class WebhooksAllPaginatedAndSorted
-{
-    public function run(int $count, SimpleListOptions $listOptions): LengthAwarePaginator
-    {
-        $query = Webhook::query()->select(['*'])
-            ->withCount(['trackedEvents'])
-            ->orderBy($listOptions->getSort(), $listOptions->getOrder());
-
-        if ($listOptions->getSearch()) {
-            $term = '%' . $listOptions->getSearch() . '%';
-            $query->where(function ($query) use ($term) {
-                $query->where('name', 'like', $term)
-                    ->orWhere('endpoint', 'like', $term);
-            });
-        }
-
-        return $query->paginate($count);
-    }
-}

app/Actions/Tag.php

@@ -2,10 +2,8 @@
 
 namespace BookStack\Actions;
 
-use BookStack\Auth\Permissions\JointPermission;
 use BookStack\Model;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Database\Eloquent\Relations\MorphTo;
 
 /**
@@ -29,12 +27,6 @@ class Tag extends Model
         return $this->morphTo('entity');
     }
 
-    public function jointPermissions(): HasMany
-    {
-        return $this->hasMany(JointPermission::class, 'entity_id', 'entity_id')
-            ->whereColumn('tags.entity_type', '=', 'joint_permissions.entity_type');
-    }
-
     /**
      * Get a full URL to start a tag name search for this tag name.
      */

app/Actions/TagRepo.php

@@ -4,29 +4,24 @@ namespace BookStack\Actions;
 
 use BookStack\Auth\Permissions\PermissionApplicator;
 use BookStack\Entities\Models\Entity;
-use BookStack\Util\SimpleListOptions;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\DB;
 
 class TagRepo
 {
-    public function __construct(
-        protected PermissionApplicator $permissions
-    ) {
+    protected PermissionApplicator $permissions;
+
+    public function __construct(PermissionApplicator $permissions)
+    {
+        $this->permissions = $permissions;
     }
 
     /**
      * Start a query against all tags in the system.
      */
-    public function queryWithTotals(SimpleListOptions $listOptions, string $nameFilter): Builder
+    public function queryWithTotals(string $searchTerm, string $nameFilter): Builder
     {
-        $searchTerm = $listOptions->getSearch();
-        $sort = $listOptions->getSort();
-        if ($sort === 'name' && $nameFilter) {
-            $sort = 'value';
-        }
-
         $query = Tag::query()
             ->select([
                 'name',
@@ -37,7 +32,7 @@ class TagRepo
                 DB::raw('SUM(IF(entity_type = \'book\', 1, 0)) as book_count'),
                 DB::raw('SUM(IF(entity_type = \'bookshelf\', 1, 0)) as shelf_count'),
             ])
-            ->orderBy($sort, $listOptions->getOrder());
+            ->orderBy($nameFilter ? 'value' : 'name');
 
         if ($nameFilter) {
             $query->where('name', '=', $nameFilter);
@@ -88,7 +83,6 @@ class TagRepo
     {
         $query = Tag::query()
             ->select('*', DB::raw('count(*) as count'))
-            ->where('value', '!=', '')
             ->groupBy('value');
 
         if ($searchTerm) {

app/Actions/View.php

@@ -2,10 +2,8 @@
 
 namespace BookStack\Actions;
 
-use BookStack\Auth\Permissions\JointPermission;
 use BookStack\Interfaces\Viewable;
 use BookStack\Model;
-use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Database\Eloquent\Relations\MorphTo;
 
 /**
@@ -30,12 +28,6 @@ class View extends Model
         return $this->morphTo();
     }
 
-    public function jointPermissions(): HasMany
-    {
-        return $this->hasMany(JointPermission::class, 'entity_id', 'viewable_id')
-            ->whereColumn('views.viewable_type', '=', 'joint_permissions.entity_type');
-    }
-
     /**
      * Increment the current user's view count for the given viewable model.
      */

app/Api/ListingResponseBuilder.php

@@ -4,29 +4,21 @@ namespace BookStack\Api;
 
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Collection;
-use Illuminate\Database\Eloquent\Model;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 
 class ListingResponseBuilder
 {
-    protected Builder $query;
-    protected Request $request;
-
-    /**
-     * @var string[]
-     */
-    protected array $fields;
+    protected $query;
+    protected $request;
+    protected $fields;
 
     /**
      * @var array<callable>
      */
-    protected array $resultModifiers = [];
+    protected $resultModifiers = [];
 
-    /**
-     * @var array<string, string>
-     */
-    protected array $filterOperators = [
+    protected $filterOperators = [
         'eq'   => '=',
         'ne'   => '!=',
         'gt'   => '>',
@@ -70,9 +62,9 @@ class ListingResponseBuilder
     /**
      * Add a callback to modify each element of the results.
      *
-     * @param (callable(Model): void) $modifier
+     * @param (callable(Model)) $modifier
      */
-    public function modifyResults(callable $modifier): void
+    public function modifyResults($modifier): void
     {
         $this->resultModifiers[] = $modifier;
     }

app/Auth/Access/EmailConfirmationService.php

@@ -8,8 +8,8 @@ use BookStack\Notifications\ConfirmEmail;
 
 class EmailConfirmationService extends UserTokenService
 {
-    protected string $tokenTable = 'email_confirmations';
-    protected int $expiryTime = 24;
+    protected $tokenTable = 'email_confirmations';
+    protected $expiryTime = 24;
 
     /**
      * Create new confirmation for a user,

app/Auth/Access/Guards/LdapSessionGuard.php

@@ -2,7 +2,7 @@
 
 namespace BookStack\Auth\Access\Guards;
 
-use BookStack\Auth\Access\LdapService;
+use BookStack\Auth\Access\Ldap\LdapService;
 use BookStack\Auth\Access\RegistrationService;
 use BookStack\Auth\User;
 use BookStack\Exceptions\JsonDebugException;

app/Auth/Access/Ldap.php

@@ -1,136 +0,0 @@
-<?php
-
-namespace BookStack\Auth\Access;
-
-/**
- * Class Ldap
- * An object-orientated thin abstraction wrapper for common PHP LDAP functions.
- * Allows the standard LDAP functions to be mocked for testing.
- */
-class Ldap
-{
-    /**
-     * Connect to an LDAP server.
-     *
-     * @return resource
-     */
-    public function connect(string $hostName, int $port)
-    {
-        return ldap_connect($hostName, $port);
-    }
-
-    /**
-     * Set the value of a LDAP option for the given connection.
-     *
-     * @param resource $ldapConnection
-     * @param mixed    $value
-     */
-    public function setOption($ldapConnection, int $option, $value): bool
-    {
-        return ldap_set_option($ldapConnection, $option, $value);
-    }
-
-    /**
-     * Start TLS on the given LDAP connection.
-     */
-    public function startTls($ldapConnection): bool
-    {
-        return ldap_start_tls($ldapConnection);
-    }
-
-    /**
-     * Set the version number for the given ldap connection.
-     *
-     * @param resource $ldapConnection
-     */
-    public function setVersion($ldapConnection, int $version): bool
-    {
-        return $this->setOption($ldapConnection, LDAP_OPT_PROTOCOL_VERSION, $version);
-    }
-
-    /**
-     * Search LDAP tree using the provided filter.
-     *
-     * @param resource   $ldapConnection
-     * @param string     $baseDn
-     * @param string     $filter
-     * @param array|null $attributes
-     *
-     * @return resource
-     */
-    public function search($ldapConnection, $baseDn, $filter, array $attributes = null)
-    {
-        return ldap_search($ldapConnection, $baseDn, $filter, $attributes);
-    }
-
-    /**
-     * Get entries from an ldap search result.
-     *
-     * @param resource $ldapConnection
-     * @param resource $ldapSearchResult
-     *
-     * @return array
-     */
-    public function getEntries($ldapConnection, $ldapSearchResult)
-    {
-        return ldap_get_entries($ldapConnection, $ldapSearchResult);
-    }
-
-    /**
-     * Search and get entries immediately.
-     *
-     * @param resource   $ldapConnection
-     * @param string     $baseDn
-     * @param string     $filter
-     * @param array|null $attributes
-     *
-     * @return resource
-     */
-    public function searchAndGetEntries($ldapConnection, $baseDn, $filter, array $attributes = null)
-    {
-        $search = $this->search($ldapConnection, $baseDn, $filter, $attributes);
-
-        return $this->getEntries($ldapConnection, $search);
-    }
-
-    /**
-     * Bind to LDAP directory.
-     *
-     * @param resource $ldapConnection
-     * @param string   $bindRdn
-     * @param string   $bindPassword
-     *
-     * @return bool
-     */
-    public function bind($ldapConnection, $bindRdn = null, $bindPassword = null)
-    {
-        return ldap_bind($ldapConnection, $bindRdn, $bindPassword);
-    }
-
-    /**
-     * Explode a LDAP dn string into an array of components.
-     *
-     * @param string $dn
-     * @param int    $withAttrib
-     *
-     * @return array
-     */
-    public function explodeDn(string $dn, int $withAttrib)
-    {
-        return ldap_explode_dn($dn, $withAttrib);
-    }
-
-    /**
-     * Escape a string for use in an LDAP filter.
-     *
-     * @param string $value
-     * @param string $ignore
-     * @param int    $flags
-     *
-     * @return string
-     */
-    public function escape(string $value, string $ignore = '', int $flags = 0)
-    {
-        return ldap_escape($value, $ignore, $flags);
-    }
-}

app/Auth/Access/Ldap/LdapConfig.php

@@ -0,0 +1,60 @@
+<?php
+
+namespace BookStack\Auth\Access\Ldap;
+
+class LdapConfig
+{
+    /**
+     * App provided config array.
+     * @var array
+     */
+    protected array $config;
+
+    public function __construct(array $config)
+    {
+        $this->config = $config;
+    }
+
+    /**
+     * Get a value from the config.
+     */
+    public function get(string $key)
+    {
+        return $this->config[$key] ?? null;
+    }
+
+    /**
+     * Parse the potentially multi-value LDAP server host string and return an array of host/port detail pairs.
+     * Multiple hosts are separated with a semicolon, for example: 'ldap.example.com:8069;ldaps://ldap.example.com'
+     *
+     * @return array<array{host: string, port: int}>
+     */
+    public function getServers(): array
+    {
+        $serverStringList = explode(';', $this->get('server'));
+
+        return array_map(fn ($serverStr) => $this->parseSingleServerString($serverStr), $serverStringList);
+    }
+
+    /**
+     * Parse an LDAP server string and return the host and port for a connection.
+     * Is flexible to formats such as 'ldap.example.com:8069' or 'ldaps://ldap.example.com'.
+     *
+     * @return array{host: string, port: int}
+     */
+    protected function parseSingleServerString(string $serverString): array
+    {
+        $serverNameParts = explode(':', trim($serverString));
+
+        // If we have a protocol just return the full string since PHP will ignore a separate port.
+        if ($serverNameParts[0] === 'ldaps' || $serverNameParts[0] === 'ldap') {
+            return ['host' => $serverString, 'port' => 389];
+        }
+
+        // Otherwise, extract the port out
+        $hostName = $serverNameParts[0];
+        $ldapPort = (count($serverNameParts) > 1) ? intval($serverNameParts[1]) : 389;
+
+        return ['host' => $hostName, 'port' => $ldapPort];
+    }
+}

app/Auth/Access/Ldap/LdapConnection.php

@@ -0,0 +1,135 @@
+<?php
+
+namespace BookStack\Auth\Access\Ldap;
+
+use ErrorException;
+
+/**
+ * An object-orientated wrapper for core ldap functions,
+ * holding an internal connection instance.
+ */
+class LdapConnection
+{
+    /**
+     * The core ldap connection resource.
+     * @var resource
+     */
+    protected $connection;
+
+    protected string $hostName;
+    protected int $port;
+
+    public function __construct(string $hostName, int $port)
+    {
+        $this->hostName = $hostName;
+        $this->port = $port;
+        $this->connection = $this->connect();
+    }
+
+    /**
+     * Start a connection to an LDAP server.
+     * Does not actually call out to the external server until an action is performed.
+     *
+     * @return resource
+     */
+    protected function connect()
+    {
+        return ldap_connect($this->hostName, $this->port);
+    }
+
+    /**
+     * Set the value of a LDAP option for the current connection.
+     *
+     * @param mixed    $value
+     */
+    public function setOption(int $option, $value): bool
+    {
+        return ldap_set_option($this->connection, $option, $value);
+    }
+
+    /**
+     * Start TLS for this LDAP connection.
+     */
+    public function startTls(): bool
+    {
+        return ldap_start_tls($this->connection);
+    }
+
+    /**
+     * Set the version number for this ldap connection.
+     */
+    public function setVersion(int $version): bool
+    {
+        return $this->setOption(LDAP_OPT_PROTOCOL_VERSION, $version);
+    }
+
+    /**
+     * Search LDAP tree using the provided filter.
+     *
+     * @return resource
+     */
+    public function search(string $baseDn, string $filter, array $attributes = null)
+    {
+        return ldap_search($this->connection, $baseDn, $filter, $attributes);
+    }
+
+    /**
+     * Get entries from an ldap search result.
+     *
+     * @param resource $ldapSearchResult
+     * @return array|false
+     */
+    public function getEntries($ldapSearchResult)
+    {
+        return ldap_get_entries($this->connection, $ldapSearchResult);
+    }
+
+    /**
+     * Search and get entries immediately.
+     *
+     * @return array|false
+     */
+    public function searchAndGetEntries(string $baseDn, string $filter, array $attributes = null)
+    {
+        $search = $this->search($baseDn, $filter, $attributes);
+
+        return $this->getEntries($search);
+    }
+
+    /**
+     * Bind to LDAP directory.
+     *
+     * @throws ErrorException
+     */
+    public function bind(string $bindRdn = null, string $bindPassword = null): bool
+    {
+        return ldap_bind($this->connection, $bindRdn, $bindPassword);
+    }
+
+    /**
+     * Explode a LDAP dn string into an array of components.
+     *
+     * @return array|false
+     */
+    public static function explodeDn(string $dn, int $withAttrib)
+    {
+        return ldap_explode_dn($dn, $withAttrib);
+    }
+
+    /**
+     * Escape a string for use in an LDAP filter.
+     */
+    public static function escape(string $value, string $ignore = '', int $flags = 0): string
+    {
+        return ldap_escape($value, $ignore, $flags);
+    }
+
+    /**
+     * Set a non-connection-specific LDAP option.
+     * @param mixed $value
+     */
+    public static function setGlobalOption(int $option, $value): bool
+    {
+        return ldap_set_option(null, $option, $value);
+    }
+}

app/Auth/Access/Ldap/LdapConnectionManager.php

@@ -0,0 +1,121 @@
+<?php
+
+namespace BookStack\Auth\Access\Ldap;
+
+use BookStack\Exceptions\LdapException;
+use BookStack\Exceptions\LdapFailedBindException;
+use ErrorException;
+use Illuminate\Support\Facades\Log;
+
+class LdapConnectionManager
+{
+    protected array $connectionCache = [];
+
+    /**
+     * Attempt to start and bind to a new LDAP connection as the configured LDAP system user.
+     */
+    public function startSystemBind(LdapConfig $config): LdapConnection
+    {
+        // Incoming options are string|false
+        $dn = $config->get('dn');
+        $pass = $config->get('pass');
+
+        $isAnonymous = ($dn === false || $pass === false);
+
+        try {
+            return $this->startBind($dn ?: null, $pass ?: null, $config);
+        } catch (LdapFailedBindException $exception) {
+            $msg = ($isAnonymous ? trans('errors.ldap_fail_anonymous') : trans('errors.ldap_fail_authed'));
+            throw new LdapFailedBindException($msg);
+        }
+    }
+
+    /**
+     * Attempt to start and bind to a new LDAP connection.
+     * Will attempt against multiple defined fail-over hosts if set in the provided config.
+     *
+     * Throws a LdapFailedBindException error if the bind connected but failed.
+     * Otherwise, generic LdapException errors would be thrown.
+     *
+     * @throws LdapException
+     */
+    public function startBind(?string $dn, ?string $password, LdapConfig $config): LdapConnection
+    {
+        // Check LDAP extension in installed
+        if (!function_exists('ldap_connect') && config('app.env') !== 'testing') {
+            throw new LdapException(trans('errors.ldap_extension_not_installed'));
+        }
+
+        // Disable certificate verification.
+        // This option works globally and must be set before a connection is created.
+        if ($config->get('tls_insecure')) {
+            LdapConnection::setGlobalOption(LDAP_OPT_X_TLS_REQUIRE_CERT, LDAP_OPT_X_TLS_NEVER);
+        }
+
+        $serverDetails = $config->getServers();
+        $lastException = null;
+
+        foreach ($serverDetails as $server) {
+            try {
+                $connection = $this->startServerConnection($server['host'], $server['port'], $config);
+            } catch (LdapException $exception) {
+                $lastException = $exception;
+                continue;
+            }
+
+            try {
+                $bound = $connection->bind($dn, $password);
+                if (!$bound) {
+                    throw new LdapFailedBindException('Failed to perform LDAP bind');
+                }
+            } catch (ErrorException $exception) {
+                Log::error('LDAP bind error: ' . $exception->getMessage());
+                $lastException = new LdapException('Encountered error during LDAP bind');
+                continue;
+            }
+
+            $this->connectionCache[$server['host'] . ':' . $server['port']] = $connection;
+            return $connection;
+        }
+
+        throw $lastException;
+    }
+
+    /**
+     * Attempt to start a server connection from the provided details.
+     * @throws LdapException
+     */
+    protected function startServerConnection(string $host, int $port, LdapConfig $config): LdapConnection
+    {
+        if (isset($this->connectionCache[$host . ':' . $port])) {
+            return $this->connectionCache[$host . ':' . $port];
+        }
+
+        /** @var LdapConnection $ldapConnection */
+        $ldapConnection = app()->make(LdapConnection::class, [$host, $port]);
+
+        if (!$ldapConnection) {
+            throw new LdapException(trans('errors.ldap_cannot_connect'));
+        }
+
+        // Set any required options
+        if ($config->get('version')) {
+            $ldapConnection->setVersion($config->get('version'));
+        }
+
+        // Start and verify TLS if it's enabled
+        if ($config->get('start_tls')) {
+            try {
+                $tlsStarted = $ldapConnection->startTls();
+            } catch (ErrorException $exception) {
+                $tlsStarted = false;
+            }
+
+            if (!$tlsStarted) {
+                throw new LdapException('Could not start TLS connection');
+            }
+        }
+
+        return $ldapConnection;
+    }
+}

app/Auth/Access/Ldap/LdapService.php

@@ -1,12 +1,13 @@
 <?php
 
-namespace BookStack\Auth\Access;
+namespace BookStack\Auth\Access\Ldap;
 
+use BookStack\Auth\Access\GroupSyncService;
 use BookStack\Auth\User;
 use BookStack\Exceptions\JsonDebugException;
 use BookStack\Exceptions\LdapException;
+use BookStack\Exceptions\LdapFailedBindException;
 use BookStack\Uploads\UserAvatars;
-use ErrorException;
 use Illuminate\Support\Facades\Log;
 
 /**
@@ -15,36 +16,18 @@ use Illuminate\Support\Facades\Log;
  */
 class LdapService
 {
-    protected Ldap $ldap;
+    protected LdapConnectionManager $ldap;
     protected GroupSyncService $groupSyncService;
     protected UserAvatars $userAvatars;
 
-    /**
-     * @var resource
-     */
-    protected $ldapConnection;
+    protected LdapConfig $config;
 
-    protected array $config;
-    protected bool $enabled;
-
-    /**
-     * LdapService constructor.
-     */
-    public function __construct(Ldap $ldap, UserAvatars $userAvatars, GroupSyncService $groupSyncService)
+    public function __construct(LdapConnectionManager $ldap, UserAvatars $userAvatars, GroupSyncService $groupSyncService)
     {
         $this->ldap = $ldap;
         $this->userAvatars = $userAvatars;
         $this->groupSyncService = $groupSyncService;
-        $this->config = config('services.ldap');
-        $this->enabled = config('auth.method') === 'ldap';
-    }
-
-    /**
-     * Check if groups should be synced.
-     */
-    public function shouldSyncGroups(): bool
-    {
-        return $this->enabled && $this->config['user_to_groups'] !== false;
+        $this->config = new LdapConfig(config('services.ldap'));
     }
 
     /**
@@ -52,10 +35,9 @@ class LdapService
      *
      * @throws LdapException
      */
-    private function getUserWithAttributes(string $userName, array $attributes): ?array
+    protected function getUserWithAttributes(string $userName, array $attributes): ?array
     {
-        $ldapConnection = $this->getConnection();
-        $this->bindSystemUser($ldapConnection);
+        $connection = $this->ldap->startSystemBind($this->config);
 
         // Clean attributes
         foreach ($attributes as $index => $attribute) {
@@ -65,12 +47,12 @@ class LdapService
         }
 
         // Find user
-        $userFilter = $this->buildFilter($this->config['user_filter'], ['user' => $userName]);
-        $baseDn = $this->config['base_dn'];
+        $userFilter = $this->buildFilter($this->config->get('user_filter'), ['user' => $userName]);
+        $baseDn = $this->config->get('base_dn');
 
-        $followReferrals = $this->config['follow_referrals'] ? 1 : 0;
-        $this->ldap->setOption($ldapConnection, LDAP_OPT_REFERRALS, $followReferrals);
-        $users = $this->ldap->searchAndGetEntries($ldapConnection, $baseDn, $userFilter, $attributes);
+        $followReferrals = $this->config->get('follow_referrals') ? 1 : 0;
+        $connection->setOption(LDAP_OPT_REFERRALS, $followReferrals);
+        $users = $connection->searchAndGetEntries($baseDn, $userFilter, $attributes);
         if ($users['count'] === 0) {
             return null;
         }
@@ -86,10 +68,10 @@ class LdapService
      */
     public function getUserDetails(string $userName): ?array
     {
-        $idAttr = $this->config['id_attribute'];
-        $emailAttr = $this->config['email_attribute'];
-        $displayNameAttr = $this->config['display_name_attribute'];
-        $thumbnailAttr = $this->config['thumbnail_attribute'];
+        $idAttr = $this->config->get('id_attribute');
+        $emailAttr = $this->config->get('email_attribute');
+        $displayNameAttr = $this->config->get('display_name_attribute');
+        $thumbnailAttr = $this->config->get('thumbnail_attribute');
 
         $user = $this->getUserWithAttributes($userName, array_filter([
             'cn', 'dn', $idAttr, $emailAttr, $displayNameAttr, $thumbnailAttr,
@@ -108,7 +90,7 @@ class LdapService
             'avatar' => $thumbnailAttr ? $this->getUserResponseProperty($user, $thumbnailAttr, null) : null,
         ];
 
-        if ($this->config['dump_user_details']) {
+        if ($this->config->get('dump_user_details')) {
             throw new JsonDebugException([
                 'details_from_ldap'        => $user,
                 'details_bookstack_parsed' => $formatted,
@@ -155,110 +137,15 @@ class LdapService
             return false;
         }
 
-        $ldapConnection = $this->getConnection();
-
         try {
-            $ldapBind = $this->ldap->bind($ldapConnection, $ldapUserDetails['dn'], $password);
-        } catch (ErrorException $e) {
-            $ldapBind = false;
+            $this->ldap->startBind($ldapUserDetails['dn'], $password, $this->config);
+        } catch (LdapFailedBindException $e) {
+            return false;
+        } catch (LdapException $e) {
+            throw $e;
         }
 
-        return $ldapBind;
-    }
-
-    /**
-     * Bind the system user to the LDAP connection using the given credentials
-     * otherwise anonymous access is attempted.
-     *
-     * @param resource $connection
-     *
-     * @throws LdapException
-     */
-    protected function bindSystemUser($connection)
-    {
-        $ldapDn = $this->config['dn'];
-        $ldapPass = $this->config['pass'];
-
-        $isAnonymous = ($ldapDn === false || $ldapPass === false);
-        if ($isAnonymous) {
-            $ldapBind = $this->ldap->bind($connection);
-        } else {
-            $ldapBind = $this->ldap->bind($connection, $ldapDn, $ldapPass);
-        }
-
-        if (!$ldapBind) {
-            throw new LdapException(($isAnonymous ? trans('errors.ldap_fail_anonymous') : trans('errors.ldap_fail_authed')));
-        }
-    }
-
-    /**
-     * Get the connection to the LDAP server.
-     * Creates a new connection if one does not exist.
-     *
-     * @throws LdapException
-     *
-     * @return resource
-     */
-    protected function getConnection()
-    {
-        if ($this->ldapConnection !== null) {
-            return $this->ldapConnection;
-        }
-
-        // Check LDAP extension in installed
-        if (!function_exists('ldap_connect') && config('app.env') !== 'testing') {
-            throw new LdapException(trans('errors.ldap_extension_not_installed'));
-        }
-
-        // Disable certificate verification.
-        // This option works globally and must be set before a connection is created.
-        if ($this->config['tls_insecure']) {
-            $this->ldap->setOption(null, LDAP_OPT_X_TLS_REQUIRE_CERT, LDAP_OPT_X_TLS_NEVER);
-        }
-
-        $serverDetails = $this->parseServerString($this->config['server']);
-        $ldapConnection = $this->ldap->connect($serverDetails['host'], $serverDetails['port']);
-
-        if ($ldapConnection === false) {
-            throw new LdapException(trans('errors.ldap_cannot_connect'));
-        }
-
-        // Set any required options
-        if ($this->config['version']) {
-            $this->ldap->setVersion($ldapConnection, $this->config['version']);
-        }
-
-        // Start and verify TLS if it's enabled
-        if ($this->config['start_tls']) {
-            $started = $this->ldap->startTls($ldapConnection);
-            if (!$started) {
-                throw new LdapException('Could not start TLS connection');
-            }
-        }
-
-        $this->ldapConnection = $ldapConnection;
-
-        return $this->ldapConnection;
-    }
-
-    /**
-     * Parse a LDAP server string and return the host and port for a connection.
-     * Is flexible to formats such as 'ldap.example.com:8069' or 'ldaps://ldap.example.com'.
-     */
-    protected function parseServerString(string $serverString): array
-    {
-        $serverNameParts = explode(':', $serverString);
-
-        // If we have a protocol just return the full string since PHP will ignore a separate port.
-        if ($serverNameParts[0] === 'ldaps' || $serverNameParts[0] === 'ldap') {
-            return ['host' => $serverString, 'port' => 389];
-        }
-
-        // Otherwise, extract the port out
-        $hostName = $serverNameParts[0];
-        $ldapPort = (count($serverNameParts) > 1) ? intval($serverNameParts[1]) : 389;
-
-        return ['host' => $hostName, 'port' => $ldapPort];
+        return true;
     }
 
     /**
@@ -269,7 +156,7 @@ class LdapService
         $newAttrs = [];
         foreach ($attrs as $key => $attrText) {
             $newKey = '${' . $key . '}';
-            $newAttrs[$newKey] = $this->ldap->escape($attrText);
+            $newAttrs[$newKey] = LdapConnection::escape($attrText);
         }
 
         return strtr($filterString, $newAttrs);
@@ -283,7 +170,7 @@ class LdapService
      */
     public function getUserGroups(string $userName): array
     {
-        $groupsAttr = $this->config['group_attribute'];
+        $groupsAttr = $this->config->get('group_attribute');
         $user = $this->getUserWithAttributes($userName, [$groupsAttr]);
 
         if ($user === null) {
@@ -293,7 +180,7 @@ class LdapService
         $userGroups = $this->groupFilter($user);
         $allGroups = $this->getGroupsRecursive($userGroups, []);
 
-        if ($this->config['dump_user_groups']) {
+        if ($this->config->get('dump_user_groups')) {
             throw new JsonDebugException([
                 'details_from_ldap'             => $user,
                 'parsed_direct_user_groups'     => $userGroups,
@@ -338,17 +225,16 @@ class LdapService
      */
     private function getGroupGroups(string $groupName): array
     {
-        $ldapConnection = $this->getConnection();
-        $this->bindSystemUser($ldapConnection);
+        $connection = $this->ldap->startSystemBind($this->config);
 
-        $followReferrals = $this->config['follow_referrals'] ? 1 : 0;
-        $this->ldap->setOption($ldapConnection, LDAP_OPT_REFERRALS, $followReferrals);
+        $followReferrals = $this->config->get('follow_referrals') ? 1 : 0;
+        $connection->setOption(LDAP_OPT_REFERRALS, $followReferrals);
 
-        $baseDn = $this->config['base_dn'];
-        $groupsAttr = strtolower($this->config['group_attribute']);
+        $baseDn = $this->config->get('base_dn');
+        $groupsAttr = strtolower($this->config->get('group_attribute'));
 
-        $groupFilter = 'CN=' . $this->ldap->escape($groupName);
-        $groups = $this->ldap->searchAndGetEntries($ldapConnection, $baseDn, $groupFilter, [$groupsAttr]);
+        $groupFilter = 'CN=' . LdapConnection::escape($groupName);
+        $groups = $connection->searchAndGetEntries($baseDn, $groupFilter, [$groupsAttr]);
         if ($groups['count'] === 0) {
             return [];
         }
@@ -362,7 +248,7 @@ class LdapService
      */
     protected function groupFilter(array $userGroupSearchResponse): array
     {
-        $groupsAttr = strtolower($this->config['group_attribute']);
+        $groupsAttr = strtolower($this->config->get('group_attribute'));
         $ldapGroups = [];
         $count = 0;
 
@@ -371,7 +257,7 @@ class LdapService
         }
 
         for ($i = 0; $i < $count; $i++) {
-            $dnComponents = $this->ldap->explodeDn($userGroupSearchResponse[$groupsAttr][$i], 1);
+            $dnComponents = LdapConnection::explodeDn($userGroupSearchResponse[$groupsAttr][$i], 1);
             if (!in_array($dnComponents[0], $ldapGroups)) {
                 $ldapGroups[] = $dnComponents[0];
             }
@@ -389,7 +275,15 @@ class LdapService
     public function syncGroups(User $user, string $username)
     {
         $userLdapGroups = $this->getUserGroups($username);
-        $this->groupSyncService->syncUserWithFoundGroups($user, $userLdapGroups, $this->config['remove_from_groups']);
+        $this->groupSyncService->syncUserWithFoundGroups($user, $userLdapGroups, $this->config->get('remove_from_groups'));
+    }
+
+    /**
+     * Check if groups should be synced.
+     */
+    public function shouldSyncGroups(): bool
+    {
+        return $this->config->get('user_to_groups') !== false;
     }
 
     /**
@@ -398,7 +292,7 @@ class LdapService
      */
     public function saveAndAttachAvatar(User $user, array $ldapUserDetails): void
     {
-        if (is_null(config('services.ldap.thumbnail_attribute')) || is_null($ldapUserDetails['avatar'])) {
+        if (is_null($this->config->get('thumbnail_attribute')) || is_null($ldapUserDetails['avatar'])) {
             return;
         }
 

app/Auth/Access/Oidc/OidcIdToken.php

@@ -4,16 +4,35 @@ namespace BookStack\Auth\Access\Oidc;
 
 class OidcIdToken
 {
-    protected array $header;
-    protected array $payload;
-    protected string $signature;
-    protected string $issuer;
-    protected array $tokenParts = [];
+    /**
+     * @var array
+     */
+    protected $header;
+
+    /**
+     * @var array
+     */
+    protected $payload;
+
+    /**
+     * @var string
+     */
+    protected $signature;
 
     /**
      * @var array[]|string[]
      */
-    protected array $keys;
+    protected $keys;
+
+    /**
+     * @var string
+     */
+    protected $issuer;
+
+    /**
+     * @var array
+     */
+    protected $tokenParts = [];
 
     public function __construct(string $token, string $issuer, array $keys)
     {
@@ -87,14 +106,6 @@ class OidcIdToken
         return $this->payload;
     }
 
-    /**
-     * Replace the existing claim data of this token with that provided.
-     */
-    public function replaceClaims(array $claims): void
-    {
-        $this->payload = $claims;
-    }
-
     /**
      * Validate the structure of the given token and ensure we have the required pieces.
      * As per https://datatracker.ietf.org/doc/html/rfc7519#section-7.2.

app/Auth/Access/Oidc/OidcJwtSigningKey.php

@@ -67,10 +67,11 @@ class OidcJwtSigningKey
             throw new OidcInvalidKeyException("Only RS256 keys are currently supported. Found key using {$alg}");
         }
 
-        // 'use' is optional for a JWK but we assume 'sig' where no value exists since that's what
-        // the OIDC discovery spec infers since 'sig' MUST be set if encryption keys come into play.
-        $use = $jwk['use'] ?? 'sig';
-        if ($use !== 'sig') {
+        if (empty($jwk['use'])) {
+            throw new OidcInvalidKeyException('A "use" parameter on the provided key is expected');
+        }
+
+        if ($jwk['use'] !== 'sig') {
             throw new OidcInvalidKeyException("Only signature keys are currently supported. Found key for use {$jwk['use']}");
         }
 

app/Auth/Access/Oidc/OidcProviderSettings.php

@@ -15,17 +15,40 @@ use Psr\Http\Client\ClientInterface;
  */
 class OidcProviderSettings
 {
-    public string $issuer;
-    public string $clientId;
-    public string $clientSecret;
-    public ?string $redirectUri;
-    public ?string $authorizationEndpoint;
-    public ?string $tokenEndpoint;
+    /**
+     * @var string
+     */
+    public $issuer;
+
+    /**
+     * @var string
+     */
+    public $clientId;
+
+    /**
+     * @var string
+     */
+    public $clientSecret;
+
+    /**
+     * @var string
+     */
+    public $redirectUri;
+
+    /**
+     * @var string
+     */
+    public $authorizationEndpoint;
+
+    /**
+     * @var string
+     */
+    public $tokenEndpoint;
 
     /**
      * @var string[]|array[]
      */
-    public ?array $keys = [];
+    public $keys = [];
 
     public function __construct(array $settings)
     {
@@ -141,10 +164,9 @@ class OidcProviderSettings
     protected function filterKeys(array $keys): array
     {
         return array_filter($keys, function (array $key) {
-            $alg = $key['alg'] ?? 'RS256';
-            $use = $key['use'] ?? 'sig';
+            $alg = $key['alg'] ?? null;
 
-            return $key['kty'] === 'RSA' && $use === 'sig' && $alg === 'RS256';
+            return $key['kty'] === 'RSA' && $key['use'] === 'sig' && (is_null($alg) || $alg === 'RS256');
         });
     }
 

app/Auth/Access/Oidc/OidcService.php

@@ -9,8 +9,6 @@ use BookStack\Auth\User;
 use BookStack\Exceptions\JsonDebugException;
 use BookStack\Exceptions\StoppedAuthenticationException;
 use BookStack\Exceptions\UserRegistrationException;
-use BookStack\Facades\Theme;
-use BookStack\Theming\ThemeEvents;
 use Illuminate\Support\Arr;
 use Illuminate\Support\Facades\Cache;
 use League\OAuth2\Client\OptionProvider\HttpBasicAuthOptionProvider;
@@ -23,12 +21,24 @@ use Psr\Http\Client\ClientInterface as HttpClient;
  */
 class OidcService
 {
+    protected RegistrationService $registrationService;
+    protected LoginService $loginService;
+    protected HttpClient $httpClient;
+    protected GroupSyncService $groupService;
+
+    /**
+     * OpenIdService constructor.
+     */
     public function __construct(
-        protected RegistrationService $registrationService,
-        protected LoginService $loginService,
-        protected HttpClient $httpClient,
-        protected GroupSyncService $groupService
+        RegistrationService $registrationService,
+        LoginService $loginService,
+        HttpClient $httpClient,
+        GroupSyncService $groupService
     ) {
+        $this->registrationService = $registrationService;
+        $this->loginService = $loginService;
+        $this->httpClient = $httpClient;
+        $this->groupService = $groupService;
     }
 
     /**
@@ -42,6 +52,7 @@ class OidcService
     {
         $settings = $this->getProviderSettings();
         $provider = $this->getProvider($settings);
+
         return [
             'url'   => $provider->getAuthorizationUrl(),
             'state' => $provider->getState(),
@@ -188,8 +199,7 @@ class OidcService
      */
     protected function getUserDetails(OidcIdToken $token): array
     {
-        $idClaim = $this->config()['external_id_claim'];
-        $id = $token->getClaim($idClaim);
+        $id = $token->getClaim('sub');
 
         return [
             'external_id' => $id,
@@ -216,16 +226,6 @@ class OidcService
             $settings->keys,
         );
 
-        $returnClaims = Theme::dispatch(ThemeEvents::OIDC_ID_TOKEN_PRE_VALIDATE, $idToken->getAllClaims(), [
-            'access_token' => $accessToken->getToken(),
-            'expires_in' => $accessToken->getExpires(),
-            'refresh_token' => $accessToken->getRefreshToken(),
-        ]);
-
-        if (!is_null($returnClaims)) {
-            $idToken->replaceClaims($returnClaims);
-        }
-
         if ($this->config()['dump_user_details']) {
             throw new JsonDebugException($idToken->getAllClaims());
         }

app/Auth/Access/Saml2Service.php

@@ -67,7 +67,7 @@ class Saml2Service
                 $returnRoute,
                 [],
                 $user->email,
-                session()->get('saml2_session_index'),
+                null,
                 true,
                 Constants::NAMEID_EMAIL_ADDRESS
             );
@@ -118,7 +118,6 @@ class Saml2Service
 
         $attrs = $toolkit->getAttributes();
         $id = $toolkit->getNameId();
-        session()->put('saml2_session_index', $toolkit->getSessionIndex());
 
         return $this->processLoginCallback($id, $attrs);
     }

app/Auth/Access/UserInviteService.php

@@ -7,12 +7,14 @@ use BookStack\Notifications\UserInvite;
 
 class UserInviteService extends UserTokenService
 {
-    protected string $tokenTable = 'user_invites';
-    protected int $expiryTime = 336; // Two weeks
+    protected $tokenTable = 'user_invites';
+    protected $expiryTime = 336; // Two weeks
 
     /**
      * Send an invitation to a user to sign into BookStack
      * Removes existing invitation tokens.
+     *
+     * @param User $user
      */
     public function sendInvitation(User $user)
     {

app/Auth/Access/UserTokenService.php

@@ -14,29 +14,41 @@ class UserTokenService
 {
     /**
      * Name of table where user tokens are stored.
+     *
+     * @var string
      */
-    protected string $tokenTable = 'user_tokens';
+    protected $tokenTable = 'user_tokens';
 
     /**
      * Token expiry time in hours.
+     *
+     * @var int
      */
-    protected int $expiryTime = 24;
+    protected $expiryTime = 24;
 
     /**
-     * Delete all tokens that belong to a user.
+     * Delete all email confirmations that belong to a user.
+     *
+     * @param User $user
+     *
+     * @return mixed
      */
-    public function deleteByUser(User $user): void
+    public function deleteByUser(User $user)
     {
-        DB::table($this->tokenTable)
+        return DB::table($this->tokenTable)
             ->where('user_id', '=', $user->id)
             ->delete();
     }
 
     /**
-     * Get the user id from a token, while checking the token exists and has not expired.
+     * Get the user id from a token, while check the token exists and has not expired.
+     *
+     * @param string $token
      *
      * @throws UserTokenNotFoundException
      * @throws UserTokenExpiredException
+     *
+     * @return int
      */
     public function checkTokenAndGetUserId(string $token): int
     {
@@ -55,6 +67,8 @@ class UserTokenService
 
     /**
      * Creates a unique token within the email confirmation database.
+     *
+     * @return string
      */
     protected function generateToken(): string
     {
@@ -68,6 +82,10 @@ class UserTokenService
 
     /**
      * Generate and store a token for the given user.
+     *
+     * @param User $user
+     *
+     * @return string
      */
     protected function createTokenForUser(User $user): string
     {
@@ -84,6 +102,10 @@ class UserTokenService
 
     /**
      * Check if the given token exists.
+     *
+     * @param string $token
+     *
+     * @return bool
      */
     protected function tokenExists(string $token): bool
     {
@@ -93,8 +115,12 @@ class UserTokenService
 
     /**
      * Get a token entry for the given token.
+     *
+     * @param string $token
+     *
+     * @return object|null
      */
-    protected function getEntryByToken(string $token): ?stdClass
+    protected function getEntryByToken(string $token)
     {
         return DB::table($this->tokenTable)
             ->where('token', '=', $token)
@@ -103,6 +129,10 @@ class UserTokenService
 
     /**
      * Check if the given token entry has expired.
+     *
+     * @param stdClass $tokenEntry
+     *
+     * @return bool
      */
     protected function entryExpired(stdClass $tokenEntry): bool
     {

app/Auth/Permissions/EntityPermission.php

@@ -5,6 +5,7 @@ namespace BookStack\Auth\Permissions;
 use BookStack\Auth\Role;
 use BookStack\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\MorphTo;
 
 /**
  * @property int $id
@@ -22,14 +23,14 @@ class EntityPermission extends Model
 
     protected $fillable = ['role_id', 'view', 'create', 'update', 'delete'];
     public $timestamps = false;
-    protected $hidden = ['entity_id', 'entity_type', 'id'];
-    protected $casts = [
-        'view' => 'boolean',
-        'create' => 'boolean',
-        'read' => 'boolean',
-        'update' => 'boolean',
-        'delete' => 'boolean',
-    ];
+
+    /**
+     * Get this restriction's attached entity.
+     */
+    public function restrictable(): MorphTo
+    {
+        return $this->morphTo('restrictable');
+    }
 
     /**
      * Get the role assigned to this entity permission.

app/Auth/Permissions/EntityPermissionEvaluator.php

@@ -1,141 +0,0 @@
-<?php
-
-namespace BookStack\Auth\Permissions;
-
-use BookStack\Auth\Role;
-use BookStack\Entities\Models\Entity;
-use Illuminate\Database\Eloquent\Builder;
-
-class EntityPermissionEvaluator
-{
-    protected string $action;
-
-    public function __construct(string $action)
-    {
-        $this->action = $action;
-    }
-
-    public function evaluateEntityForUser(Entity $entity, array $userRoleIds): ?bool
-    {
-        if ($this->isUserSystemAdmin($userRoleIds)) {
-            return true;
-        }
-
-        $typeIdChain = $this->gatherEntityChainTypeIds(SimpleEntityData::fromEntity($entity));
-        $relevantPermissions = $this->getPermissionsMapByTypeId($typeIdChain, [...$userRoleIds, 0]);
-        $permitsByType = $this->collapseAndCategorisePermissions($typeIdChain, $relevantPermissions);
-
-        $status = $this->evaluatePermitsByType($permitsByType);
-
-        return is_null($status) ? null : $status === PermissionStatus::IMPLICIT_ALLOW || $status === PermissionStatus::EXPLICIT_ALLOW;
-    }
-
-    /**
-     * @param array<string, array<string, int>> $permitsByType
-     */
-    protected function evaluatePermitsByType(array $permitsByType): ?int
-    {
-        // Return grant or reject from role-level if exists
-        if (count($permitsByType['role']) > 0) {
-            return max($permitsByType['role']) ? PermissionStatus::EXPLICIT_ALLOW : PermissionStatus::EXPLICIT_DENY;
-        }
-
-        // Return fallback permission if exists
-        if (count($permitsByType['fallback']) > 0) {
-            return $permitsByType['fallback'][0] ? PermissionStatus::IMPLICIT_ALLOW : PermissionStatus::IMPLICIT_DENY;
-        }
-
-        return null;
-    }
-
-    /**
-     * @param string[] $typeIdChain
-     * @param array<string, EntityPermission[]> $permissionMapByTypeId
-     * @return array<string, array<string, int>>
-     */
-    protected function collapseAndCategorisePermissions(array $typeIdChain, array $permissionMapByTypeId): array
-    {
-        $permitsByType = ['fallback' => [], 'role' => []];
-
-        foreach ($typeIdChain as $typeId) {
-            $permissions = $permissionMapByTypeId[$typeId] ?? [];
-            foreach ($permissions as $permission) {
-                $roleId = $permission->role_id;
-                $type = $roleId === 0 ? 'fallback' : 'role';
-                if (!isset($permitsByType[$type][$roleId])) {
-                    $permitsByType[$type][$roleId] = $permission->{$this->action};
-                }
-            }
-
-            if (isset($permitsByType['fallback'][0])) {
-                break;
-            }
-        }
-
-        return $permitsByType;
-    }
-
-    /**
-     * @param string[] $typeIdChain
-     * @return array<string, EntityPermission[]>
-     */
-    protected function getPermissionsMapByTypeId(array $typeIdChain, array $filterRoleIds): array
-    {
-        $query = EntityPermission::query()->where(function (Builder $query) use ($typeIdChain) {
-            foreach ($typeIdChain as $typeId) {
-                $query->orWhere(function (Builder $query) use ($typeId) {
-                    [$type, $id] = explode(':', $typeId);
-                    $query->where('entity_type', '=', $type)
-                        ->where('entity_id', '=', $id);
-                });
-            }
-        });
-
-        if (!empty($filterRoleIds)) {
-            $query->where(function (Builder $query) use ($filterRoleIds) {
-                $query->whereIn('role_id', [...$filterRoleIds, 0]);
-            });
-        }
-
-        $relevantPermissions = $query->get(['entity_id', 'entity_type', 'role_id', $this->action])->all();
-
-        $map = [];
-        foreach ($relevantPermissions as $permission) {
-            $key = $permission->entity_type . ':' . $permission->entity_id;
-            if (!isset($map[$key])) {
-                $map[$key] = [];
-            }
-
-            $map[$key][] = $permission;
-        }
-
-        return $map;
-    }
-
-    /**
-     * @return string[]
-     */
-    protected function gatherEntityChainTypeIds(SimpleEntityData $entity): array
-    {
-        // The array order here is very important due to the fact we walk up the chain
-        // elsewhere in the class. Earlier items in the chain have higher priority.
-
-        $chain = [$entity->type . ':' . $entity->id];
-
-        if ($entity->type === 'page' && $entity->chapter_id) {
-            $chain[] = 'chapter:' . $entity->chapter_id;
-        }
-
-        if ($entity->type === 'page' || $entity->type === 'chapter') {
-            $chain[] = 'book:' . $entity->book_id;
-        }
-
-        return $chain;
-    }
-
-    protected function isUserSystemAdmin($userRoleIds): bool
-    {
-        $adminRoleId = Role::getSystemRole('admin')->id;
-        return in_array($adminRoleId, $userRoleIds);
-    }
-}

app/Auth/Permissions/JointPermissionBuilder.php

@@ -19,6 +19,11 @@ use Illuminate\Support\Facades\DB;
  */
 class JointPermissionBuilder
 {
+    /**
+     * @var array<string, array<int, SimpleEntityData>>
+     */
+    protected $entityCache;
+
     /**
      * Re-generate all entity permission from scratch.
      */
@@ -93,6 +98,40 @@ class JointPermissionBuilder
             });
     }
 
+    /**
+     * Prepare the local entity cache and ensure it's empty.
+     *
+     * @param SimpleEntityData[] $entities
+     */
+    protected function readyEntityCache(array $entities)
+    {
+        $this->entityCache = [];
+
+        foreach ($entities as $entity) {
+            if (!isset($this->entityCache[$entity->type])) {
+                $this->entityCache[$entity->type] = [];
+            }
+
+            $this->entityCache[$entity->type][$entity->id] = $entity;
+        }
+    }
+
+    /**
+     * Get a book via ID, Checks local cache.
+     */
+    protected function getBook(int $bookId): SimpleEntityData
+    {
+        return $this->entityCache['book'][$bookId];
+    }
+
+    /**
+     * Get a chapter via ID, Checks local cache.
+     */
+    protected function getChapter(int $chapterId): SimpleEntityData
+    {
+        return $this->entityCache['chapter'][$chapterId];
+    }
+
     /**
      * Get a query for fetching a book with its children.
      */
@@ -101,7 +140,6 @@ class JointPermissionBuilder
         return Book::query()->withTrashed()
             ->select(['id', 'owned_by'])->with([
                 'chapters' => function ($query) {
-                    $query->withTrashed()->select(['id', 'owned_by', 'book_id']);
                 },
                 'pages' => function ($query) {
                     $query->withTrashed()->select(['id', 'owned_by', 'book_id', 'chapter_id']);
@@ -175,7 +213,13 @@ class JointPermissionBuilder
         $simpleEntities = [];
 
         foreach ($entities as $entity) {
-            $simple = SimpleEntityData::fromEntity($entity);
+            $attrs = $entity->getAttributes();
+            $simple = new SimpleEntityData();
+            $simple->id = $attrs['id'];
+            $simple->type = $entity->getMorphClass();
+            $simple->owned_by = $attrs['owned_by'] ?? 0;
+            $simple->book_id = $attrs['book_id'] ?? null;
+            $simple->chapter_id = $attrs['chapter_id'] ?? null;
             $simpleEntities[] = $simple;
         }
 
@@ -185,16 +229,24 @@ class JointPermissionBuilder
     /**
      * Create & Save entity jointPermissions for many entities and roles.
      *
-     * @param Entity[] $originalEntities
+     * @param Entity[] $entities
      * @param Role[]   $roles
      */
     protected function createManyJointPermissions(array $originalEntities, array $roles)
     {
         $entities = $this->entitiesToSimpleEntities($originalEntities);
+        $this->readyEntityCache($entities);
         $jointPermissions = [];
 
         // Fetch related entity permissions
-        $permissions = new MassEntityPermissionEvaluator($entities, 'view');
+        $permissions = $this->getEntityPermissionsForEntities($entities);
+
+        // Create a mapping of explicit entity permissions
+        $permissionMap = [];
+        foreach ($permissions as $permission) {
+            $key = $permission->entity_type . ':' . $permission->entity_id . ':' . $permission->role_id;
+            $permissionMap[$key] = $permission->view;
+        }
 
         // Create a mapping of role permissions
         $rolePermissionMap = [];
@@ -207,14 +259,13 @@ class JointPermissionBuilder
         // Create Joint Permission Data
         foreach ($entities as $entity) {
             foreach ($roles as $role) {
-                $jp = $this->createJointPermissionData(
+                $jointPermissions[] = $this->createJointPermissionData(
                     $entity,
                     $role->getRawAttribute('id'),
-                    $permissions,
+                    $permissionMap,
                     $rolePermissionMap,
                     $role->system_name === 'admin'
                 );
-                $jointPermissions[] = $jp;
             }
         }
 
@@ -248,45 +299,109 @@ class JointPermissionBuilder
         return $idsByType;
     }
 
+    /**
+     * Get the entity permissions for all the given entities.
+     *
+     * @param SimpleEntityData[] $entities
+     *
+     * @return EntityPermission[]
+     */
+    protected function getEntityPermissionsForEntities(array $entities): array
+    {
+        $idsByType = $this->entitiesToTypeIdMap($entities);
+        $permissionFetch = EntityPermission::query()
+            ->where(function (Builder $query) use ($idsByType) {
+                foreach ($idsByType as $type => $ids) {
+                    $query->orWhere(function (Builder $query) use ($type, $ids) {
+                        $query->where('entity_type', '=', $type)->whereIn('entity_id', $ids);
+                    });
+                }
+            });
+
+        return $permissionFetch->get()->all();
+    }
+
     /**
      * Create entity permission data for an entity and role
      * for a particular action.
      */
-    protected function createJointPermissionData(SimpleEntityData $entity, int $roleId, MassEntityPermissionEvaluator $permissionMap, array $rolePermissionMap, bool $isAdminRole): array
+    protected function createJointPermissionData(SimpleEntityData $entity, int $roleId, array $permissionMap, array $rolePermissionMap, bool $isAdminRole): array
     {
-        // Ensure system admin role retains permissions
-        if ($isAdminRole) {
-            return $this->createJointPermissionDataArray($entity, $roleId, PermissionStatus::EXPLICIT_ALLOW, true);
-        }
-
-        // Return evaluated entity permission status if it has an affect.
-        $entityPermissionStatus = $permissionMap->evaluateEntityForRole($entity, $roleId);
-        if ($entityPermissionStatus !== null) {
-            return $this->createJointPermissionDataArray($entity, $roleId, $entityPermissionStatus, false);
-        }
-
-        // Otherwise default to the role-level permissions
         $permissionPrefix = $entity->type . '-view';
         $roleHasPermission = isset($rolePermissionMap[$roleId . ':' . $permissionPrefix . '-all']);
         $roleHasPermissionOwn = isset($rolePermissionMap[$roleId . ':' . $permissionPrefix . '-own']);
-        $status = $roleHasPermission ? PermissionStatus::IMPLICIT_ALLOW : PermissionStatus::IMPLICIT_DENY;
-        return $this->createJointPermissionDataArray($entity, $roleId, $status, $roleHasPermissionOwn);
+
+        if ($isAdminRole) {
+            return $this->createJointPermissionDataArray($entity, $roleId, true, true);
+        }
+
+        if ($this->entityPermissionsActiveForRole($permissionMap, $entity, $roleId)) {
+            $hasAccess = $this->mapHasActiveRestriction($permissionMap, $entity, $roleId);
+
+            return $this->createJointPermissionDataArray($entity, $roleId, $hasAccess, $hasAccess);
+        }
+
+        if ($entity->type === 'book' || $entity->type === 'bookshelf') {
+            return $this->createJointPermissionDataArray($entity, $roleId, $roleHasPermission, $roleHasPermissionOwn);
+        }
+
+        // For chapters and pages, Check if explicit permissions are set on the Book.
+        $book = $this->getBook($entity->book_id);
+        $hasExplicitAccessToParents = $this->mapHasActiveRestriction($permissionMap, $book, $roleId);
+        $hasPermissiveAccessToParents = !$this->entityPermissionsActiveForRole($permissionMap, $book, $roleId);
+
+        // For pages with a chapter, Check if explicit permissions are set on the Chapter
+        if ($entity->type === 'page' && $entity->chapter_id !== 0) {
+            $chapter = $this->getChapter($entity->chapter_id);
+            $chapterRestricted = $this->entityPermissionsActiveForRole($permissionMap, $chapter, $roleId);
+            $hasPermissiveAccessToParents = $hasPermissiveAccessToParents && !$chapterRestricted;
+            if ($chapterRestricted) {
+                $hasExplicitAccessToParents = $this->mapHasActiveRestriction($permissionMap, $chapter, $roleId);
+            }
+        }
+
+        return $this->createJointPermissionDataArray(
+            $entity,
+            $roleId,
+            ($hasExplicitAccessToParents || ($roleHasPermission && $hasPermissiveAccessToParents)),
+            ($hasExplicitAccessToParents || ($roleHasPermissionOwn && $hasPermissiveAccessToParents))
+        );
+    }
+
+    /**
+     * Check if entity permissions are defined within the given map, for the given entity and role.
+     * Checks for the default `role_id=0` backup option as a fallback.
+     */
+    protected function entityPermissionsActiveForRole(array $permissionMap, SimpleEntityData $entity, int $roleId): bool
+    {
+        $keyPrefix = $entity->type . ':' . $entity->id . ':';
+        return isset($permissionMap[$keyPrefix . $roleId]) || isset($permissionMap[$keyPrefix . '0']);
+    }
+
+    /**
+     * Check for an active restriction in an entity map.
+     */
+    protected function mapHasActiveRestriction(array $entityMap, SimpleEntityData $entity, int $roleId): bool
+    {
+        $roleKey = $entity->type . ':' . $entity->id . ':' . $roleId;
+        $defaultKey = $entity->type . ':' . $entity->id . ':0';
+
+        return $entityMap[$roleKey] ?? $entityMap[$defaultKey] ?? false;
     }
 
     /**
      * Create an array of data with the information of an entity jointPermissions.
      * Used to build data for bulk insertion.
      */
-    protected function createJointPermissionDataArray(SimpleEntityData $entity, int $roleId, int $permissionStatus, bool $hasPermissionOwn): array
+    protected function createJointPermissionDataArray(SimpleEntityData $entity, int $roleId, bool $permissionAll, bool $permissionOwn): array
     {
-        $ownPermissionActive = ($hasPermissionOwn && $permissionStatus !== PermissionStatus::EXPLICIT_DENY && $entity->owned_by);
-
         return [
-            'entity_id'   => $entity->id,
-            'entity_type' => $entity->type,
-            'role_id'     => $roleId,
-            'status'      => $permissionStatus,
-            'owner_id'    => $ownPermissionActive ? $entity->owned_by : null,
+            'entity_id'          => $entity->id,
+            'entity_type'        => $entity->type,
+            'has_permission'     => $permissionAll,
+            'has_permission_own' => $permissionOwn,
+            'owned_by'           => $entity->owned_by,
+            'role_id'            => $roleId,
         ];
     }
 }

app/Auth/Permissions/MassEntityPermissionEvaluator.php

@@ -1,81 +0,0 @@
-<?php
-
-namespace BookStack\Auth\Permissions;
-
-class MassEntityPermissionEvaluator extends EntityPermissionEvaluator
-{
-    /**
-     * @var SimpleEntityData[]
-     */
-    protected array $entitiesInvolved;
-    protected array $permissionMapCache;
-
-    public function __construct(array $entitiesInvolved, string $action)
-    {
-        $this->entitiesInvolved = $entitiesInvolved;
-        parent::__construct($action);
-    }
-
-    public function evaluateEntityForRole(SimpleEntityData $entity, int $roleId): ?int
-    {
-        $typeIdChain = $this->gatherEntityChainTypeIds($entity);
-        $relevantPermissions = $this->getPermissionMapByTypeIdForChainAndRole($typeIdChain, $roleId);
-        $permitsByType = $this->collapseAndCategorisePermissions($typeIdChain, $relevantPermissions);
-
-        return $this->evaluatePermitsByType($permitsByType);
-    }
-
-    /**
-     * @param string[] $typeIdChain
-     * @return array<string, EntityPermission[]>
-     */
-    protected function getPermissionMapByTypeIdForChainAndRole(array $typeIdChain, int $roleId): array
-    {
-        $allPermissions = $this->getPermissionMapByTypeIdAndRoleForAllInvolved();
-        $relevantPermissions = [];
-
-        // Filter down permissions to just those for current typeId
-        // and current roleID or fallback permissions.
-        foreach ($typeIdChain as $typeId) {
-            $relevantPermissions[$typeId] = [
-                ...($allPermissions[$typeId][$roleId] ?? []),
-                ...($allPermissions[$typeId][0] ?? [])
-            ];
-        }
-
-        return $relevantPermissions;
-    }
-
-    /**
-     * @return array<string, array<int, EntityPermission[]>>
-     */
-    protected function getPermissionMapByTypeIdAndRoleForAllInvolved(): array
-    {
-        if (isset($this->permissionMapCache)) {
-            return $this->permissionMapCache;
-        }
-
-        $entityTypeIdChain = [];
-        foreach ($this->entitiesInvolved as $entity) {
-            $entityTypeIdChain[] = $entity->type . ':' . $entity->id;
-        }
-
-        $permissionMap = $this->getPermissionsMapByTypeId($entityTypeIdChain, []);
-
-       // Manipulate permission map to also be keyed by roleId.
-        foreach ($permissionMap as $typeId => $permissions) {
-            $permissionMap[$typeId] = [];
-            foreach ($permissions as $permission) {
-                $roleId = $permission->getRawAttribute('role_id');
-                if (!isset($permissionMap[$typeId][$roleId])) {
-                    $permissionMap[$typeId][$roleId] = [];
-                }
-                $permissionMap[$typeId][$roleId][] = $permission;
-            }
-        }
-
-        $this->permissionMapCache = $permissionMap;
-
-        return $this->permissionMapCache;
-    }
-}

app/Auth/Permissions/PermissionApplicator.php

@@ -4,6 +4,7 @@ namespace BookStack\Auth\Permissions;
 
 use BookStack\Auth\Role;
 use BookStack\Auth\User;
+use BookStack\Entities\Models\Chapter;
 use BookStack\Entities\Models\Entity;
 use BookStack\Entities\Models\Page;
 use BookStack\Model;
@@ -60,7 +61,46 @@ class PermissionApplicator
     {
         $this->ensureValidEntityAction($action);
 
-        return (new EntityPermissionEvaluator($action))->evaluateEntityForUser($entity, $userRoleIds);
+        $adminRoleId = Role::getSystemRole('admin')->id;
+        if (in_array($adminRoleId, $userRoleIds)) {
+            return true;
+        }
+
+        // The chain order here is very important due to the fact we walk up the chain
+        // in the loop below. Earlier items in the chain have higher priority.
+        $chain = [$entity];
+        if ($entity instanceof Page && $entity->chapter_id) {
+            $chain[] = $entity->chapter;
+        }
+
+        if ($entity instanceof Page || $entity instanceof Chapter) {
+            $chain[] = $entity->book;
+        }
+
+        foreach ($chain as $currentEntity) {
+            $allowedByRoleId = $currentEntity->permissions()
+                ->whereIn('role_id', [0, ...$userRoleIds])
+                ->pluck($action, 'role_id');
+
+            // Continue up the chain if no applicable entity permission overrides.
+            if ($allowedByRoleId->isEmpty()) {
+                continue;
+            }
+
+            // If we have user-role-specific permissions set, allow if any of those
+            // role permissions allow access.
+            $hasDefault = $allowedByRoleId->has(0);
+            if (!$hasDefault || $allowedByRoleId->count() > 1) {
+                return $allowedByRoleId->search(function (bool $allowed, int $roleId) {
+                        return $roleId !== 0 && $allowed;
+                }) !== false;
+            }
+
+            // Otherwise, return the default "Other roles" fallback value.
+            return $allowedByRoleId->get(0);
+        }
+
+        return null;
     }
 
     /**
@@ -94,12 +134,10 @@ class PermissionApplicator
     {
         return $query->where(function (Builder $parentQuery) {
             $parentQuery->whereHas('jointPermissions', function (Builder $permissionQuery) {
-                $permissionQuery->select(['entity_id', 'entity_type'])
-                    ->selectRaw('max(owner_id) as owner_id')
-                    ->selectRaw('max(status) as status')
-                    ->whereIn('role_id', $this->getCurrentUserRoleIds())
-                    ->groupBy(['entity_type', 'entity_id'])
-                    ->havingRaw('(status IN (1, 3) or (owner_id = ? and status != 2))', [$this->currentUser()->id]);
+                $permissionQuery->whereIn('role_id', $this->getCurrentUserRoleIds())
+                    ->where(function (Builder $query) {
+                        $this->addJointHasPermissionCheck($query, $this->currentUser()->id);
+                    });
             });
         });
     }
@@ -123,23 +161,35 @@ class PermissionApplicator
      * Filter items that have entities set as a polymorphic relation.
      * For simplicity, this will not return results attached to draft pages.
      * Draft pages should never really have related items though.
+     *
+     * @param Builder|QueryBuilder $query
      */
-    public function restrictEntityRelationQuery(Builder $query, string $tableName, string $entityIdColumn, string $entityTypeColumn): Builder
+    public function restrictEntityRelationQuery($query, string $tableName, string $entityIdColumn, string $entityTypeColumn)
     {
         $tableDetails = ['tableName' => $tableName, 'entityIdColumn' => $entityIdColumn, 'entityTypeColumn' => $entityTypeColumn];
         $pageMorphClass = (new Page())->getMorphClass();
 
-        return $this->restrictEntityQuery($query)
-            ->where(function ($query) use ($tableDetails, $pageMorphClass) {
-                /** @var Builder $query */
-                $query->where($tableDetails['entityTypeColumn'], '!=', $pageMorphClass)
+        $q = $query->whereExists(function ($permissionQuery) use (&$tableDetails) {
+            /** @var Builder $permissionQuery */
+            $permissionQuery->select(['role_id'])->from('joint_permissions')
+                ->whereColumn('joint_permissions.entity_id', '=', $tableDetails['tableName'] . '.' . $tableDetails['entityIdColumn'])
+                ->whereColumn('joint_permissions.entity_type', '=', $tableDetails['tableName'] . '.' . $tableDetails['entityTypeColumn'])
+                ->whereIn('joint_permissions.role_id', $this->getCurrentUserRoleIds())
+                ->where(function (QueryBuilder $query) {
+                    $this->addJointHasPermissionCheck($query, $this->currentUser()->id);
+                });
+        })->where(function ($query) use ($tableDetails, $pageMorphClass) {
+            /** @var Builder $query */
+            $query->where($tableDetails['entityTypeColumn'], '!=', $pageMorphClass)
                 ->orWhereExists(function (QueryBuilder $query) use ($tableDetails, $pageMorphClass) {
                     $query->select('id')->from('pages')
                         ->whereColumn('pages.id', '=', $tableDetails['tableName'] . '.' . $tableDetails['entityIdColumn'])
                         ->where($tableDetails['tableName'] . '.' . $tableDetails['entityTypeColumn'], '=', $pageMorphClass)
                         ->where('pages.draft', '=', false);
                 });
-            });
+        });
+
+        return $q;
     }
 
     /**
@@ -151,20 +201,49 @@ class PermissionApplicator
     public function restrictPageRelationQuery(Builder $query, string $tableName, string $pageIdColumn): Builder
     {
         $fullPageIdColumn = $tableName . '.' . $pageIdColumn;
-        return $this->restrictEntityQuery($query)
-            ->where(function ($query) use ($fullPageIdColumn) {
-                /** @var Builder $query */
-                $query->whereExists(function (QueryBuilder $query) use ($fullPageIdColumn) {
-                    $query->select('id')->from('pages')
-                        ->whereColumn('pages.id', '=', $fullPageIdColumn)
-                        ->where('pages.draft', '=', false);
-                })->orWhereExists(function (QueryBuilder $query) use ($fullPageIdColumn) {
-                    $query->select('id')->from('pages')
-                        ->whereColumn('pages.id', '=', $fullPageIdColumn)
-                        ->where('pages.draft', '=', true)
-                        ->where('pages.created_by', '=', $this->currentUser()->id);
+        $morphClass = (new Page())->getMorphClass();
+
+        $existsQuery = function ($permissionQuery) use ($fullPageIdColumn, $morphClass) {
+            /** @var Builder $permissionQuery */
+            $permissionQuery->select('joint_permissions.role_id')->from('joint_permissions')
+                ->whereColumn('joint_permissions.entity_id', '=', $fullPageIdColumn)
+                ->where('joint_permissions.entity_type', '=', $morphClass)
+                ->whereIn('joint_permissions.role_id', $this->getCurrentUserRoleIds())
+                ->where(function (QueryBuilder $query) {
+                    $this->addJointHasPermissionCheck($query, $this->currentUser()->id);
                 });
-            });
+        };
+
+        $q = $query->where(function ($query) use ($existsQuery, $fullPageIdColumn) {
+            $query->whereExists($existsQuery)
+                ->orWhere($fullPageIdColumn, '=', 0);
+        });
+
+        // Prevent visibility of non-owned draft pages
+        $q->whereExists(function (QueryBuilder $query) use ($fullPageIdColumn) {
+            $query->select('id')->from('pages')
+                ->whereColumn('pages.id', '=', $fullPageIdColumn)
+                ->where(function (QueryBuilder $query) {
+                    $query->where('pages.draft', '=', false)
+                        ->orWhere('pages.owned_by', '=', $this->currentUser()->id);
+                });
+        });
+
+        return $q;
+    }
+
+    /**
+     * Add the query for checking the given user id has permission
+     * within the join_permissions table.
+     *
+     * @param QueryBuilder|Builder $query
+     */
+    protected function addJointHasPermissionCheck($query, int $userIdToCheck)
+    {
+        $query->where('joint_permissions.has_permission', '=', true)->orWhere(function ($query) use ($userIdToCheck) {
+            $query->where('joint_permissions.has_permission_own', '=', true)
+                ->where('joint_permissions.owned_by', '=', $userIdToCheck);
+        });
     }
 
     /**

app/Auth/Permissions/PermissionStatus.php

@@ -1,11 +0,0 @@
-<?php
-
-namespace BookStack\Auth\Permissions;
-
-class PermissionStatus
-{
-    const IMPLICIT_DENY = 0;
-    const IMPLICIT_ALLOW = 1;
-    const EXPLICIT_DENY = 2;
-    const EXPLICIT_ALLOW = 3;
-}

app/Auth/Permissions/PermissionsRepo.php

@@ -12,8 +12,11 @@ use Illuminate\Database\Eloquent\Collection;
 class PermissionsRepo
 {
     protected JointPermissionBuilder $permissionBuilder;
-    protected array $systemRoles = ['admin', 'public'];
+    protected $systemRoles = ['admin', 'public'];
 
+    /**
+     * PermissionsRepo constructor.
+     */
     public function __construct(JointPermissionBuilder $permissionBuilder)
     {
         $this->permissionBuilder = $permissionBuilder;
@@ -38,7 +41,7 @@ class PermissionsRepo
     /**
      * Get a role via its ID.
      */
-    public function getRoleById(int $id): Role
+    public function getRoleById($id): Role
     {
         return Role::query()->findOrFail($id);
     }
@@ -49,10 +52,10 @@ class PermissionsRepo
     public function saveNewRole(array $roleData): Role
     {
         $role = new Role($roleData);
-        $role->mfa_enforced = boolval($roleData['mfa_enforced'] ?? false);
+        $role->mfa_enforced = ($roleData['mfa_enforced'] ?? 'false') === 'true';
         $role->save();
 
-        $permissions = $roleData['permissions'] ?? [];
+        $permissions = isset($roleData['permissions']) ? array_keys($roleData['permissions']) : [];
         $this->assignRolePermissions($role, $permissions);
         $this->permissionBuilder->rebuildForRole($role);
 
@@ -63,45 +66,42 @@ class PermissionsRepo
 
     /**
      * Updates an existing role.
-     * Ensures Admin system role always have core permissions.
+     * Ensure Admin role always have core permissions.
      */
-    public function updateRole($roleId, array $roleData): Role
+    public function updateRole($roleId, array $roleData)
     {
         $role = $this->getRoleById($roleId);
 
-        if (isset($roleData['permissions'])) {
-            $this->assignRolePermissions($role, $roleData['permissions']);
-        }
-
-        $role->fill($roleData);
-        $role->save();
-        $this->permissionBuilder->rebuildForRole($role);
-
-        Activity::add(ActivityType::ROLE_UPDATE, $role);
-
-        return $role;
-    }
-
-    /**
-     * Assign a list of permission names to the given role.
-     */
-    protected function assignRolePermissions(Role $role, array $permissionNameArray = []): void
-    {
-        $permissions = [];
-        $permissionNameArray = array_values($permissionNameArray);
-
-        // Ensure the admin system role retains vital system permissions
+        $permissions = isset($roleData['permissions']) ? array_keys($roleData['permissions']) : [];
         if ($role->system_name === 'admin') {
-            $permissionNameArray = array_unique(array_merge($permissionNameArray, [
+            $permissions = array_merge($permissions, [
                 'users-manage',
                 'user-roles-manage',
                 'restrictions-manage-all',
                 'restrictions-manage-own',
                 'settings-manage',
-            ]));
+            ]);
         }
 
-        if (!empty($permissionNameArray)) {
+        $this->assignRolePermissions($role, $permissions);
+
+        $role->fill($roleData);
+        $role->mfa_enforced = ($roleData['mfa_enforced'] ?? 'false') === 'true';
+        $role->save();
+        $this->permissionBuilder->rebuildForRole($role);
+
+        Activity::add(ActivityType::ROLE_UPDATE, $role);
+    }
+
+    /**
+     * Assign a list of permission names to a role.
+     */
+    protected function assignRolePermissions(Role $role, array $permissionNameArray = [])
+    {
+        $permissions = [];
+        $permissionNameArray = array_values($permissionNameArray);
+
+        if ($permissionNameArray) {
             $permissions = RolePermission::query()
                 ->whereIn('name', $permissionNameArray)
                 ->pluck('id')
@@ -114,13 +114,13 @@ class PermissionsRepo
     /**
      * Delete a role from the system.
      * Check it's not an admin role or set as default before deleting.
-     * If a migration Role ID is specified the users assign to the current role
+     * If an migration Role ID is specified the users assign to the current role
      * will be added to the role of the specified id.
      *
      * @throws PermissionsException
      * @throws Exception
      */
-    public function deleteRole(int $roleId, int $migrateRoleId = 0): void
+    public function deleteRole($roleId, $migrateRoleId)
     {
         $role = $this->getRoleById($roleId);
 
@@ -131,7 +131,7 @@ class PermissionsRepo
             throw new PermissionsException(trans('errors.role_registration_default_cannot_delete'));
         }
 
-        if ($migrateRoleId !== 0) {
+        if ($migrateRoleId) {
             $newRole = Role::query()->find($migrateRoleId);
             if ($newRole) {
                 $users = $role->users()->pluck('id')->toArray();

app/Auth/Permissions/RolePermission.php

@@ -8,8 +8,6 @@ use Illuminate\Database\Eloquent\Relations\BelongsToMany;
 
 /**
  * @property int $id
- * @property string $name
- * @property string $display_name
  */
 class RolePermission extends Model
 {

app/Auth/Permissions/SimpleEntityData.php

@@ -2,8 +2,6 @@
 
 namespace BookStack\Auth\Permissions;
 
-use BookStack\Entities\Models\Entity;
-
 class SimpleEntityData
 {
     public int $id;
@@ -11,18 +9,4 @@ class SimpleEntityData
     public int $owned_by;
     public ?int $book_id;
     public ?int $chapter_id;
-
-    public static function fromEntity(Entity $entity): self
-    {
-        $attrs = $entity->getAttributes();
-        $simple = new self();
-
-        $simple->id = $attrs['id'];
-        $simple->type = $entity->getMorphClass();
-        $simple->owned_by = $attrs['owned_by'] ?? 0;
-        $simple->book_id = $attrs['book_id'] ?? null;
-        $simple->chapter_id = $attrs['chapter_id'] ?? null;
-
-        return $simple;
-    }
 }

app/Auth/Queries/AllUsersPaginatedAndSorted.php

@@ -3,7 +3,6 @@
 namespace BookStack\Auth\Queries;
 
 use BookStack\Auth\User;
-use BookStack\Util\SimpleListOptions;
 use Illuminate\Pagination\LengthAwarePaginator;
 
 /**
@@ -12,23 +11,23 @@ use Illuminate\Pagination\LengthAwarePaginator;
  * user is assumed to be trusted. (Admin users).
  * Email search can be abused to extract email addresses.
  */
-class UsersAllPaginatedAndSorted
+class AllUsersPaginatedAndSorted
 {
-    public function run(int $count, SimpleListOptions $listOptions): LengthAwarePaginator
+    /**
+     * @param array{sort: string, order: string, search: string} $sortData
+     */
+    public function run(int $count, array $sortData): LengthAwarePaginator
     {
-        $sort = $listOptions->getSort();
-        if ($sort === 'created_at') {
-            $sort = 'users.created_at';
-        }
+        $sort = $sortData['sort'];
 
         $query = User::query()->select(['*'])
             ->scopes(['withLastActivityAt'])
             ->with(['roles', 'avatar'])
             ->withCount('mfaValues')
-            ->orderBy($sort, $listOptions->getOrder());
+            ->orderBy($sort, $sortData['order']);
 
-        if ($listOptions->getSearch()) {
-            $term = '%' . $listOptions->getSearch() . '%';
+        if ($sortData['search']) {
+            $term = '%' . $sortData['search'] . '%';
             $query->where(function ($query) use ($term) {
                 $query->where('name', 'like', $term)
                     ->orWhere('email', 'like', $term);

app/Auth/Queries/RolesAllPaginatedAndSorted.php

@@ -1,35 +0,0 @@
-<?php
-
-namespace BookStack\Auth\Queries;
-
-use BookStack\Auth\Role;
-use BookStack\Util\SimpleListOptions;
-use Illuminate\Pagination\LengthAwarePaginator;
-
-/**
- * Get all the roles in the system in a paginated format.
- */
-class RolesAllPaginatedAndSorted
-{
-    public function run(int $count, SimpleListOptions $listOptions): LengthAwarePaginator
-    {
-        $sort = $listOptions->getSort();
-        if ($sort === 'created_at') {
-            $sort = 'users.created_at';
-        }
-
-        $query = Role::query()->select(['*'])
-            ->withCount(['users', 'permissions'])
-            ->orderBy($sort, $listOptions->getOrder());
-
-        if ($listOptions->getSearch()) {
-            $term = '%' . $listOptions->getSearch() . '%';
-            $query->where(function ($query) use ($term) {
-                $query->where('display_name', 'like', $term)
-                    ->orWhere('description', 'like', $term);
-            });
-        }
-
-        return $query->paginate($count);
-    }
-}

app/Auth/Role.php

@@ -27,14 +27,10 @@ class Role extends Model implements Loggable
 {
     use HasFactory;
 
-    protected $fillable = ['display_name', 'description', 'external_auth_id', 'mfa_enforced'];
+    protected $fillable = ['display_name', 'description', 'external_auth_id'];
 
     protected $hidden = ['pivot'];
 
-    protected $casts = [
-        'mfa_enforced' => 'boolean',
-    ];
-
     /**
      * The roles that belong to the role.
      */
@@ -111,13 +107,15 @@ class Role extends Model implements Loggable
      */
     public static function getSystemRole(string $systemName): ?self
     {
-        static $cache = [];
+        return static::query()->where('system_name', '=', $systemName)->first();
+    }
 
-        if (!isset($cache[$systemName])) {
-            $cache[$systemName] = static::query()->where('system_name', '=', $systemName)->first();
-        }
-
-        return $cache[$systemName];
+    /**
+     * Get all visible roles.
+     */
+    public static function visible(): Collection
+    {
+        return static::query()->where('hidden', '=', false)->orderBy('name')->get();
     }
 
     /**

app/Auth/User.php

@@ -72,7 +72,7 @@ class User extends Model implements AuthenticatableContract, CanResetPasswordCon
      */
     protected $hidden = [
         'password', 'remember_token', 'system_name', 'email_confirmed', 'external_auth_id', 'email',
-        'created_at', 'updated_at', 'image_id', 'roles', 'avatar', 'user_id', 'pivot',
+        'created_at', 'updated_at', 'image_id', 'roles', 'avatar', 'user_id',
     ];
 
     /**
@@ -200,7 +200,6 @@ class User extends Model implements AuthenticatableContract, CanResetPasswordCon
     public function attachRole(Role $role)
     {
         $this->roles()->attach($role->id);
-        $this->unsetRelation('roles');
     }
 
     /**

app/Auth/UserRepo.php

@@ -158,9 +158,6 @@ class UserRepo
         // Delete user profile images
         $this->userAvatar->destroyAllForUser($user);
 
-        // Delete related activities
-        setting()->deleteUserSettings($user->id);
-
         if (!empty($newOwnerId)) {
             $newOwner = User::query()->find($newOwnerId);
             if (!is_null($newOwner)) {
@@ -234,8 +231,6 @@ class UserRepo
      */
     protected function setUserRoles(User $user, array $roles)
     {
-        $roles = array_filter(array_values($roles));
-
         if ($this->demotingLastAdmin($user, $roles)) {
             throw new UserUpdateException(trans('errors.role_cannot_remove_only_admin'), $user->getEditUrl());
         }

app/Config/app.php

@@ -8,8 +8,6 @@
  * Do not edit this file unless you're happy to maintain any changes yourself.
  */
 
-use Illuminate\Support\Facades\Facade;
-
 return [
 
     // The environment to run BookStack in.
@@ -77,7 +75,7 @@ return [
     'locale' => env('APP_LANG', 'en'),
 
     // Locales available
-    'locales' => ['en', 'ar', 'bg', 'bs', 'ca', 'cs', 'cy', 'da', 'de', 'de_informal', 'el', 'es', 'es_AR', 'et', 'eu', 'fa', 'fr', 'he', 'hr', 'hu', 'id', 'it', 'ja', 'ka', 'ko', 'lt', 'lv', 'nl', 'nb', 'pt', 'pt_BR', 'sk', 'sl', 'sv', 'pl',  'ro', 'ru', 'tr', 'uk', 'uz', 'vi', 'zh_CN', 'zh_TW'],
+    'locales' => ['en', 'ar', 'bg', 'bs', 'ca', 'cs', 'cy', 'da', 'de', 'de_informal', 'es', 'es_AR', 'et', 'eu', 'fa', 'fr', 'he', 'hr', 'hu', 'id', 'it', 'ja', 'ko', 'lt', 'lv', 'nl', 'nb', 'pt', 'pt_BR', 'sk', 'sl', 'sv', 'pl',  'ro', 'ru', 'tr', 'uk', 'uz', 'vi', 'zh_CN', 'zh_TW'],
 
     //  Application Fallback Locale
     'fallback_locale' => 'en',
@@ -100,13 +98,7 @@ return [
     // Encryption cipher
     'cipher' => 'AES-256-CBC',
 
-    // Maintenance Mode Driver
-    'maintenance' => [
-        'driver' => 'file',
-        // 'store'  => 'redis',
-    ],
-
-    // Application Service Providers
+    // Application Services Provides
     'providers' => [
 
         // Laravel Framework Service Providers...
@@ -149,9 +141,58 @@ return [
         BookStack\Providers\ViewTweaksServiceProvider::class,
     ],
 
-    // Class Aliases
-    // This array of class aliases to be registered on application start.
-    'aliases' => Facade::defaultAliases()->merge([
+    /*
+    |--------------------------------------------------------------------------
+    | Class Aliases
+    |--------------------------------------------------------------------------
+    |
+    | This array of class aliases will be registered when this application
+    | is started. However, feel free to register as many as you wish as
+    | the aliases are "lazy" loaded so they don't hinder performance.
+    |
+    */
+
+    // Class aliases, Registered on application start
+    'aliases' => [
+        // Laravel
+        'App'          => Illuminate\Support\Facades\App::class,
+        'Arr'          => Illuminate\Support\Arr::class,
+        'Artisan'      => Illuminate\Support\Facades\Artisan::class,
+        'Auth'         => Illuminate\Support\Facades\Auth::class,
+        'Blade'        => Illuminate\Support\Facades\Blade::class,
+        'Bus'          => Illuminate\Support\Facades\Bus::class,
+        'Cache'        => Illuminate\Support\Facades\Cache::class,
+        'Config'       => Illuminate\Support\Facades\Config::class,
+        'Cookie'       => Illuminate\Support\Facades\Cookie::class,
+        'Crypt'        => Illuminate\Support\Facades\Crypt::class,
+        'Date'         => Illuminate\Support\Facades\Date::class,
+        'DB'           => Illuminate\Support\Facades\DB::class,
+        'Eloquent'     => Illuminate\Database\Eloquent\Model::class,
+        'Event'        => Illuminate\Support\Facades\Event::class,
+        'File'         => Illuminate\Support\Facades\File::class,
+        'Gate'         => Illuminate\Support\Facades\Gate::class,
+        'Hash'         => Illuminate\Support\Facades\Hash::class,
+        'Http'         => Illuminate\Support\Facades\Http::class,
+        'Lang'         => Illuminate\Support\Facades\Lang::class,
+        'Log'          => Illuminate\Support\Facades\Log::class,
+        'Mail'         => Illuminate\Support\Facades\Mail::class,
+        'Notification' => Illuminate\Support\Facades\Notification::class,
+        'Password'     => Illuminate\Support\Facades\Password::class,
+        'Queue'        => Illuminate\Support\Facades\Queue::class,
+        'RateLimiter'  => Illuminate\Support\Facades\RateLimiter::class,
+        'Redirect'     => Illuminate\Support\Facades\Redirect::class,
+        // 'Redis'        => Illuminate\Support\Facades\Redis::class,
+        'Request'      => Illuminate\Support\Facades\Request::class,
+        'Response'     => Illuminate\Support\Facades\Response::class,
+        'Route'        => Illuminate\Support\Facades\Route::class,
+        'Schema'       => Illuminate\Support\Facades\Schema::class,
+        'Session'      => Illuminate\Support\Facades\Session::class,
+        'Storage'      => Illuminate\Support\Facades\Storage::class,
+        'Str'          => Illuminate\Support\Str::class,
+        'URL'          => Illuminate\Support\Facades\URL::class,
+        'Validator'    => Illuminate\Support\Facades\Validator::class,
+        'View'         => Illuminate\Support\Facades\View::class,
+
         // Laravel Packages
         'Socialite'    => Laravel\Socialite\Facades\Socialite::class,
 
@@ -161,7 +202,7 @@ return [
         // Custom BookStack
         'Activity'    => BookStack\Facades\Activity::class,
         'Theme'       => BookStack\Facades\Theme::class,
-    ])->toArray(),
+    ],
 
     // Proxy configuration
     'proxies' => env('APP_PROXIES', ''),

app/Config/broadcasting.php

@@ -14,7 +14,7 @@ return [
     // This option controls the default broadcaster that will be used by the
     // framework when an event needs to be broadcast. This can be set to
     // any of the connections defined in the "connections" array below.
-    'default' => 'null',
+    'default' => env('BROADCAST_DRIVER', 'pusher'),
 
     // Broadcast Connections
     // Here you may define all of the broadcast connections that will be used
@@ -22,7 +22,21 @@ return [
     // each available type of connection are provided inside this array.
     'connections' => [
 
-        // Default options removed since we don't use broadcasting.
+        'pusher' => [
+            'driver'  => 'pusher',
+            'key'     => env('PUSHER_APP_KEY'),
+            'secret'  => env('PUSHER_APP_SECRET'),
+            'app_id'  => env('PUSHER_APP_ID'),
+            'options' => [
+                'cluster' => env('PUSHER_APP_CLUSTER'),
+                'useTLS'  => true,
+            ],
+        ],
+
+        'redis' => [
+            'driver'     => 'redis',
+            'connection' => 'default',
+        ],
 
         'log' => [
             'driver' => 'log',

app/Config/cache.php

@@ -87,6 +87,6 @@ return [
     |
     */
 
-    'prefix' => env('CACHE_PREFIX', Str::slug(env('APP_NAME', 'laravel'), '_') . '_cache_'),
+    'prefix' => env('CACHE_PREFIX', Str::slug(env('APP_NAME', 'laravel'), '_') . '_cache'),
 
 ];

app/Config/filesystems.php

@@ -33,20 +33,17 @@ return [
             'driver'     => 'local',
             'root'       => public_path(),
             'visibility' => 'public',
-            'throw'      => true,
         ],
 
         'local_secure_attachments' => [
             'driver' => 'local',
             'root'   => storage_path('uploads/files/'),
-            'throw'  => true,
         ],
 
         'local_secure_images' => [
             'driver'     => 'local',
             'root'       => storage_path('uploads/images/'),
             'visibility' => 'public',
-            'throw'      => true,
         ],
 
         's3' => [
@@ -57,7 +54,6 @@ return [
             'bucket'                  => env('STORAGE_S3_BUCKET', 'your-bucket'),
             'endpoint'                => env('STORAGE_S3_ENDPOINT', null),
             'use_path_style_endpoint' => env('STORAGE_S3_ENDPOINT', null) !== null,
-            'throw'                   => true,
         ],
 
     ],

app/Config/logging.php

@@ -21,15 +21,6 @@ return [
     // one of the channels defined in the "channels" configuration array.
     'default' => env('LOG_CHANNEL', 'single'),
 
-    // Deprecations Log Channel
-    // This option controls the log channel that should be used to log warnings
-    // regarding deprecated PHP and library features. This allows you to get
-    // your application ready for upcoming major versions of dependencies.
-    'deprecations' => [
-        'channel' => 'null',
-        'trace' => false,
-    ],
-
     // Log Channels
     // Here you may configure the log channels for your application. Out of
     // the box, Laravel uses the Monolog PHP logging library. This gives

app/Config/mail.php

@@ -14,7 +14,13 @@ return [
     // From Laravel 7+ this is MAIL_MAILER in laravel.
     // Kept as MAIL_DRIVER in BookStack to prevent breaking change.
     // Options: smtp, sendmail, log, array
-    'default' => env('MAIL_DRIVER', 'smtp'),
+    'driver' => env('MAIL_DRIVER', 'smtp'),
+
+    // SMTP host address
+    'host' => env('MAIL_HOST', 'smtp.mailgun.org'),
+
+    // SMTP host port
+    'port' => env('MAIL_PORT', 587),
 
     // Global "From" address & name
     'from' => [
@@ -22,43 +28,17 @@ return [
         'name'    => env('MAIL_FROM_NAME', 'BookStack'),
     ],
 
-    // Mailer Configurations
-    // Available mailing methods and their settings.
-    'mailers' => [
-        'smtp' => [
-            'transport' => 'smtp',
-            'host' => env('MAIL_HOST', 'smtp.mailgun.org'),
-            'port' => env('MAIL_PORT', 587),
-            'encryption' => env('MAIL_ENCRYPTION', 'tls'),
-            'username' => env('MAIL_USERNAME'),
-            'password' => env('MAIL_PASSWORD'),
-            'verify_peer' => env('MAIL_VERIFY_SSL', true),
-            'timeout' => null,
-            'local_domain' => env('MAIL_EHLO_DOMAIN'),
-        ],
+    // Email encryption protocol
+    'encryption' => env('MAIL_ENCRYPTION', 'tls'),
 
-        'sendmail' => [
-            'transport' => 'sendmail',
-            'path' => env('MAIL_SENDMAIL_COMMAND', '/usr/sbin/sendmail -bs'),
-        ],
+    // SMTP server username
+    'username' => env('MAIL_USERNAME'),
 
-        'log' => [
-            'transport' => 'log',
-            'channel' => env('MAIL_LOG_CHANNEL'),
-        ],
+    // SMTP server password
+    'password' => env('MAIL_PASSWORD'),
 
-        'array' => [
-            'transport' => 'array',
-        ],
-
-        'failover' => [
-            'transport' => 'failover',
-            'mailers' => [
-                'smtp',
-                'log',
-            ],
-        ],
-    ],
+    // Sendmail application path
+    'sendmail' => '/usr/sbin/sendmail -bs',
 
     // Email markdown configuration
     'markdown' => [
@@ -67,4 +47,11 @@ return [
             resource_path('views/vendor/mail'),
         ],
     ],
+
+    // Log Channel
+    // If you are using the "log" driver, you may specify the logging channel
+    // if you prefer to keep mail messages separate from other log entries
+    // for simpler reading. Otherwise, the default channel will be used.
+    'log_channel' => env('MAIL_LOG_CHANNEL'),
+
 ];

app/Config/oidc.php

@@ -8,12 +8,9 @@ return [
     // Dump user details after a login request for debugging purposes
     'dump_user_details' => env('OIDC_DUMP_USER_DETAILS', false),
 
-    // Claim, within an OpenId token, to find the user's display name
+    // Attribute, within a OpenId token, to find the user's display name
     'display_name_claims' => explode('|', env('OIDC_DISPLAY_NAME_CLAIMS', 'name')),
 
-    // Claim, within an OpenID token, to use to connect a BookStack user to the OIDC user.
-    'external_id_claim' => env('OIDC_EXTERNAL_ID_CLAIM', 'sub'),
-
     // OAuth2/OpenId client id, as configured in your Authorization server.
     'client_id' => env('OIDC_CLIENT_ID', null),
 

app/Config/setting-defaults.php

@@ -16,27 +16,16 @@ return [
     'app-editor'           => 'wysiwyg',
     'app-color'            => '#206ea7',
     'app-color-light'      => 'rgba(32,110,167,0.15)',
-    'link-color'           => '#206ea7',
     'bookshelf-color'      => '#a94747',
     'book-color'           => '#077b70',
     'chapter-color'        => '#af4d0d',
     'page-color'           => '#206ea7',
     'page-draft-color'     => '#7e50b1',
-    'app-color-dark'       => '#195785',
-    'app-color-light-dark' => 'rgba(32,110,167,0.15)',
-    'link-color-dark'      => '#429fe3',
-    'bookshelf-color-dark' => '#ff5454',
-    'book-color-dark'      => '#389f60',
-    'chapter-color-dark'   => '#ee7a2d',
-    'page-color-dark'      => '#429fe3',
-    'page-draft-color-dark' => '#a66ce8',
     'app-custom-head'      => false,
     'registration-enabled' => false,
 
     // User-level default settings
     'user' => [
-        'ui-shortcuts'          => '{}',
-        'ui-shortcuts-enabled'  => false,
         'dark-mode-enabled'     => env('APP_DEFAULT_DARK_MODE', false),
         'bookshelves_view_type' => env('APP_VIEWS_BOOKSHELVES', 'grid'),
         'bookshelf_view_type'   => env('APP_VIEWS_BOOKSHELF', 'grid'),

app/Entities/EntityProvider.php

@@ -18,11 +18,30 @@ use BookStack\Entities\Models\PageRevision;
  */
 class EntityProvider
 {
-    public Bookshelf $bookshelf;
-    public Book $book;
-    public Chapter $chapter;
-    public Page $page;
-    public PageRevision $pageRevision;
+    /**
+     * @var Bookshelf
+     */
+    public $bookshelf;
+
+    /**
+     * @var Book
+     */
+    public $book;
+
+    /**
+     * @var Chapter
+     */
+    public $chapter;
+
+    /**
+     * @var Page
+     */
+    public $page;
+
+    /**
+     * @var PageRevision
+     */
+    public $pageRevision;
 
     public function __construct()
     {
@@ -50,18 +69,13 @@ class EntityProvider
     }
 
     /**
-     * Get an entity instance by its basic name.
+     * Get an entity instance by it's basic name.
      */
     public function get(string $type): Entity
     {
         $type = strtolower($type);
-        $instance = $this->all()[$type] ?? null;
 
-        if (is_null($instance)) {
-            throw new \InvalidArgumentException("Provided type \"{$type}\" is not a valid entity type");
-        }
-
-        return $instance;
+        return $this->all()[$type];
     }
 
     /**

app/Entities/Models/Page.php

@@ -88,6 +88,8 @@ class Page extends BookChild
 
     /**
      * Get the current revision for the page if existing.
+     *
+     * @return PageRevision|null
      */
     public function currentRevision(): HasOne
     {

app/Entities/Repos/BaseRepo.php

@@ -87,14 +87,14 @@ class BaseRepo
     {
         if ($coverImage) {
             $imageType = $entity->coverImageTypeKey();
-            $this->imageRepo->destroyImage($entity->cover()->first());
+            $this->imageRepo->destroyImage($entity->cover);
             $image = $this->imageRepo->saveNew($coverImage, $imageType, $entity->id, 512, 512, true);
             $entity->cover()->associate($image);
             $entity->save();
         }
 
         if ($removeImage) {
-            $this->imageRepo->destroyImage($entity->cover()->first());
+            $this->imageRepo->destroyImage($entity->cover);
             $entity->image_id = 0;
             $entity->save();
         }

app/Entities/Tools/BookContents.php

@@ -181,7 +181,7 @@ class BookContents
             $model->changeBook($newBook->id);
         }
 
-        if ($model instanceof Page && $chapterChanged) {
+        if ($chapterChanged) {
             $model->chapter_id = $newChapter->id ?? 0;
         }
 
@@ -235,7 +235,7 @@ class BookContents
             }
 
             $hasPageEditPermission = userCan('page-update', $model);
-            $newParentInRightLocation = ($newParent instanceof Book || ($newParent instanceof Chapter && $newParent->book_id === $newBook->id));
+            $newParentInRightLocation = ($newParent instanceof Book || $newParent->book_id === $newBook->id);
             $newParentPermission = ($newParent instanceof Chapter) ? 'chapter-update' : 'book-update';
             $hasNewParentPermission = userCan($newParentPermission, $newParent);
 

app/Entities/Tools/Cloner.php

@@ -7,7 +7,6 @@ use BookStack\Entities\Models\Book;
 use BookStack\Entities\Models\Bookshelf;
 use BookStack\Entities\Models\Chapter;
 use BookStack\Entities\Models\Entity;
-use BookStack\Entities\Models\HasCoverImage;
 use BookStack\Entities\Models\Page;
 use BookStack\Entities\Repos\BookRepo;
 use BookStack\Entities\Repos\ChapterRepo;
@@ -110,11 +109,9 @@ class Cloner
         $inputData['tags'] = $this->entityTagsToInputArray($entity);
 
         // Add a cover to the data if existing on the original entity
-        if ($entity instanceof HasCoverImage) {
-            $cover = $entity->cover()->first();
-            if ($cover) {
-                $inputData['image'] = $this->imageToUploadedFile($cover);
-            }
+        if ($entity->cover instanceof Image) {
+            $uploadedFile = $this->imageToUploadedFile($entity->cover);
+            $inputData['image'] = $uploadedFile;
         }
 
         return $inputData;

app/Entities/Tools/Markdown/CustomListItemRenderer.php

@@ -2,18 +2,18 @@
 
 namespace BookStack\Entities\Tools\Markdown;
 
-use League\CommonMark\Extension\CommonMark\Node\Block\ListItem;
-use League\CommonMark\Extension\CommonMark\Renderer\Block\ListItemRenderer;
+use League\CommonMark\Block\Element\AbstractBlock;
+use League\CommonMark\Block\Element\ListItem;
+use League\CommonMark\Block\Element\Paragraph;
+use League\CommonMark\Block\Renderer\BlockRendererInterface;
+use League\CommonMark\Block\Renderer\ListItemRenderer;
+use League\CommonMark\ElementRendererInterface;
 use League\CommonMark\Extension\TaskList\TaskListItemMarker;
-use League\CommonMark\Node\Block\Paragraph;
-use League\CommonMark\Node\Node;
-use League\CommonMark\Renderer\ChildNodeRendererInterface;
-use League\CommonMark\Renderer\NodeRendererInterface;
-use League\CommonMark\Util\HtmlElement;
+use League\CommonMark\HtmlElement;
 
-class CustomListItemRenderer implements NodeRendererInterface
+class CustomListItemRenderer implements BlockRendererInterface
 {
-    protected ListItemRenderer $baseRenderer;
+    protected $baseRenderer;
 
     public function __construct()
     {
@@ -23,11 +23,11 @@ class CustomListItemRenderer implements NodeRendererInterface
     /**
      * @return HtmlElement|string|null
      */
-    public function render(Node $node, ChildNodeRendererInterface $childRenderer)
+    public function render(AbstractBlock $block, ElementRendererInterface $htmlRenderer, bool $inTightList = false)
     {
-        $listItem = $this->baseRenderer->render($node, $childRenderer);
+        $listItem = $this->baseRenderer->render($block, $htmlRenderer, $inTightList);
 
-        if ($node instanceof ListItem && $this->startsTaskListItem($node) && $listItem instanceof HtmlElement) {
+        if ($this->startsTaskListItem($block)) {
             $listItem->setAttribute('class', 'task-list-item');
         }
 

app/Entities/Tools/Markdown/CustomStrikeThroughExtension.php

@@ -2,16 +2,16 @@
 
 namespace BookStack\Entities\Tools\Markdown;
 
-use League\CommonMark\Environment\EnvironmentBuilderInterface;
+use League\CommonMark\ConfigurableEnvironmentInterface;
 use League\CommonMark\Extension\ExtensionInterface;
 use League\CommonMark\Extension\Strikethrough\Strikethrough;
 use League\CommonMark\Extension\Strikethrough\StrikethroughDelimiterProcessor;
 
 class CustomStrikeThroughExtension implements ExtensionInterface
 {
-    public function register(EnvironmentBuilderInterface $environment): void
+    public function register(ConfigurableEnvironmentInterface $environment)
     {
         $environment->addDelimiterProcessor(new StrikethroughDelimiterProcessor());
-        $environment->addRenderer(Strikethrough::class, new CustomStrikethroughRenderer());
+        $environment->addInlineRenderer(Strikethrough::class, new CustomStrikethroughRenderer());
     }
 }

app/Entities/Tools/Markdown/CustomStrikethroughRenderer.php

@@ -2,23 +2,25 @@
 
 namespace BookStack\Entities\Tools\Markdown;
 
+use League\CommonMark\ElementRendererInterface;
 use League\CommonMark\Extension\Strikethrough\Strikethrough;
-use League\CommonMark\Node\Node;
-use League\CommonMark\Renderer\ChildNodeRendererInterface;
-use League\CommonMark\Renderer\NodeRendererInterface;
-use League\CommonMark\Util\HtmlElement;
+use League\CommonMark\HtmlElement;
+use League\CommonMark\Inline\Element\AbstractInline;
+use League\CommonMark\Inline\Renderer\InlineRendererInterface;
 
 /**
  * This is a somewhat clone of the League\CommonMark\Extension\Strikethrough\StrikethroughRender
  * class but modified slightly to use <s> HTML tags instead of <del> in order to
  * match front-end markdown-it rendering.
  */
-class CustomStrikethroughRenderer implements NodeRendererInterface
+class CustomStrikethroughRenderer implements InlineRendererInterface
 {
-    public function render(Node $node, ChildNodeRendererInterface $childRenderer)
+    public function render(AbstractInline $inline, ElementRendererInterface $htmlRenderer)
     {
-        Strikethrough::assertInstanceOf($node);
+        if (!($inline instanceof Strikethrough)) {
+            throw new \InvalidArgumentException('Incompatible inline type: ' . get_class($inline));
+        }
 
-        return new HtmlElement('s', $node->data->get('attributes'), $childRenderer->renderNodes($node->children()));
+        return new HtmlElement('s', $inline->getData('attributes', []), $htmlRenderer->renderInlines($inline->children()));
     }
 }

app/Entities/Tools/Markdown/MarkdownToHtml.php

@@ -4,12 +4,11 @@ namespace BookStack\Entities\Tools\Markdown;
 
 use BookStack\Facades\Theme;
 use BookStack\Theming\ThemeEvents;
-use League\CommonMark\Environment\Environment;
-use League\CommonMark\Extension\CommonMark\CommonMarkCoreExtension;
-use League\CommonMark\Extension\CommonMark\Node\Block\ListItem;
+use League\CommonMark\Block\Element\ListItem;
+use League\CommonMark\CommonMarkConverter;
+use League\CommonMark\Environment;
 use League\CommonMark\Extension\Table\TableExtension;
 use League\CommonMark\Extension\TaskList\TaskListExtension;
-use League\CommonMark\MarkdownConverter;
 
 class MarkdownToHtml
 {
@@ -22,16 +21,15 @@ class MarkdownToHtml
 
     public function convert(): string
     {
-        $environment = new Environment();
-        $environment->addExtension(new CommonMarkCoreExtension());
+        $environment = Environment::createCommonMarkEnvironment();
         $environment->addExtension(new TableExtension());
         $environment->addExtension(new TaskListExtension());
         $environment->addExtension(new CustomStrikeThroughExtension());
         $environment = Theme::dispatch(ThemeEvents::COMMONMARK_ENVIRONMENT_CONFIGURE, $environment) ?? $environment;
-        $converter = new MarkdownConverter($environment);
+        $converter = new CommonMarkConverter([], $environment);
 
-        $environment->addRenderer(ListItem::class, new CustomListItemRenderer(), 10);
+        $environment->addBlockRenderer(ListItem::class, new CustomListItemRenderer(), 10);
 
-        return $converter->convert($this->markdown)->getContent();
+        return $converter->convertToHtml($this->markdown);
     }
 }

app/Entities/Tools/PageContent.php

@@ -19,15 +19,20 @@ use Illuminate\Support\Str;
 
 class PageContent
 {
-    public function __construct(
-        protected Page $page
-    ) {
+    protected Page $page;
+
+    /**
+     * PageContent constructor.
+     */
+    public function __construct(Page $page)
+    {
+        $this->page = $page;
     }
 
     /**
      * Update the content of the page with new provided HTML.
      */
-    public function setNewHTML(string $html): void
+    public function setNewHTML(string $html)
     {
         $html = $this->extractBase64ImagesFromHtml($html);
         $this->page->html = $this->formatHtml($html);
@@ -38,7 +43,7 @@ class PageContent
     /**
      * Update the content of the page with new provided Markdown content.
      */
-    public function setNewMarkdown(string $markdown): void
+    public function setNewMarkdown(string $markdown)
     {
         $markdown = $this->extractBase64ImagesFromMarkdown($markdown);
         $this->page->markdown = $markdown;
@@ -52,7 +57,7 @@ class PageContent
      */
     protected function extractBase64ImagesFromHtml(string $htmlText): string
     {
-        if (empty($htmlText) || !str_contains($htmlText, 'data:image')) {
+        if (empty($htmlText) || strpos($htmlText, 'data:image') === false) {
             return $htmlText;
         }
 
@@ -86,7 +91,7 @@ class PageContent
      * Attempting to capture the whole data uri using regex can cause PHP
      * PCRE limits to be hit with larger, multi-MB, files.
      */
-    protected function extractBase64ImagesFromMarkdown(string $markdown): string
+    protected function extractBase64ImagesFromMarkdown(string $markdown)
     {
         $matches = [];
         $contentLength = strlen($markdown);
@@ -178,13 +183,32 @@ class PageContent
         $childNodes = $body->childNodes;
         $xPath = new DOMXPath($doc);
 
-        // Map to hold used ID references
+        // Set ids on top-level nodes
         $idMap = [];
-        // Map to hold changing ID references
-        $changeMap = [];
+        foreach ($childNodes as $index => $childNode) {
+            [$oldId, $newId] = $this->setUniqueId($childNode, $idMap);
+            if ($newId && $newId !== $oldId) {
+                $this->updateLinks($xPath, '#' . $oldId, '#' . $newId);
+            }
+        }
 
-        $this->updateIdsRecursively($body, 0, $idMap, $changeMap);
-        $this->updateLinks($xPath, $changeMap);
+        // Set ids on nested header nodes
+        $nestedHeaders = $xPath->query('//body//*//h1|//body//*//h2|//body//*//h3|//body//*//h4|//body//*//h5|//body//*//h6');
+        foreach ($nestedHeaders as $nestedHeader) {
+            [$oldId, $newId] = $this->setUniqueId($nestedHeader, $idMap);
+            if ($newId && $newId !== $oldId) {
+                $this->updateLinks($xPath, '#' . $oldId, '#' . $newId);
+            }
+        }
+
+        // Ensure no duplicate ids within child items
+        $idElems = $xPath->query('//body//*//*[@id]');
+        foreach ($idElems as $domElem) {
+            [$oldId, $newId] = $this->setUniqueId($domElem, $idMap);
+            if ($newId && $newId !== $oldId) {
+                $this->updateLinks($xPath, '#' . $oldId, '#' . $newId);
+            }
+        }
 
         // Generate inner html as a string
         $html = '';
@@ -199,53 +223,20 @@ class PageContent
     }
 
     /**
-     * For the given DOMNode, traverse its children recursively and update IDs
-     * where required (Top-level, headers & elements with IDs).
-     * Will update the provided $changeMap array with changes made, where keys are the old
-     * ids and the corresponding values are the new ids.
+     * Update the all links to the $old location to instead point to $new.
      */
-    protected function updateIdsRecursively(DOMNode $element, int $depth, array &$idMap, array &$changeMap): void
+    protected function updateLinks(DOMXPath $xpath, string $old, string $new)
     {
-        /* @var DOMNode $child */
-        foreach ($element->childNodes as $child) {
-            if ($child instanceof DOMElement && ($depth === 0 || in_array($child->nodeName, ['h1', 'h2', 'h3', 'h4', 'h5', 'h6']) || $child->getAttribute('id'))) {
-                [$oldId, $newId] = $this->setUniqueId($child, $idMap);
-                if ($newId && $newId !== $oldId && !isset($idMap[$oldId])) {
-                    $changeMap[$oldId] = $newId;
-                }
-            }
-
-            if ($child->hasChildNodes()) {
-                $this->updateIdsRecursively($child, $depth + 1, $idMap, $changeMap);
-            }
-        }
-    }
-
-    /**
-     * Update the all links in the given xpath to apply requires changes within the
-     * given $changeMap array.
-     */
-    protected function updateLinks(DOMXPath $xpath, array $changeMap): void
-    {
-        if (empty($changeMap)) {
-            return;
-        }
-
-        $links = $xpath->query('//body//*//*[@href]');
-        /** @var DOMElement $domElem */
-        foreach ($links as $domElem) {
-            $href = ltrim($domElem->getAttribute('href'), '#');
-            $newHref = $changeMap[$href] ?? null;
-            if ($newHref) {
-                $domElem->setAttribute('href', '#' . $newHref);
-            }
+        $old = str_replace('"', '', $old);
+        $matchingLinks = $xpath->query('//body//*//*[@href="' . $old . '"]');
+        foreach ($matchingLinks as $domElem) {
+            $domElem->setAttribute('href', $new);
         }
     }
 
     /**
      * Set a unique id on the given DOMElement.
-     * A map for existing ID's should be passed in to check for current existence,
-     * and this will be updated with any new IDs set upon elements.
+     * A map for existing ID's should be passed in to check for current existence.
      * Returns a pair of strings in the format [old_id, new_id].
      */
     protected function setUniqueId(DOMNode $element, array &$idMap): array
@@ -256,7 +247,7 @@ class PageContent
 
         // Stop if there's an existing valid id that has not already been used.
         $existingId = $element->getAttribute('id');
-        if (str_starts_with($existingId, 'bkmrk') && !isset($idMap[$existingId])) {
+        if (strpos($existingId, 'bkmrk') === 0 && !isset($idMap[$existingId])) {
             $idMap[$existingId] = true;
 
             return [$existingId, $existingId];
@@ -267,7 +258,7 @@ class PageContent
         // the same content is passed through.
         $contentId = 'bkmrk-' . mb_substr(strtolower(preg_replace('/\s+/', '-', trim($element->nodeValue))), 0, 20);
         $newId = urlencode($contentId);
-        $loopIndex = 1;
+        $loopIndex = 0;
 
         while (isset($idMap[$newId])) {
             $newId = urlencode($contentId . '-' . $loopIndex);
@@ -304,9 +295,7 @@ class PageContent
         if ($blankIncludes) {
             $content = $this->blankPageIncludes($content);
         } else {
-            for ($includeDepth = 0; $includeDepth < 3; $includeDepth++) {
-                $content = $this->parsePageIncludes($content);
-            }
+            $content = $this->parsePageIncludes($content);
         }
 
         return $content;
@@ -451,8 +440,8 @@ class PageContent
     {
         libxml_use_internal_errors(true);
         $doc = new DOMDocument();
-        $html = '<?xml encoding="utf-8" ?><body>' . $html . '</body>';
-        $doc->loadHTML($html);
+        $html = '<body>' . $html . '</body>';
+        $doc->loadHTML(mb_convert_encoding($html, 'HTML-ENTITIES', 'UTF-8'));
 
         return $doc;
     }

app/Entities/Tools/PermissionsUpdater.php

@@ -4,20 +4,20 @@ namespace BookStack\Entities\Tools;
 
 use BookStack\Actions\ActivityType;
 use BookStack\Auth\Permissions\EntityPermission;
-use BookStack\Auth\Role;
 use BookStack\Auth\User;
 use BookStack\Entities\Models\Book;
 use BookStack\Entities\Models\Bookshelf;
 use BookStack\Entities\Models\Entity;
 use BookStack\Facades\Activity;
 use Illuminate\Http\Request;
+use Illuminate\Support\Collection;
 
 class PermissionsUpdater
 {
     /**
      * Update an entities permissions from a permission form submit request.
      */
-    public function updateFromPermissionsForm(Entity $entity, Request $request): void
+    public function updateFromPermissionsForm(Entity $entity, Request $request)
     {
         $permissions = $request->get('permissions', null);
         $ownerId = $request->get('owned_by', null);
@@ -39,44 +39,12 @@ class PermissionsUpdater
         Activity::add(ActivityType::PERMISSIONS_UPDATE, $entity);
     }
 
-    /**
-     * Update permissions from API request data.
-     */
-    public function updateFromApiRequestData(Entity $entity, array $data): void
-    {
-        if (isset($data['role_permissions'])) {
-            $entity->permissions()->where('role_id', '!=', 0)->delete();
-            $rolePermissionData = $this->formatPermissionsFromApiRequestToEntityPermissions($data['role_permissions'] ?? [], false);
-            $entity->permissions()->createMany($rolePermissionData);
-        }
-
-        if (array_key_exists('fallback_permissions', $data)) {
-            $entity->permissions()->where('role_id', '=', 0)->delete();
-        }
-
-        if (isset($data['fallback_permissions']['inheriting']) && $data['fallback_permissions']['inheriting'] !== true) {
-            $data = $data['fallback_permissions'];
-            $data['role_id'] = 0;
-            $rolePermissionData = $this->formatPermissionsFromApiRequestToEntityPermissions([$data], true);
-            $entity->permissions()->createMany($rolePermissionData);
-        }
-
-        if (isset($data['owner_id'])) {
-            $this->updateOwnerFromId($entity, intval($data['owner_id']));
-        }
-
-        $entity->save();
-        $entity->rebuildPermissions();
-
-        Activity::add(ActivityType::PERMISSIONS_UPDATE, $entity);
-    }
-
     /**
      * Update the owner of the given entity.
      * Checks the user exists in the system first.
      * Does not save the model, just updates it.
      */
-    protected function updateOwnerFromId(Entity $entity, int $newOwnerId): void
+    protected function updateOwnerFromId(Entity $entity, int $newOwnerId)
     {
         $newOwner = User::query()->find($newOwnerId);
         if (!is_null($newOwner)) {
@@ -99,41 +67,7 @@ class PermissionsUpdater
             $formatted[] = $entityPermissionData;
         }
 
-        return $this->filterEntityPermissionDataUponRole($formatted, true);
-    }
-
-    protected function formatPermissionsFromApiRequestToEntityPermissions(array $permissions, bool $allowFallback): array
-    {
-        $formatted = [];
-
-        foreach ($permissions as $requestPermissionData) {
-            $entityPermissionData = ['role_id' => $requestPermissionData['role_id']];
-            foreach (EntityPermission::PERMISSIONS as $permission) {
-                $entityPermissionData[$permission] = boolval($requestPermissionData[$permission] ?? false);
-            }
-            $formatted[] = $entityPermissionData;
-        }
-
-        return $this->filterEntityPermissionDataUponRole($formatted, $allowFallback);
-    }
-
-    protected function filterEntityPermissionDataUponRole(array $entityPermissionData, bool $allowFallback): array
-    {
-        $roleIds = [];
-        foreach ($entityPermissionData as $permissionEntry) {
-            $roleIds[] = intval($permissionEntry['role_id']);
-        }
-
-        $actualRoleIds = array_unique(array_values(array_filter($roleIds)));
-        $rolesById = Role::query()->whereIn('id', $actualRoleIds)->get('id')->keyBy('id');
-
-        return array_values(array_filter($entityPermissionData, function ($data) use ($rolesById, $allowFallback) {
-            if (intval($data['role_id']) === 0) {
-                return $allowFallback;
-            }
-
-            return $rolesById->has($data['role_id']);
-        }));
+        return $formatted;
     }
 
     /**

app/Exceptions/Handler.php

@@ -17,7 +17,7 @@ class Handler extends ExceptionHandler
     /**
      * A list of the exception types that are not reported.
      *
-     * @var array<int, class-string<\Throwable>>
+     * @var array
      */
     protected $dontReport = [
         NotFoundException::class,
@@ -25,9 +25,9 @@ class Handler extends ExceptionHandler
     ];
 
     /**
-     * A list of the inputs that are never flashed to the session on validation exceptions.
+     * A list of the inputs that are never flashed for validation exceptions.
      *
-     * @var array<int, string>
+     * @var array
      */
     protected $dontFlash = [
         'current_password',
@@ -98,7 +98,6 @@ class Handler extends ExceptionHandler
         ];
 
         if ($e instanceof ValidationException) {
-            $responseData['error']['message'] = 'The given data was invalid.';
             $responseData['error']['validation'] = $e->errors();
             $code = $e->status;
         }

app/Exceptions/LdapFailedBindException.php

@@ -0,0 +1,7 @@
+<?php
+
+namespace BookStack\Exceptions;
+
+class LdapFailedBindException extends LdapException
+{
+}

app/Exceptions/WhoopsBookStackPrettyHandler.php

@@ -2,18 +2,25 @@
 
 namespace BookStack\Exceptions;
 
-use Illuminate\Contracts\Foundation\ExceptionRenderer;
+use Whoops\Handler\Handler;
 
-class BookStackExceptionHandlerPage implements ExceptionRenderer
+class WhoopsBookStackPrettyHandler extends Handler
 {
-    public function render($throwable)
+    /**
+     * @return int|null A handler may return nothing, or a Handler::HANDLE_* constant
+     */
+    public function handle()
     {
-        return view('errors.debug', [
-            'error'       => $throwable->getMessage(),
-            'errorClass'  => get_class($throwable),
-            'trace'       => $throwable->getTraceAsString(),
+        $exception = $this->getException();
+
+        echo view('errors.debug', [
+            'error'       => $exception->getMessage(),
+            'errorClass'  => get_class($exception),
+            'trace'       => $exception->getTraceAsString(),
             'environment' => $this->getEnvironment(),
         ])->render();
+
+        return Handler::QUIT;
     }
 
     protected function safeReturn(callable $callback, $default = null)

app/Http/Controllers/Api/ApiController.php

@@ -32,15 +32,10 @@ abstract class ApiController extends Controller
      */
     public function getValidationRules(): array
     {
-        return $this->rules();
-    }
+        if (method_exists($this, 'rules')) {
+            return $this->rules();
+        }
 
-    /**
-     * Get the validation rules for the actions in this controller.
-     * Defaults to a $rules property but can be a rules() method.
-     */
-    protected function rules(): array
-    {
         return $this->rules;
     }
 }

app/Http/Controllers/Api/AttachmentApiController.php

@@ -13,9 +13,11 @@ use Illuminate\Validation\ValidationException;
 
 class AttachmentApiController extends ApiController
 {
-    public function __construct(
-        protected AttachmentService $attachmentService
-    ) {
+    protected $attachmentService;
+
+    public function __construct(AttachmentService $attachmentService)
+    {
+        $this->attachmentService = $attachmentService;
     }
 
     /**
@@ -172,13 +174,13 @@ class AttachmentApiController extends ApiController
                 'name'        => ['required', 'min:1', 'max:255', 'string'],
                 'uploaded_to' => ['required', 'integer', 'exists:pages,id'],
                 'file'        => array_merge(['required_without:link'], $this->attachmentService->getFileValidationRules()),
-                'link'        => ['required_without:file', 'min:1', 'max:2000', 'safe_url'],
+                'link'        => ['required_without:file', 'min:1', 'max:255', 'safe_url'],
             ],
             'update' => [
                 'name'        => ['min:1', 'max:255', 'string'],
                 'uploaded_to' => ['integer', 'exists:pages,id'],
                 'file'        => $this->attachmentService->getFileValidationRules(),
-                'link'        => ['min:1', 'max:2000', 'safe_url'],
+                'link'        => ['min:1', 'max:255', 'safe_url'],
             ],
         ];
     }

app/Http/Controllers/Api/ContentPermissionApiController.php

@@ -1,100 +0,0 @@
-<?php
-
-namespace BookStack\Http\Controllers\Api;
-
-use BookStack\Entities\EntityProvider;
-use BookStack\Entities\Models\Entity;
-use BookStack\Entities\Tools\PermissionsUpdater;
-use Illuminate\Http\Request;
-
-class ContentPermissionApiController extends ApiController
-{
-    public function __construct(
-        protected PermissionsUpdater $permissionsUpdater,
-        protected EntityProvider $entities
-    ) {
-    }
-
-    protected $rules = [
-        'update' => [
-            'owner_id'  => ['int'],
-
-            'role_permissions' => ['array'],
-            'role_permissions.*.role_id' => ['required', 'int', 'exists:roles,id'],
-            'role_permissions.*.view' => ['required', 'boolean'],
-            'role_permissions.*.create' => ['required', 'boolean'],
-            'role_permissions.*.update' => ['required', 'boolean'],
-            'role_permissions.*.delete' => ['required', 'boolean'],
-
-            'fallback_permissions' => ['nullable'],
-            'fallback_permissions.inheriting' => ['required_with:fallback_permissions', 'boolean'],
-            'fallback_permissions.view' => ['required_if:fallback_permissions.inheriting,false', 'boolean'],
-            'fallback_permissions.create' => ['required_if:fallback_permissions.inheriting,false', 'boolean'],
-            'fallback_permissions.update' => ['required_if:fallback_permissions.inheriting,false', 'boolean'],
-            'fallback_permissions.delete' => ['required_if:fallback_permissions.inheriting,false', 'boolean'],
-        ]
-    ];
-
-    /**
-     * Read the configured content-level permissions for the item of the given type and ID.
-     * 'contentType' should be one of: page, book, chapter, bookshelf.
-     * 'contentId' should be the relevant ID of that item type you'd like to handle permissions for.
-     * The permissions shown are those that override the default for just the specified item, they do not show the
-     * full evaluated permission for a role, nor do they reflect permissions inherited from other items in the hierarchy.
-     * Fallback permission values may be `null` when inheriting is active.
-     */
-    public function read(string $contentType, string $contentId)
-    {
-        $entity = $this->entities->get($contentType)
-            ->newQuery()->scopes(['visible'])->findOrFail($contentId);
-
-        $this->checkOwnablePermission('restrictions-manage', $entity);
-
-        return response()->json($this->formattedPermissionDataForEntity($entity));
-    }
-
-    /**
-     * Update the configured content-level permission overrides for the item of the given type and ID.
-     * 'contentType' should be one of: page, book, chapter, bookshelf.
-     * 'contentId' should be the relevant ID of that item type you'd like to handle permissions for.
-     * Providing an empty `role_permissions` array will remove any existing configured role permissions,
-     * so you may want to fetch existing permissions beforehand if just adding/removing a single item.
-     * You should completely omit the `owner_id`, `role_permissions` and/or the `fallback_permissions` properties
-     * from your request data if you don't wish to update details within those categories.
-     */
-    public function update(Request $request, string $contentType, string $contentId)
-    {
-        $entity = $this->entities->get($contentType)
-            ->newQuery()->scopes(['visible'])->findOrFail($contentId);
-
-        $this->checkOwnablePermission('restrictions-manage', $entity);
-
-        $data = $this->validate($request, $this->rules()['update']);
-        $this->permissionsUpdater->updateFromApiRequestData($entity, $data);
-
-        return response()->json($this->formattedPermissionDataForEntity($entity));
-    }
-
-    protected function formattedPermissionDataForEntity(Entity $entity): array
-    {
-        $rolePermissions = $entity->permissions()
-            ->where('role_id', '!=', 0)
-            ->with(['role:id,display_name'])
-            ->get();
-
-        $fallback = $entity->permissions()->where('role_id', '=', 0)->first();
-        $fallbackData = [
-            'inheriting' => is_null($fallback),
-            'view' => $fallback->view ?? null,
-            'create' => $fallback->create ?? null,
-            'update' => $fallback->update ?? null,
-            'delete' => $fallback->delete ?? null,
-        ];
-
-        return [
-            'owner' => $entity->ownedBy()->first(),
-            'role_permissions' => $rolePermissions,
-            'fallback_permissions' => $fallbackData,
-        ];
-    }
-}

app/Http/Controllers/Api/ImageGalleryApiController.php

@@ -1,146 +0,0 @@
-<?php
-
-namespace BookStack\Http\Controllers\Api;
-
-use BookStack\Entities\Models\Page;
-use BookStack\Uploads\Image;
-use BookStack\Uploads\ImageRepo;
-use Illuminate\Http\Request;
-
-class ImageGalleryApiController extends ApiController
-{
-    protected array $fieldsToExpose = [
-        'id', 'name', 'url', 'path', 'type', 'uploaded_to', 'created_by', 'updated_by',  'created_at', 'updated_at',
-    ];
-
-    public function __construct(
-        protected ImageRepo $imageRepo
-    ) {
-    }
-
-    protected function rules(): array
-    {
-        return [
-            'create' => [
-                'type'  => ['required', 'string', 'in:gallery,drawio'],
-                'uploaded_to' => ['required', 'integer'],
-                'image' => ['required', 'file', ...$this->getImageValidationRules()],
-                'name'  => ['string', 'max:180'],
-            ],
-            'update' => [
-                'name'  => ['string', 'max:180'],
-            ]
-        ];
-    }
-
-    /**
-     * Get a listing of images in the system. Includes gallery (page content) images and drawings.
-     * Requires visibility of the page they're originally uploaded to.
-     */
-    public function list()
-    {
-        $images = Image::query()->scopes(['visible'])
-            ->select($this->fieldsToExpose)
-            ->whereIn('type', ['gallery', 'drawio']);
-
-        return $this->apiListingResponse($images, [
-            ...$this->fieldsToExpose
-        ]);
-    }
-
-    /**
-     * Create a new image in the system.
-     * Since "image" is expected to be a file, this needs to be a 'multipart/form-data' type request.
-     * The provided "uploaded_to" should be an existing page ID in the system.
-     * If the "name" parameter is omitted, the filename of the provided image file will be used instead.
-     * The "type" parameter should be 'gallery' for page content images, and 'drawio' should only be used
-     * when the file is a PNG file with diagrams.net image data embedded within.
-     */
-    public function create(Request $request)
-    {
-        $this->checkPermission('image-create-all');
-        $data = $this->validate($request, $this->rules()['create']);
-        Page::visible()->findOrFail($data['uploaded_to']);
-
-        $image = $this->imageRepo->saveNew($data['image'], $data['type'], $data['uploaded_to']);
-
-        if (isset($data['name'])) {
-            $image->refresh();
-            $image->update(['name' => $data['name']]);
-        }
-
-        return response()->json($this->formatForSingleResponse($image));
-    }
-
-    /**
-     * View the details of a single image.
-     * The "thumbs" response property contains links to scaled variants that BookStack may use in its UI.
-     * The "content" response property provides HTML and Markdown content, in the format that BookStack
-     * would typically use by default to add the image in page content, as a convenience.
-     * Actual image file data is not provided but can be fetched via the "url" response property.
-     */
-    public function read(string $id)
-    {
-        $image = Image::query()->scopes(['visible'])->findOrFail($id);
-
-        return response()->json($this->formatForSingleResponse($image));
-    }
-
-    /**
-     * Update the details of an existing image in the system.
-     * Only allows updating of the image name at this time.
-     */
-    public function update(Request $request, string $id)
-    {
-        $data = $this->validate($request, $this->rules()['update']);
-        $image = $this->imageRepo->getById($id);
-        $this->checkOwnablePermission('page-view', $image->getPage());
-        $this->checkOwnablePermission('image-update', $image);
-
-        $this->imageRepo->updateImageDetails($image, $data);
-
-        return response()->json($this->formatForSingleResponse($image));
-    }
-
-    /**
-     * Delete an image from the system.
-     * Will also delete thumbnails for the image.
-     * Does not check or handle image usage so this could leave pages with broken image references.
-     */
-    public function delete(string $id)
-    {
-        $image = $this->imageRepo->getById($id);
-        $this->checkOwnablePermission('page-view', $image->getPage());
-        $this->checkOwnablePermission('image-delete', $image);
-        $this->imageRepo->destroyImage($image);
-
-        return response('', 204);
-    }
-
-    /**
-     * Format the given image model for single-result display.
-     */
-    protected function formatForSingleResponse(Image $image): array
-    {
-        $this->imageRepo->loadThumbs($image);
-        $data = $image->getAttributes();
-        $data['created_by'] = $image->createdBy;
-        $data['updated_by'] = $image->updatedBy;
-        $data['content'] = [];
-
-        $escapedUrl = htmlentities($image->url);
-        $escapedName = htmlentities($image->name);
-        if ($image->type === 'drawio') {
-            $data['content']['html'] = "<div drawio-diagram=\"{$image->id}\"><img src=\"{$escapedUrl}\"></div>";
-            $data['content']['markdown'] = $data['content']['html'];
-        } else {
-            $escapedDisplayThumb = htmlentities($image->thumbs['display']);
-            $data['content']['html'] = "<a href=\"{$escapedUrl}\" target=\"_blank\"><img src=\"{$escapedDisplayThumb}\" alt=\"{$escapedName}\"></a>";
-            $mdEscapedName = str_replace(']', '', str_replace('[', '', $image->name));
-            $mdEscapedThumb = str_replace(']', '', str_replace('[', '', $image->thumbs['display']));
-            $data['content']['markdown'] = "![{$mdEscapedName}]({$mdEscapedThumb})";
-        }
-
-        return $data;
-    }
-}

app/Http/Controllers/Api/RoleApiController.php

@@ -1,136 +0,0 @@
-<?php
-
-namespace BookStack\Http\Controllers\Api;
-
-use BookStack\Auth\Permissions\PermissionsRepo;
-use BookStack\Auth\Role;
-use Illuminate\Http\Request;
-use Illuminate\Support\Facades\DB;
-
-class RoleApiController extends ApiController
-{
-    protected PermissionsRepo $permissionsRepo;
-
-    protected array $fieldsToExpose = [
-        'display_name', 'description', 'mfa_enforced', 'external_auth_id', 'created_at', 'updated_at',
-    ];
-
-    protected $rules = [
-        'create' => [
-            'display_name'  => ['required', 'string', 'min:3', 'max:180'],
-            'description'   => ['string', 'max:180'],
-            'mfa_enforced'  => ['boolean'],
-            'external_auth_id' => ['string'],
-            'permissions'   => ['array'],
-            'permissions.*' => ['string'],
-        ],
-        'update' => [
-            'display_name'  => ['string', 'min:3', 'max:180'],
-            'description'   => ['string', 'max:180'],
-            'mfa_enforced'  => ['boolean'],
-            'external_auth_id' => ['string'],
-            'permissions'   => ['array'],
-            'permissions.*' => ['string'],
-        ]
-    ];
-
-    public function __construct(PermissionsRepo $permissionsRepo)
-    {
-        $this->permissionsRepo = $permissionsRepo;
-
-        // Checks for all endpoints in this controller
-        $this->middleware(function ($request, $next) {
-            $this->checkPermission('user-roles-manage');
-
-            return $next($request);
-        });
-    }
-
-    /**
-     * Get a listing of roles in the system.
-     * Requires permission to manage roles.
-     */
-    public function list()
-    {
-        $roles = Role::query()->select(['*'])
-            ->withCount(['users', 'permissions']);
-
-        return $this->apiListingResponse($roles, [
-            ...$this->fieldsToExpose,
-            'permissions_count',
-            'users_count',
-        ]);
-    }
-
-    /**
-     * Create a new role in the system.
-     * Permissions should be provided as an array of permission name strings.
-     * Requires permission to manage roles.
-     */
-    public function create(Request $request)
-    {
-        $data = $this->validate($request, $this->rules()['create']);
-
-        $role = null;
-        DB::transaction(function () use ($data, &$role) {
-            $role = $this->permissionsRepo->saveNewRole($data);
-        });
-
-        $this->singleFormatter($role);
-
-        return response()->json($role);
-    }
-
-    /**
-     * View the details of a single role.
-     * Provides the permissions and a high-level list of the users assigned.
-     * Requires permission to manage roles.
-     */
-    public function read(string $id)
-    {
-        $role = $this->permissionsRepo->getRoleById($id);
-        $this->singleFormatter($role);
-
-        return response()->json($role);
-    }
-
-    /**
-     * Update an existing role in the system.
-     * Permissions should be provided as an array of permission name strings.
-     * An empty "permissions" array would clear granted permissions.
-     * In many cases, where permissions are changed, you'll want to fetch the existing
-     * permissions and then modify before providing in your update request.
-     * Requires permission to manage roles.
-     */
-    public function update(Request $request, string $id)
-    {
-        $data = $this->validate($request, $this->rules()['update']);
-        $role = $this->permissionsRepo->updateRole($id, $data);
-
-        $this->singleFormatter($role);
-
-        return response()->json($role);
-    }
-
-    /**
-     * Delete a role from the system.
-     * Requires permission to manage roles.
-     */
-    public function delete(string $id)
-    {
-        $this->permissionsRepo->deleteRole(intval($id));
-
-        return response('', 204);
-    }
-
-    /**
-     * Format the given role model for single-result display.
-     */
-    protected function singleFormatter(Role $role)
-    {
-        $role->load('users:id,name,slug');
-        $role->unsetRelation('permissions');
-        $role->setAttribute('permissions', $role->permissions()->orderBy('name', 'asc')->pluck('name'));
-        $role->makeVisible(['users', 'permissions']);
-    }
-}

app/Http/Controllers/Api/UserApiController.php

@@ -13,9 +13,9 @@ use Illuminate\Validation\Rules\Unique;
 
 class UserApiController extends ApiController
 {
-    protected UserRepo $userRepo;
+    protected $userRepo;
 
-    protected array $fieldsToExpose = [
+    protected $fieldsToExpose = [
         'email', 'created_at', 'updated_at', 'last_activity_at', 'external_auth_id',
     ];
 

app/Http/Controllers/AttachmentController.php

@@ -15,10 +15,16 @@ use Illuminate\Validation\ValidationException;
 
 class AttachmentController extends Controller
 {
-    public function __construct(
-        protected AttachmentService $attachmentService,
-        protected PageRepo $pageRepo
-    ) {
+    protected AttachmentService $attachmentService;
+    protected PageRepo $pageRepo;
+
+    /**
+     * AttachmentController constructor.
+     */
+    public function __construct(AttachmentService $attachmentService, PageRepo $pageRepo)
+    {
+        $this->attachmentService = $attachmentService;
+        $this->pageRepo = $pageRepo;
     }
 
     /**
@@ -106,7 +112,7 @@ class AttachmentController extends Controller
         try {
             $this->validate($request, [
                 'attachment_edit_name' => ['required', 'string', 'min:1', 'max:255'],
-                'attachment_edit_url'  => ['string', 'min:1', 'max:2000', 'safe_url'],
+                'attachment_edit_url'  => ['string', 'min:1', 'max:255', 'safe_url'],
             ]);
         } catch (ValidationException $exception) {
             return response()->view('attachments.manager-edit-form', array_merge($request->only(['attachment_edit_name', 'attachment_edit_url']), [
@@ -142,7 +148,7 @@ class AttachmentController extends Controller
             $this->validate($request, [
                 'attachment_link_uploaded_to' => ['required', 'integer', 'exists:pages,id'],
                 'attachment_link_name'        => ['required', 'string', 'min:1', 'max:255'],
-                'attachment_link_url'         => ['required', 'string', 'min:1', 'max:2000', 'safe_url'],
+                'attachment_link_url'         => ['required', 'string', 'min:1', 'max:255', 'safe_url'],
             ]);
         } catch (ValidationException $exception) {
             return response()->view('attachments.manager-link-form', array_merge($request->only(['attachment_link_name', 'attachment_link_url']), [

app/Http/Controllers/AuditLogController.php

@@ -3,8 +3,6 @@
 namespace BookStack\Http\Controllers;
 
 use BookStack\Actions\Activity;
-use BookStack\Actions\ActivityType;
-use BookStack\Util\SimpleListOptions;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
 
@@ -15,15 +13,10 @@ class AuditLogController extends Controller
         $this->checkPermission('settings-manage');
         $this->checkPermission('users-manage');
 
-        $sort = $request->get('sort', 'activity_date');
-        $order = $request->get('order', 'desc');
-        $listOptions = (new SimpleListOptions('', $sort, $order))->withSortOptions([
-            'created_at' => trans('settings.audit_table_date'),
-            'type' => trans('settings.audit_table_event'),
-        ]);
-
-        $filters = [
+        $listDetails = [
+            'order'     => $request->get('order', 'desc'),
             'event'     => $request->get('event', ''),
+            'sort'      => $request->get('sort', 'created_at'),
             'date_from' => $request->get('date_from', ''),
             'date_to'   => $request->get('date_to', ''),
             'user'      => $request->get('user', ''),
@@ -32,38 +25,39 @@ class AuditLogController extends Controller
 
         $query = Activity::query()
             ->with([
-                'entity' => fn ($query) => $query->withTrashed(),
+                'entity' => function ($query) {
+                    $query->withTrashed();
+                },
                 'user',
             ])
-            ->orderBy($listOptions->getSort(), $listOptions->getOrder());
+            ->orderBy($listDetails['sort'], $listDetails['order']);
 
-        if ($filters['event']) {
-            $query->where('type', '=', $filters['event']);
+        if ($listDetails['event']) {
+            $query->where('type', '=', $listDetails['event']);
         }
-        if ($filters['user']) {
-            $query->where('user_id', '=', $filters['user']);
+        if ($listDetails['user']) {
+            $query->where('user_id', '=', $listDetails['user']);
         }
 
-        if ($filters['date_from']) {
-            $query->where('created_at', '>=', $filters['date_from']);
+        if ($listDetails['date_from']) {
+            $query->where('created_at', '>=', $listDetails['date_from']);
         }
-        if ($filters['date_to']) {
-            $query->where('created_at', '<=', $filters['date_to']);
+        if ($listDetails['date_to']) {
+            $query->where('created_at', '<=', $listDetails['date_to']);
         }
-        if ($filters['ip']) {
-            $query->where('ip', 'like', $filters['ip'] . '%');
+        if ($listDetails['ip']) {
+            $query->where('ip', 'like', $listDetails['ip'] . '%');
         }
 
         $activities = $query->paginate(100);
-        $activities->appends($request->all());
+        $activities->appends($listDetails);
 
-        $types = ActivityType::all();
+        $types = DB::table('activities')->select('type')->distinct()->pluck('type');
         $this->setPageTitle(trans('settings.audit'));
 
         return view('settings.audit', [
             'activities'    => $activities,
-            'filters'       => $filters,
-            'listOptions'   => $listOptions,
+            'listDetails'   => $listDetails,
             'activityTypes' => $types,
         ]);
     }

app/Http/Controllers/Auth/ConfirmEmailController.php

@@ -14,11 +14,21 @@ use Illuminate\Http\Request;
 
 class ConfirmEmailController extends Controller
 {
+    protected EmailConfirmationService $emailConfirmationService;
+    protected LoginService $loginService;
+    protected UserRepo $userRepo;
+
+    /**
+     * Create a new controller instance.
+     */
     public function __construct(
-        protected EmailConfirmationService $emailConfirmationService,
-        protected LoginService $loginService,
-        protected UserRepo $userRepo
+        EmailConfirmationService $emailConfirmationService,
+        LoginService $loginService,
+        UserRepo $userRepo
     ) {
+        $this->emailConfirmationService = $emailConfirmationService;
+        $this->loginService = $loginService;
+        $this->userRepo = $userRepo;
     }
 
     /**
@@ -41,28 +51,14 @@ class ConfirmEmailController extends Controller
         return view('auth.user-unconfirmed', ['user' => $user]);
     }
 
-    /**
-     * Show the form for a user to provide their positive confirmation of their email.
-     */
-    public function showAcceptForm(string $token)
-    {
-        return view('auth.register-confirm-accept', ['token' => $token]);
-    }
-
     /**
      * Confirms an email via a token and logs the user into the system.
      *
      * @throws ConfirmationEmailException
      * @throws Exception
      */
-    public function confirm(Request $request)
+    public function confirm(string $token)
     {
-        $validated = $this->validate($request, [
-            'token' => ['required', 'string']
-        ]);
-
-        $token = $validated['token'];
-
         try {
             $userId = $this->emailConfirmationService->checkTokenAndGetUserId($token);
         } catch (UserTokenNotFoundException $exception) {

app/Http/Controllers/BookController.php

@@ -15,7 +15,6 @@ use BookStack\Exceptions\ImageUploadException;
 use BookStack\Exceptions\NotFoundException;
 use BookStack\Facades\Activity;
 use BookStack\References\ReferenceFetcher;
-use BookStack\Util\SimpleListOptions;
 use Illuminate\Http\Request;
 use Illuminate\Validation\ValidationException;
 use Throwable;
@@ -36,16 +35,13 @@ class BookController extends Controller
     /**
      * Display a listing of the book.
      */
-    public function index(Request $request)
+    public function index()
     {
         $view = setting()->getForCurrentUser('books_view_type');
-        $listOptions = SimpleListOptions::fromRequest($request, 'books')->withSortOptions([
-            'name' => trans('common.sort_name'),
-            'created_at' => trans('common.sort_created_at'),
-            'updated_at' => trans('common.sort_updated_at'),
-        ]);
+        $sort = setting()->getForCurrentUser('books_sort', 'name');
+        $order = setting()->getForCurrentUser('books_sort_order', 'asc');
 
-        $books = $this->bookRepo->getAllPaginated(18, $listOptions->getSort(), $listOptions->getOrder());
+        $books = $this->bookRepo->getAllPaginated(18, $sort, $order);
         $recents = $this->isSignedIn() ? $this->bookRepo->getRecentlyViewed(4) : false;
         $popular = $this->bookRepo->getPopular(4);
         $new = $this->bookRepo->getRecentlyCreated(4);
@@ -60,7 +56,8 @@ class BookController extends Controller
             'popular' => $popular,
             'new'     => $new,
             'view'    => $view,
-            'listOptions' => $listOptions,
+            'sort'    => $sort,
+            'order'   => $order,
         ]);
     }
 

app/Http/Controllers/BookshelfController.php

@@ -10,7 +10,6 @@ use BookStack\Entities\Tools\ShelfContext;
 use BookStack\Exceptions\ImageUploadException;
 use BookStack\Exceptions\NotFoundException;
 use BookStack\References\ReferenceFetcher;
-use BookStack\Util\SimpleListOptions;
 use Exception;
 use Illuminate\Http\Request;
 use Illuminate\Validation\ValidationException;
@@ -31,16 +30,18 @@ class BookshelfController extends Controller
     /**
      * Display a listing of the book.
      */
-    public function index(Request $request)
+    public function index()
     {
         $view = setting()->getForCurrentUser('bookshelves_view_type');
-        $listOptions = SimpleListOptions::fromRequest($request, 'bookshelves')->withSortOptions([
+        $sort = setting()->getForCurrentUser('bookshelves_sort', 'name');
+        $order = setting()->getForCurrentUser('bookshelves_sort_order', 'asc');
+        $sortOptions = [
             'name'       => trans('common.sort_name'),
             'created_at' => trans('common.sort_created_at'),
             'updated_at' => trans('common.sort_updated_at'),
-        ]);
+        ];
 
-        $shelves = $this->shelfRepo->getAllPaginated(18, $listOptions->getSort(), $listOptions->getOrder());
+        $shelves = $this->shelfRepo->getAllPaginated(18, $sort, $order);
         $recents = $this->isSignedIn() ? $this->shelfRepo->getRecentlyViewed(4) : false;
         $popular = $this->shelfRepo->getPopular(4);
         $new = $this->shelfRepo->getRecentlyCreated(4);
@@ -54,7 +55,9 @@ class BookshelfController extends Controller
             'popular'     => $popular,
             'new'         => $new,
             'view'        => $view,
-            'listOptions' => $listOptions,
+            'sort'        => $sort,
+            'order'       => $order,
+            'sortOptions' => $sortOptions,
         ]);
     }
 
@@ -64,7 +67,7 @@ class BookshelfController extends Controller
     public function create()
     {
         $this->checkPermission('bookshelf-create-all');
-        $books = Book::visible()->orderBy('name')->get(['name', 'id', 'slug', 'created_at', 'updated_at']);
+        $books = Book::visible()->orderBy('name')->get(['name', 'id', 'slug']);
         $this->setPageTitle(trans('entities.shelves_create'));
 
         return view('shelves.create', ['books' => $books]);
@@ -97,21 +100,16 @@ class BookshelfController extends Controller
      *
      * @throws NotFoundException
      */
-    public function show(Request $request, ActivityQueries $activities, string $slug)
+    public function show(ActivityQueries $activities, string $slug)
     {
         $shelf = $this->shelfRepo->getBySlug($slug);
         $this->checkOwnablePermission('bookshelf-view', $shelf);
 
-        $listOptions = SimpleListOptions::fromRequest($request, 'shelf_books')->withSortOptions([
-            'default' => trans('common.sort_default'),
-            'name' => trans('common.sort_name'),
-            'created_at' => trans('common.sort_created_at'),
-            'updated_at' => trans('common.sort_updated_at'),
-        ]);
+        $sort = setting()->getForCurrentUser('shelf_books_sort', 'default');
+        $order = setting()->getForCurrentUser('shelf_books_sort_order', 'asc');
 
-        $sort = $listOptions->getSort();
         $sortedVisibleShelfBooks = $shelf->visibleBooks()->get()
-            ->sortBy($sort === 'default' ? 'pivot.order' : $sort, SORT_REGULAR, $listOptions->getOrder() === 'desc')
+            ->sortBy($sort === 'default' ? 'pivot.order' : $sort, SORT_REGULAR, $order === 'desc')
             ->values()
             ->all();
 
@@ -126,7 +124,8 @@ class BookshelfController extends Controller
             'sortedVisibleShelfBooks' => $sortedVisibleShelfBooks,
             'view'                    => $view,
             'activity'                => $activities->entityActivity($shelf, 20, 1),
-            'listOptions'             => $listOptions,
+            'order'                   => $order,
+            'sort'                    => $sort,
             'referenceCount'          => $this->referenceFetcher->getPageReferenceCountToEntity($shelf),
         ]);
     }
@@ -140,7 +139,7 @@ class BookshelfController extends Controller
         $this->checkOwnablePermission('bookshelf-update', $shelf);
 
         $shelfBookIds = $shelf->books()->get(['id'])->pluck('id');
-        $books = Book::visible()->whereNotIn('id', $shelfBookIds)->orderBy('name')->get(['name', 'id', 'slug', 'created_at', 'updated_at']);
+        $books = Book::visible()->whereNotIn('id', $shelfBookIds)->orderBy('name')->get(['name', 'id', 'slug']);
 
         $this->setPageTitle(trans('entities.shelves_edit_named', ['name' => $shelf->getShortName()]));
 

app/Http/Controllers/HomeController.php

@@ -10,16 +10,13 @@ use BookStack\Entities\Queries\TopFavourites;
 use BookStack\Entities\Repos\BookRepo;
 use BookStack\Entities\Repos\BookshelfRepo;
 use BookStack\Entities\Tools\PageContent;
-use BookStack\Uploads\FaviconHandler;
-use BookStack\Util\SimpleListOptions;
-use Illuminate\Http\Request;
 
 class HomeController extends Controller
 {
     /**
      * Display the homepage.
      */
-    public function index(Request $request, ActivityQueries $activities)
+    public function index(ActivityQueries $activities)
     {
         $activity = $activities->latest(10);
         $draftPages = [];
@@ -64,27 +61,33 @@ class HomeController extends Controller
         if ($homepageOption === 'bookshelves' || $homepageOption === 'books') {
             $key = $homepageOption;
             $view = setting()->getForCurrentUser($key . '_view_type');
-            $listOptions = SimpleListOptions::fromRequest($request, $key)->withSortOptions([
-                'name' => trans('common.sort_name'),
+            $sort = setting()->getForCurrentUser($key . '_sort', 'name');
+            $order = setting()->getForCurrentUser($key . '_sort_order', 'asc');
+
+            $sortOptions = [
+                'name'       => trans('common.sort_name'),
                 'created_at' => trans('common.sort_created_at'),
                 'updated_at' => trans('common.sort_updated_at'),
-            ]);
+            ];
 
             $commonData = array_merge($commonData, [
                 'view'        => $view,
-                'listOptions' => $listOptions,
+                'sort'        => $sort,
+                'order'       => $order,
+                'sortOptions' => $sortOptions,
             ]);
         }
 
         if ($homepageOption === 'bookshelves') {
-            $shelves = app(BookshelfRepo::class)->getAllPaginated(18, $commonData['listOptions']->getSort(), $commonData['listOptions']->getOrder());
+            $shelves = app(BookshelfRepo::class)->getAllPaginated(18, $commonData['sort'], $commonData['order']);
             $data = array_merge($commonData, ['shelves' => $shelves]);
 
             return view('home.shelves', $data);
         }
 
         if ($homepageOption === 'books') {
-            $books = app(BookRepo::class)->getAllPaginated(18, $commonData['listOptions']->getSort(), $commonData['listOptions']->getOrder());
+            $bookRepo = app(BookRepo::class);
+            $books = $bookRepo->getAllPaginated(18, $commonData['sort'], $commonData['order']);
             $data = array_merge($commonData, ['books' => $books]);
 
             return view('home.books', $data);
@@ -128,15 +131,4 @@ class HomeController extends Controller
     {
         return response()->view('errors.404', [], 404);
     }
-
-    /**
-     * Serve the application favicon.
-     * Ensures a 'favicon.ico' file exists at the web root location (if writable) to be served
-     * directly by the webserver in the future.
-     */
-    public function favicon(FaviconHandler $favicons)
-    {
-        $exists = $favicons->restoreOriginalIfNotExists();
-        return response()->file($exists ? $favicons->getPath() : $favicons->getOriginalPath());
-    }
 }

app/Http/Controllers/Images/DrawioImageController.php

@@ -66,19 +66,14 @@ class DrawioImageController extends Controller
      */
     public function getAsBase64($id)
     {
-        try {
-            $image = $this->imageRepo->getById($id);
-        } catch (Exception $exception) {
-            return $this->jsonError(trans('errors.drawing_data_not_found'), 404);
-        }
-
-        if ($image->type !== 'drawio' || !userCan('page-view', $image->getPage())) {
-            return $this->jsonError(trans('errors.drawing_data_not_found'), 404);
+        $image = $this->imageRepo->getById($id);
+        if (is_null($image) || $image->type !== 'drawio' || !userCan('page-view', $image->getPage())) {
+            return $this->jsonError('Image data could not be found');
         }
 
         $imageData = $this->imageRepo->getImageData($image);
         if (is_null($imageData)) {
-            return $this->jsonError(trans('errors.drawing_data_not_found'), 404);
+            return $this->jsonError('Image data could not be found');
         }
 
         return response()->json([

app/Http/Controllers/Images/GalleryImageController.php

@@ -10,9 +10,14 @@ use Illuminate\Validation\ValidationException;
 
 class GalleryImageController extends Controller
 {
-    public function __construct(
-        protected ImageRepo $imageRepo
-    ) {
+    protected $imageRepo;
+
+    /**
+     * GalleryImageController constructor.
+     */
+    public function __construct(ImageRepo $imageRepo)
+    {
+        $this->imageRepo = $imageRepo;
     }
 
     /**
@@ -42,14 +47,9 @@ class GalleryImageController extends Controller
     public function create(Request $request)
     {
         $this->checkPermission('image-create-all');
-
-        try {
-            $this->validate($request, [
-                'file' => $this->getImageValidationRules(),
-            ]);
-        } catch (ValidationException $exception) {
-            return $this->jsonError(implode("\n", $exception->errors()['file']));
-        }
+        $this->validate($request, [
+            'file' => $this->getImageValidationRules(),
+        ]);
 
         try {
             $imageUpload = $request->file('file');

app/Http/Controllers/PageRevisionController.php

@@ -3,13 +3,10 @@
 namespace BookStack\Http\Controllers;
 
 use BookStack\Actions\ActivityType;
-use BookStack\Entities\Models\PageRevision;
 use BookStack\Entities\Repos\PageRepo;
 use BookStack\Entities\Tools\PageContent;
 use BookStack\Exceptions\NotFoundException;
 use BookStack\Facades\Activity;
-use BookStack\Util\SimpleListOptions;
-use Illuminate\Http\Request;
 use Ssddanbrown\HtmlDiff\Diff;
 
 class PageRevisionController extends Controller
@@ -26,29 +23,22 @@ class PageRevisionController extends Controller
      *
      * @throws NotFoundException
      */
-    public function index(Request $request, string $bookSlug, string $pageSlug)
+    public function index(string $bookSlug, string $pageSlug)
     {
         $page = $this->pageRepo->getBySlug($bookSlug, $pageSlug);
-        $listOptions = SimpleListOptions::fromRequest($request, 'page_revisions', true)->withSortOptions([
-            'id' => trans('entities.pages_revisions_sort_number')
-        ]);
-
         $revisions = $page->revisions()->select([
-                'id', 'page_id', 'name', 'created_at', 'created_by', 'updated_at',
-                'type', 'revision_number', 'summary',
-            ])
+            'id', 'page_id', 'name', 'created_at', 'created_by', 'updated_at',
+            'type', 'revision_number', 'summary',
+        ])
             ->selectRaw("IF(markdown = '', false, true) as is_markdown")
             ->with(['page.book', 'createdBy'])
-            ->reorder('id', $listOptions->getOrder())
-            ->reorder('created_at', $listOptions->getOrder())
-            ->paginate(50);
+            ->get();
 
         $this->setPageTitle(trans('entities.pages_revisions_named', ['pageName' => $page->getShortName()]));
 
         return view('pages.revisions', [
-            'revisions'   => $revisions,
-            'page'        => $page,
-            'listOptions' => $listOptions,
+            'revisions' => $revisions,
+            'page'      => $page,
         ]);
     }
 
@@ -60,7 +50,6 @@ class PageRevisionController extends Controller
     public function show(string $bookSlug, string $pageSlug, int $revisionId)
     {
         $page = $this->pageRepo->getBySlug($bookSlug, $pageSlug);
-        /** @var ?PageRevision $revision */
         $revision = $page->revisions()->where('id', '=', $revisionId)->first();
         if ($revision === null) {
             throw new NotFoundException();
@@ -89,7 +78,6 @@ class PageRevisionController extends Controller
     public function changes(string $bookSlug, string $pageSlug, int $revisionId)
     {
         $page = $this->pageRepo->getBySlug($bookSlug, $pageSlug);
-        /** @var ?PageRevision $revision */
         $revision = $page->revisions()->where('id', '=', $revisionId)->first();
         if ($revision === null) {
             throw new NotFoundException();

app/Http/Controllers/RoleController.php

@@ -3,18 +3,19 @@
 namespace BookStack\Http\Controllers;
 
 use BookStack\Auth\Permissions\PermissionsRepo;
-use BookStack\Auth\Queries\RolesAllPaginatedAndSorted;
 use BookStack\Auth\Role;
 use BookStack\Exceptions\PermissionsException;
-use BookStack\Util\SimpleListOptions;
 use Exception;
 use Illuminate\Http\Request;
 use Illuminate\Validation\ValidationException;
 
 class RoleController extends Controller
 {
-    protected PermissionsRepo $permissionsRepo;
+    protected $permissionsRepo;
 
+    /**
+     * PermissionController constructor.
+     */
     public function __construct(PermissionsRepo $permissionsRepo)
     {
         $this->permissionsRepo = $permissionsRepo;
@@ -23,27 +24,14 @@ class RoleController extends Controller
     /**
      * Show a listing of the roles in the system.
      */
-    public function index(Request $request)
+    public function index()
     {
         $this->checkPermission('user-roles-manage');
-
-        $listOptions = SimpleListOptions::fromRequest($request, 'roles')->withSortOptions([
-            'display_name' => trans('common.sort_name'),
-            'users_count' => trans('settings.roles_assigned_users'),
-            'permissions_count' => trans('settings.roles_permissions_provided'),
-            'created_at' => trans('common.sort_created_at'),
-            'updated_at' => trans('common.sort_updated_at'),
-        ]);
-
-        $roles = (new RolesAllPaginatedAndSorted())->run(20, $listOptions);
-        $roles->appends($listOptions->getPaginationAppends());
+        $roles = $this->permissionsRepo->getAllRoles();
 
         $this->setPageTitle(trans('settings.roles'));
 
-        return view('settings.roles.index', [
-            'roles'       => $roles,
-            'listOptions' => $listOptions,
-        ]);
+        return view('settings.roles.index', ['roles' => $roles]);
     }
 
     /**
@@ -74,28 +62,29 @@ class RoleController extends Controller
     public function store(Request $request)
     {
         $this->checkPermission('user-roles-manage');
-        $data = $this->validate($request, [
+        $this->validate($request, [
             'display_name' => ['required', 'min:3', 'max:180'],
             'description'  => ['max:180'],
-            'external_auth_id' => ['string'],
-            'permissions'  => ['array'],
-            'mfa_enforced' => ['string'],
         ]);
 
-        $data['permissions'] = array_keys($data['permissions'] ?? []);
-        $data['mfa_enforced'] = ($data['mfa_enforced'] ?? 'false') === 'true';
-        $this->permissionsRepo->saveNewRole($data);
+        $this->permissionsRepo->saveNewRole($request->all());
+        $this->showSuccessNotification(trans('settings.role_create_success'));
 
         return redirect('/settings/roles');
     }
 
     /**
      * Show the form for editing a user role.
+     *
+     * @throws PermissionsException
      */
     public function edit(string $id)
     {
         $this->checkPermission('user-roles-manage');
         $role = $this->permissionsRepo->getRoleById($id);
+        if ($role->hidden) {
+            throw new PermissionsException(trans('errors.role_cannot_be_edited'));
+        }
 
         $this->setPageTitle(trans('settings.role_edit'));
 
@@ -104,21 +93,19 @@ class RoleController extends Controller
 
     /**
      * Updates a user role.
+     *
+     * @throws ValidationException
      */
     public function update(Request $request, string $id)
     {
         $this->checkPermission('user-roles-manage');
-        $data = $this->validate($request, [
+        $this->validate($request, [
             'display_name' => ['required', 'min:3', 'max:180'],
             'description'  => ['max:180'],
-            'external_auth_id' => ['string'],
-            'permissions'  => ['array'],
-            'mfa_enforced' => ['string'],
         ]);
 
-        $data['permissions'] = array_keys($data['permissions'] ?? []);
-        $data['mfa_enforced'] = ($data['mfa_enforced'] ?? 'false') === 'true';
-        $this->permissionsRepo->updateRole($id, $data);
+        $this->permissionsRepo->updateRole($id, $request->all());
+        $this->showSuccessNotification(trans('settings.role_update_success'));
 
         return redirect('/settings/roles');
     }
@@ -151,14 +138,15 @@ class RoleController extends Controller
         $this->checkPermission('user-roles-manage');
 
         try {
-            $migrateRoleId = intval($request->get('migrate_role_id') ?: "0");
-            $this->permissionsRepo->deleteRole($id, $migrateRoleId);
+            $this->permissionsRepo->deleteRole($id, $request->get('migrate_role_id'));
         } catch (PermissionsException $e) {
             $this->showErrorNotification($e->getMessage());
 
             return redirect()->back();
         }
 
+        $this->showSuccessNotification(trans('settings.role_delete_success'));
+
         return redirect('/settings/roles');
     }
 }

app/Http/Controllers/SearchController.php

@@ -11,7 +11,7 @@ use Illuminate\Http\Request;
 
 class SearchController extends Controller
 {
-    protected SearchRunner $searchRunner;
+    protected $searchRunner;
 
     public function __construct(SearchRunner $searchRunner)
     {
@@ -69,7 +69,7 @@ class SearchController extends Controller
      * Search for a list of entities and return a partial HTML response of matching entities.
      * Returns the most popular entities if no search is provided.
      */
-    public function searchForSelector(Request $request)
+    public function searchEntitiesAjax(Request $request)
     {
         $entityTypes = $request->filled('types') ? explode(',', $request->get('types')) : ['page', 'chapter', 'book'];
         $searchTerm = $request->get('term', false);
@@ -83,25 +83,7 @@ class SearchController extends Controller
             $entities = (new Popular())->run(20, 0, $entityTypes);
         }
 
-        return view('search.parts.entity-selector-list', ['entities' => $entities, 'permission' => $permission]);
-    }
-
-    /**
-     * Search for a list of entities and return a partial HTML response of matching entities
-     * to be used as a result preview suggestion list for global system searches.
-     */
-    public function searchSuggestions(Request $request)
-    {
-        $searchTerm = $request->get('term', '');
-        $entities = $this->searchRunner->searchEntities(SearchOptions::fromString($searchTerm), 'all', 1, 5)['results'];
-
-        foreach ($entities as $entity) {
-            $entity->setAttribute('preview_content', '');
-        }
-
-        return view('search.parts.entity-suggestion-list', [
-            'entities' => $entities->slice(0, 5)
-        ]);
+        return view('search.parts.entity-ajax-list', ['entities' => $entities, 'permission' => $permission]);
     }
 
     /**

app/Http/Controllers/SettingController.php

@@ -4,14 +4,20 @@ namespace BookStack\Http\Controllers;
 
 use BookStack\Actions\ActivityType;
 use BookStack\Auth\User;
-use BookStack\Settings\AppSettingsStore;
 use BookStack\Uploads\ImageRepo;
 use Illuminate\Http\Request;
 
 class SettingController extends Controller
 {
+    protected ImageRepo $imageRepo;
+
     protected array $settingCategories = ['features', 'customization', 'registration'];
 
+    public function __construct(ImageRepo $imageRepo)
+    {
+        $this->imageRepo = $imageRepo;
+    }
+
     /**
      * Handle requests to the settings index path.
      */
@@ -42,17 +48,37 @@ class SettingController extends Controller
     /**
      * Update the specified settings in storage.
      */
-    public function update(Request $request, AppSettingsStore $store, string $category)
+    public function update(Request $request, string $category)
     {
         $this->ensureCategoryExists($category);
         $this->preventAccessInDemoMode();
         $this->checkPermission('settings-manage');
         $this->validate($request, [
-            'app_logo' => ['nullable', ...$this->getImageValidationRules()],
-            'app_icon' => ['nullable', ...$this->getImageValidationRules()],
+            'app_logo' => array_merge(['nullable'], $this->getImageValidationRules()),
         ]);
 
-        $store->storeFromUpdateRequest($request, $category);
+        // Cycles through posted settings and update them
+        foreach ($request->all() as $name => $value) {
+            $key = str_replace('setting-', '', trim($name));
+            if (strpos($name, 'setting-') !== 0) {
+                continue;
+            }
+            setting()->put($key, $value);
+        }
+
+        // Update logo image if set
+        if ($category === 'customization' && $request->hasFile('app_logo')) {
+            $logoFile = $request->file('app_logo');
+            $this->imageRepo->destroyByType('system');
+            $image = $this->imageRepo->saveNew($logoFile, 'system', 0, null, 86);
+            setting()->put('app-logo', $image->url);
+        }
+
+        // Clear logo image if requested
+        if ($category === 'customization' && $request->get('app_logo_reset', null)) {
+            $this->imageRepo->destroyByType('system');
+            setting()->remove('app-logo');
+        }
 
         $this->logActivity(ActivityType::SETTINGS_UPDATE, $category);
         $this->showSuccessNotification(trans('settings.settings_save_success'));

app/Http/Controllers/TagController.php

@@ -3,14 +3,15 @@
 namespace BookStack\Http\Controllers;
 
 use BookStack\Actions\TagRepo;
-use BookStack\Util\SimpleListOptions;
 use Illuminate\Http\Request;
 
 class TagController extends Controller
 {
-    public function __construct(
-        protected TagRepo $tagRepo
-    ) {
+    protected TagRepo $tagRepo;
+
+    public function __construct(TagRepo $tagRepo)
+    {
+        $this->tagRepo = $tagRepo;
     }
 
     /**
@@ -18,25 +19,22 @@ class TagController extends Controller
      */
     public function index(Request $request)
     {
-        $listOptions = SimpleListOptions::fromRequest($request, 'tags')->withSortOptions([
-            'name' => trans('common.sort_name'),
-            'usages' => trans('entities.tags_usages'),
-        ]);
-
+        $search = $request->get('search', '');
         $nameFilter = $request->get('name', '');
         $tags = $this->tagRepo
-            ->queryWithTotals($listOptions, $nameFilter)
+            ->queryWithTotals($search, $nameFilter)
             ->paginate(50)
-            ->appends(array_filter(array_merge($listOptions->getPaginationAppends(), [
+            ->appends(array_filter([
+                'search' => $search,
                 'name'   => $nameFilter,
-            ])));
+            ]));
 
         $this->setPageTitle(trans('entities.tags'));
 
         return view('tags.index', [
-            'tags'        => $tags,
-            'nameFilter'  => $nameFilter,
-            'listOptions' => $listOptions,
+            'tags'       => $tags,
+            'search'     => $search,
+            'nameFilter' => $nameFilter,
         ]);
     }
 

app/Http/Controllers/UserController.php

@@ -3,13 +3,13 @@
 namespace BookStack\Http\Controllers;
 
 use BookStack\Auth\Access\SocialAuthService;
-use BookStack\Auth\Queries\UsersAllPaginatedAndSorted;
+use BookStack\Auth\Queries\AllUsersPaginatedAndSorted;
 use BookStack\Auth\Role;
+use BookStack\Auth\User;
 use BookStack\Auth\UserRepo;
 use BookStack\Exceptions\ImageUploadException;
 use BookStack\Exceptions\UserUpdateException;
 use BookStack\Uploads\ImageRepo;
-use BookStack\Util\SimpleListOptions;
 use Exception;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
@@ -21,6 +21,9 @@ class UserController extends Controller
     protected UserRepo $userRepo;
     protected ImageRepo $imageRepo;
 
+    /**
+     * UserController constructor.
+     */
     public function __construct(UserRepo $userRepo, ImageRepo $imageRepo)
     {
         $this->userRepo = $userRepo;
@@ -33,23 +36,20 @@ class UserController extends Controller
     public function index(Request $request)
     {
         $this->checkPermission('users-manage');
+        $listDetails = [
+            'order'  => $request->get('order', 'asc'),
+            'search' => $request->get('search', ''),
+            'sort'   => $request->get('sort', 'name'),
+        ];
 
-        $listOptions = SimpleListOptions::fromRequest($request, 'users')->withSortOptions([
-            'name' => trans('common.sort_name'),
-            'email' => trans('auth.email'),
-            'created_at' => trans('common.sort_created_at'),
-            'updated_at' => trans('common.sort_updated_at'),
-            'last_activity_at' => trans('settings.users_latest_activity'),
-        ]);
-
-        $users = (new UsersAllPaginatedAndSorted())->run(20, $listOptions);
+        $users = (new AllUsersPaginatedAndSorted())->run(20, $listDetails);
 
         $this->setPageTitle(trans('settings.users'));
-        $users->appends($listOptions->getPaginationAppends());
+        $users->appends($listDetails);
 
         return view('users.index', [
             'users'       => $users,
-            'listOptions' => $listOptions,
+            'listDetails' => $listDetails,
         ]);
     }
 
@@ -107,8 +107,9 @@ class UserController extends Controller
     {
         $this->checkPermissionOrCurrentUser('users-manage', $id);
 
-        $user = $this->userRepo->getById($id);
-        $user->load(['apiTokens', 'mfaValues']);
+        /** @var User $user */
+        $user = User::query()->with(['apiTokens', 'mfaValues'])->findOrFail($id);
+
         $authMethod = ($user->system_name) ? 'system' : config('auth.method');
 
         $activeSocialDrivers = $socialAuthService->getActiveDrivers();
@@ -164,8 +165,6 @@ class UserController extends Controller
         // Delete the profile image if reset option is in request
         if ($request->has('profile_image_reset')) {
             $this->imageRepo->destroyImage($user->avatar);
-            $user->image_id = 0;
-            $user->save();
         }
 
         $redirectUrl = userCan('users-manage') ? '/settings/users' : "/settings/users/{$user->id}";
@@ -197,10 +196,143 @@ class UserController extends Controller
         $this->checkPermissionOrCurrentUser('users-manage', $id);
 
         $user = $this->userRepo->getById($id);
-        $newOwnerId = intval($request->get('new_owner_id')) ?: null;
+        $newOwnerId = $request->get('new_owner_id', null);
 
         $this->userRepo->destroy($user, $newOwnerId);
 
         return redirect('/settings/users');
     }
+
+    /**
+     * Update the user's preferred book-list display setting.
+     */
+    public function switchBooksView(Request $request, int $id)
+    {
+        return $this->switchViewType($id, $request, 'books');
+    }
+
+    /**
+     * Update the user's preferred shelf-list display setting.
+     */
+    public function switchShelvesView(Request $request, int $id)
+    {
+        return $this->switchViewType($id, $request, 'bookshelves');
+    }
+
+    /**
+     * Update the user's preferred shelf-view book list display setting.
+     */
+    public function switchShelfView(Request $request, int $id)
+    {
+        return $this->switchViewType($id, $request, 'bookshelf');
+    }
+
+    /**
+     * For a type of list, switch with stored view type for a user.
+     */
+    protected function switchViewType(int $userId, Request $request, string $listName)
+    {
+        $this->checkPermissionOrCurrentUser('users-manage', $userId);
+
+        $viewType = $request->get('view_type');
+        if (!in_array($viewType, ['grid', 'list'])) {
+            $viewType = 'list';
+        }
+
+        $user = $this->userRepo->getById($userId);
+        $key = $listName . '_view_type';
+        setting()->putUser($user, $key, $viewType);
+
+        return redirect()->back(302, [], "/settings/users/$userId");
+    }
+
+    /**
+     * Change the stored sort type for a particular view.
+     */
+    public function changeSort(Request $request, string $id, string $type)
+    {
+        $validSortTypes = ['books', 'bookshelves', 'shelf_books'];
+        if (!in_array($type, $validSortTypes)) {
+            return redirect()->back(500);
+        }
+
+        return $this->changeListSort($id, $request, $type);
+    }
+
+    /**
+     * Toggle dark mode for the current user.
+     */
+    public function toggleDarkMode()
+    {
+        $enabled = setting()->getForCurrentUser('dark-mode-enabled', false);
+        setting()->putUser(user(), 'dark-mode-enabled', $enabled ? 'false' : 'true');
+
+        return redirect()->back();
+    }
+
+    /**
+     * Update the stored section expansion preference for the given user.
+     */
+    public function updateExpansionPreference(Request $request, string $id, string $key)
+    {
+        $this->checkPermissionOrCurrentUser('users-manage', $id);
+        $keyWhitelist = ['home-details'];
+        if (!in_array($key, $keyWhitelist)) {
+            return response('Invalid key', 500);
+        }
+
+        $newState = $request->get('expand', 'false');
+
+        $user = $this->userRepo->getById($id);
+        setting()->putUser($user, 'section_expansion#' . $key, $newState);
+
+        return response('', 204);
+    }
+
+    public function updateCodeLanguageFavourite(Request $request)
+    {
+        $validated = $this->validate($request, [
+            'language' => ['required', 'string', 'max:20'],
+            'active'   => ['required', 'bool'],
+        ]);
+
+        $currentFavoritesStr = setting()->getForCurrentUser('code-language-favourites', '');
+        $currentFavorites = array_filter(explode(',', $currentFavoritesStr));
+
+        $isFav = in_array($validated['language'], $currentFavorites);
+        if (!$isFav && $validated['active']) {
+            $currentFavorites[] = $validated['language'];
+        } elseif ($isFav && !$validated['active']) {
+            $index = array_search($validated['language'], $currentFavorites);
+            array_splice($currentFavorites, $index, 1);
+        }
+
+        setting()->putUser(user(), 'code-language-favourites', implode(',', $currentFavorites));
+    }
+
+    /**
+     * Changed the stored preference for a list sort order.
+     */
+    protected function changeListSort(int $userId, Request $request, string $listName)
+    {
+        $this->checkPermissionOrCurrentUser('users-manage', $userId);
+
+        $sort = $request->get('sort');
+        if (!in_array($sort, ['name', 'created_at', 'updated_at', 'default'])) {
+            $sort = 'name';
+        }
+
+        $order = $request->get('order');
+        if (!in_array($order, ['asc', 'desc'])) {
+            $order = 'asc';
+        }
+
+        $user = $this->userRepo->getById($userId);
+        $sortKey = $listName . '_sort';
+        $orderKey = $listName . '_sort_order';
+        setting()->putUser($user, $sortKey, $sort);
+        setting()->putUser($user, $orderKey, $order);
+
+        return redirect()->back(302, [], "/settings/users/$userId");
+    }
 }

app/Http/Controllers/UserPreferencesController.php

@@ -1,142 +0,0 @@
-<?php
-
-namespace BookStack\Http\Controllers;
-
-use BookStack\Auth\UserRepo;
-use BookStack\Settings\UserShortcutMap;
-use Illuminate\Http\Request;
-
-class UserPreferencesController extends Controller
-{
-    protected UserRepo $userRepo;
-
-    public function __construct(UserRepo $userRepo)
-    {
-        $this->userRepo = $userRepo;
-    }
-
-    /**
-     * Show the user-specific interface shortcuts.
-     */
-    public function showShortcuts()
-    {
-        $shortcuts = UserShortcutMap::fromUserPreferences();
-        $enabled = setting()->getForCurrentUser('ui-shortcuts-enabled', false);
-
-        return view('users.preferences.shortcuts', [
-            'shortcuts' => $shortcuts,
-            'enabled' => $enabled,
-        ]);
-    }
-
-    /**
-     * Update the user-specific interface shortcuts.
-     */
-    public function updateShortcuts(Request $request)
-    {
-        $enabled = $request->get('enabled') === 'true';
-        $providedShortcuts = $request->get('shortcut', []);
-        $shortcuts = new UserShortcutMap($providedShortcuts);
-
-        setting()->putForCurrentUser('ui-shortcuts', $shortcuts->toJson());
-        setting()->putForCurrentUser('ui-shortcuts-enabled', $enabled);
-
-        $this->showSuccessNotification(trans('preferences.shortcuts_update_success'));
-
-        return redirect('/preferences/shortcuts');
-    }
-
-    /**
-     * Update the preferred view format for a list view of the given type.
-     */
-    public function changeView(Request $request, string $type)
-    {
-        $valueViewTypes = ['books', 'bookshelves', 'bookshelf'];
-        if (!in_array($type, $valueViewTypes)) {
-            return redirect()->back(500);
-        }
-
-        $view = $request->get('view');
-        if (!in_array($view, ['grid', 'list'])) {
-            $view = 'list';
-        }
-
-        $key = $type . '_view_type';
-        setting()->putForCurrentUser($key, $view);
-
-        return redirect()->back(302, [], "/");
-    }
-
-    /**
-     * Change the stored sort type for a particular view.
-     */
-    public function changeSort(Request $request, string $type)
-    {
-        $validSortTypes = ['books', 'bookshelves', 'shelf_books', 'users', 'roles', 'webhooks', 'tags', 'page_revisions'];
-        if (!in_array($type, $validSortTypes)) {
-            return redirect()->back(500);
-        }
-
-        $sort = substr($request->get('sort') ?: 'name', 0, 50);
-        $order = $request->get('order') === 'desc' ? 'desc' : 'asc';
-
-        $sortKey = $type . '_sort';
-        $orderKey = $type . '_sort_order';
-        setting()->putForCurrentUser($sortKey, $sort);
-        setting()->putForCurrentUser($orderKey, $order);
-
-        return redirect()->back(302, [], "/");
-    }
-
-    /**
-     * Toggle dark mode for the current user.
-     */
-    public function toggleDarkMode()
-    {
-        $enabled = setting()->getForCurrentUser('dark-mode-enabled', false);
-        setting()->putForCurrentUser('dark-mode-enabled', $enabled ? 'false' : 'true');
-
-        return redirect()->back();
-    }
-
-    /**
-     * Update the stored section expansion preference for the given user.
-     */
-    public function changeExpansion(Request $request, string $type)
-    {
-        $typeWhitelist = ['home-details'];
-        if (!in_array($type, $typeWhitelist)) {
-            return response('Invalid key', 500);
-        }
-
-        $newState = $request->get('expand', 'false');
-        setting()->putForCurrentUser('section_expansion#' . $type, $newState);
-
-        return response('', 204);
-    }
-
-    /**
-     * Update the favorite status for a code language.
-     */
-    public function updateCodeLanguageFavourite(Request $request)
-    {
-        $validated = $this->validate($request, [
-            'language' => ['required', 'string', 'max:20'],
-            'active'   => ['required', 'bool'],
-        ]);
-
-        $currentFavoritesStr = setting()->getForCurrentUser('code-language-favourites', '');
-        $currentFavorites = array_filter(explode(',', $currentFavoritesStr));
-
-        $isFav = in_array($validated['language'], $currentFavorites);
-        if (!$isFav && $validated['active']) {
-            $currentFavorites[] = $validated['language'];
-        } elseif ($isFav && !$validated['active']) {
-            $index = array_search($validated['language'], $currentFavorites);
-            array_splice($currentFavorites, $index, 1);
-        }
-
-        setting()->putForCurrentUser('code-language-favourites', implode(',', $currentFavorites));
-        return response('', 204);
-    }
-}

app/Http/Controllers/WebhookController.php

@@ -3,9 +3,7 @@
 namespace BookStack\Http\Controllers;
 
 use BookStack\Actions\ActivityType;
-use BookStack\Actions\Queries\WebhooksAllPaginatedAndSorted;
 use BookStack\Actions\Webhook;
-use BookStack\Util\SimpleListOptions;
 use Illuminate\Http\Request;
 
 class WebhookController extends Controller
@@ -20,25 +18,16 @@ class WebhookController extends Controller
     /**
      * Show all webhooks configured in the system.
      */
-    public function index(Request $request)
+    public function index()
     {
-        $listOptions = SimpleListOptions::fromRequest($request, 'webhooks')->withSortOptions([
-            'name' => trans('common.sort_name'),
-            'endpoint'  => trans('settings.webhooks_endpoint'),
-            'created_at' => trans('common.sort_created_at'),
-            'updated_at' => trans('common.sort_updated_at'),
-            'active'     => trans('common.status'),
-        ]);
-
-        $webhooks = (new WebhooksAllPaginatedAndSorted())->run(20, $listOptions);
-        $webhooks->appends($listOptions->getPaginationAppends());
+        $webhooks = Webhook::query()
+            ->orderBy('name', 'desc')
+            ->with('trackedEvents')
+            ->get();
 
         $this->setPageTitle(trans('settings.webhooks'));
 
-        return view('settings.webhooks.index', [
-            'webhooks'    => $webhooks,
-            'listOptions' => $listOptions,
-        ]);
+        return view('settings.webhooks.index', ['webhooks' => $webhooks]);
     }
 
     /**

app/Http/Request.php

@@ -9,8 +9,10 @@ class Request extends LaravelRequest
     /**
      * Override the default request methods to get the scheme and host
      * to directly use the custom APP_URL, if set.
+     *
+     * @return string
      */
-    public function getSchemeAndHttpHost(): string
+    public function getSchemeAndHttpHost()
     {
         $appUrl = config('app.url', null);
 
@@ -25,8 +27,10 @@ class Request extends LaravelRequest
      * Override the default request methods to get the base URL
      * to directly use the custom APP_URL, if set.
      * The base URL never ends with a / but should start with one if not empty.
+     *
+     * @return string
      */
-    public function getBaseUrl(): string
+    public function getBaseUrl()
     {
         $appUrl = config('app.url', null);
 

app/Providers/AppServiceProvider.php

@@ -8,16 +8,16 @@ use BookStack\Entities\Models\Book;
 use BookStack\Entities\Models\Bookshelf;
 use BookStack\Entities\Models\Chapter;
 use BookStack\Entities\Models\Page;
-use BookStack\Exceptions\BookStackExceptionHandlerPage;
+use BookStack\Exceptions\WhoopsBookStackPrettyHandler;
 use BookStack\Settings\SettingService;
 use BookStack\Util\CspService;
 use GuzzleHttp\Client;
-use Illuminate\Contracts\Foundation\ExceptionRenderer;
 use Illuminate\Database\Eloquent\Relations\Relation;
 use Illuminate\Support\Facades\Schema;
 use Illuminate\Support\Facades\URL;
 use Illuminate\Support\ServiceProvider;
 use Psr\Http\Client\ClientInterface as HttpClientInterface;
+use Whoops\Handler\HandlerInterface;
 
 class AppServiceProvider extends ServiceProvider
 {
@@ -26,7 +26,7 @@ class AppServiceProvider extends ServiceProvider
      * @var string[]
      */
     public $bindings = [
-        ExceptionRenderer::class => BookStackExceptionHandlerPage::class,
+        HandlerInterface::class => WhoopsBookStackPrettyHandler::class,
     ];
 
     /**

app/Providers/AuthServiceProvider.php

@@ -6,7 +6,7 @@ use BookStack\Api\ApiTokenGuard;
 use BookStack\Auth\Access\ExternalBaseUserProvider;
 use BookStack\Auth\Access\Guards\AsyncExternalBaseSessionGuard;
 use BookStack\Auth\Access\Guards\LdapSessionGuard;
-use BookStack\Auth\Access\LdapService;
+use BookStack\Auth\Access\Ldap\LdapService;
 use BookStack\Auth\Access\LoginService;
 use BookStack\Auth\Access\RegistrationService;
 use Illuminate\Support\Facades\Auth;

app/Providers/EventServiceProvider.php

@@ -24,22 +24,11 @@ class EventServiceProvider extends ServiceProvider
     ];
 
     /**
-     * Register any events for your application.
+     * Register any other events for your application.
      *
      * @return void
      */
     public function boot()
     {
-        //
-    }
-
-    /**
-     * Determine if events and listeners should be automatically discovered.
-     *
-     * @return bool
-     */
-    public function shouldDiscoverEvents()
-    {
-        return false;
     }
 }

app/Providers/RouteServiceProvider.php

@@ -19,6 +19,14 @@ class RouteServiceProvider extends ServiceProvider
      */
     public const HOME = '/';
 
+    /**
+     * This namespace is applied to the controller routes in your routes file.
+     *
+     * In addition, it is set as the URL generator's root namespace.
+     *
+     * @var string
+     */
+
     /**
      * Define your route model bindings, pattern filters, etc.
      *
@@ -77,7 +85,7 @@ class RouteServiceProvider extends ServiceProvider
     protected function configureRateLimiting()
     {
         RateLimiter::for('api', function (Request $request) {
-            return Limit::perMinute(60)->by($request->user()?->id ?: $request->ip());
+            return Limit::perMinute(60)->by(optional($request->user())->id ?: $request->ip());
         });
     }
 }

app/Providers/TranslationServiceProvider.php

@@ -3,41 +3,10 @@
 namespace BookStack\Providers;
 
 use BookStack\Translation\FileLoader;
-use BookStack\Translation\MessageSelector;
 use Illuminate\Translation\TranslationServiceProvider as BaseProvider;
-use Illuminate\Translation\Translator;
 
 class TranslationServiceProvider extends BaseProvider
 {
-    /**
-     * Register the service provider.
-     *
-     * @return void
-     */
-    public function register()
-    {
-        $this->registerLoader();
-
-        // This is a tweak upon Laravel's based translation service registration to allow
-        // usage of a custom MessageSelector class
-        $this->app->singleton('translator', function ($app) {
-            $loader = $app['translation.loader'];
-
-            // When registering the translator component, we'll need to set the default
-            // locale as well as the fallback locale. So, we'll grab the application
-            // configuration so we can easily get both of these values from there.
-            $locale = $app['config']['app.locale'];
-
-            $trans = new Translator($loader, $locale);
-            $trans->setFallback($app['config']['app.fallback_locale']);
-            $trans->setSelector(new MessageSelector());
-
-            return $trans;
-        });
-    }
-
-
-
     /**
      * Register the translation line loader.
      * Overrides the default register action from Laravel so a custom loader can be used.

app/Providers/ValidationRuleServiceProvider.php

@@ -21,8 +21,8 @@ class ValidationRuleServiceProvider extends ServiceProvider
 
         Validator::extend('safe_url', function ($attribute, $value, $parameters, $validator) {
             $cleanLinkName = strtolower(trim($value));
-            $isJs = str_starts_with($cleanLinkName, 'javascript:');
-            $isData = str_starts_with($cleanLinkName, 'data:');
+            $isJs = strpos($cleanLinkName, 'javascript:') === 0;
+            $isData = strpos($cleanLinkName, 'data:') === 0;
 
             return !$isJs && !$isData;
         });

app/References/CrossLinkParser.php

@@ -54,10 +54,10 @@ class CrossLinkParser
     {
         $links = [];
 
-        $html = '<?xml encoding="utf-8" ?><body>' . $html . '</body>';
+        $html = '<body>' . $html . '</body>';
         libxml_use_internal_errors(true);
         $doc = new DOMDocument();
-        $doc->loadHTML($html);
+        $doc->loadHTML(mb_convert_encoding($html, 'HTML-ENTITIES', 'UTF-8'));
 
         $xPath = new DOMXPath($doc);
         $anchors = $xPath->query('//a[@href]');

app/References/Reference.php

@@ -2,9 +2,7 @@
 
 namespace BookStack\References;
 
-use BookStack\Auth\Permissions\JointPermission;
 use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Database\Eloquent\Relations\MorphTo;
 
 /**
@@ -26,10 +24,4 @@ class Reference extends Model
     {
         return $this->morphTo('to');
     }
-
-    public function jointPermissions(): HasMany
-    {
-        return $this->hasMany(JointPermission::class, 'entity_id', 'from_id')
-            ->whereColumn('references.from_type', '=', 'joint_permissions.entity_type');
-    }
 }

app/References/ReferenceFetcher.php

@@ -5,7 +5,6 @@ namespace BookStack\References;
 use BookStack\Auth\Permissions\PermissionApplicator;
 use BookStack\Entities\Models\Entity;
 use BookStack\Entities\Models\Page;
-use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Collection;
 use Illuminate\Database\Eloquent\Relations\Relation;
 
@@ -24,7 +23,8 @@ class ReferenceFetcher
      */
     public function getPageReferencesToEntity(Entity $entity): Collection
     {
-        $baseQuery = $this->queryPageReferencesToEntity($entity)
+        $baseQuery = $entity->referencesTo()
+            ->where('from_type', '=', (new Page())->getMorphClass())
             ->with([
                 'from'         => fn (Relation $query) => $query->select(Page::$listAttributes),
                 'from.book'    => fn (Relation $query) => $query->scopes('visible'),
@@ -47,8 +47,11 @@ class ReferenceFetcher
      */
     public function getPageReferenceCountToEntity(Entity $entity): int
     {
+        $baseQuery = $entity->referencesTo()
+            ->where('from_type', '=', (new Page())->getMorphClass());
+
         $count = $this->permissions->restrictEntityRelationQuery(
-            $this->queryPageReferencesToEntity($entity),
+            $baseQuery,
             'references',
             'from_id',
             'from_type'
@@ -56,12 +59,4 @@ class ReferenceFetcher
 
         return $count;
     }
-
-    protected function queryPageReferencesToEntity(Entity $entity): Builder
-    {
-        return Reference::query()
-            ->where('to_type', '=', $entity->getMorphClass())
-            ->where('to_id', '=', $entity->id)
-            ->where('from_type', '=', (new Page())->getMorphClass());
-    }
 }

app/Search/SearchIndex.php

@@ -15,18 +15,25 @@ class SearchIndex
 {
     /**
      * A list of delimiter characters used to break-up parsed content into terms for indexing.
+     *
+     * @var string
      */
-    public static string $delimiters = " \n\t.,!?:;()[]{}<>`'\"";
+    public static $delimiters = " \n\t.,!?:;()[]{}<>`'\"";
 
-    public function __construct(
-        protected EntityProvider $entityProvider
-    ) {
+    /**
+     * @var EntityProvider
+     */
+    protected $entityProvider;
+
+    public function __construct(EntityProvider $entityProvider)
+    {
+        $this->entityProvider = $entityProvider;
     }
 
     /**
      * Index the given entity.
      */
-    public function indexEntity(Entity $entity): void
+    public function indexEntity(Entity $entity)
     {
         $this->deleteEntityTerms($entity);
         $terms = $this->entityToTermDataArray($entity);
@@ -38,7 +45,7 @@ class SearchIndex
      *
      * @param Entity[] $entities
      */
-    public function indexEntities(array $entities): void
+    public function indexEntities(array $entities)
     {
         $terms = [];
         foreach ($entities as $entity) {
@@ -62,7 +69,7 @@ class SearchIndex
      *
      * @param callable(Entity, int, int):void|null $progressCallback
      */
-    public function indexAllEntities(?callable $progressCallback = null): void
+    public function indexAllEntities(?callable $progressCallback = null)
     {
         SearchTerm::query()->truncate();
 
@@ -94,7 +101,7 @@ class SearchIndex
     /**
      * Delete related Entity search terms.
      */
-    public function deleteEntityTerms(Entity $entity): void
+    public function deleteEntityTerms(Entity $entity)
     {
         $entity->searchTerms()->delete();
     }
@@ -105,12 +112,12 @@ class SearchIndex
      *
      * @returns array<string, int>
      */
-    protected function generateTermScoreMapFromText(string $text, float $scoreAdjustment = 1): array
+    protected function generateTermScoreMapFromText(string $text, int $scoreAdjustment = 1): array
     {
         $termMap = $this->textToTermCountMap($text);
 
         foreach ($termMap as $term => $count) {
-            $termMap[$term] = floor($count * $scoreAdjustment);
+            $termMap[$term] = $count * $scoreAdjustment;
         }
 
         return $termMap;
@@ -138,12 +145,12 @@ class SearchIndex
             'h6' => 1.5,
         ];
 
-        $html = '<?xml encoding="utf-8" ?><body>' . $html . '</body>';
+        $html = '<body>' . $html . '</body>';
         $html = str_ireplace(['<br>', '<br />', '<br/>'], "\n", $html);
 
         libxml_use_internal_errors(true);
         $doc = new DOMDocument();
-        $doc->loadHTML($html);
+        $doc->loadHTML(mb_convert_encoding($html, 'HTML-ENTITIES', 'UTF-8'));
 
         $topElems = $doc->documentElement->childNodes->item(0)->childNodes;
         /** @var DOMNode $child */

app/Search/SearchRunner.php

@@ -50,7 +50,7 @@ class SearchRunner
      * The provided count is for each entity to search,
      * Total returned could be larger and not guaranteed.
      *
-     * @return array{total: int, count: int, has_more: bool, results: Collection<Entity>}
+     * @return array{total: int, count: int, has_more: bool, results: Entity[]}
      */
     public function searchEntities(SearchOptions $searchOpts, string $entityType = 'all', int $page = 1, int $count = 20): array
     {
@@ -173,7 +173,6 @@ class SearchRunner
         // Handle exact term matching
         foreach ($searchOpts->exacts as $inputTerm) {
             $entityQuery->where(function (EloquentBuilder $query) use ($inputTerm, $entityModelInstance) {
-                $inputTerm = str_replace('\\', '\\\\', $inputTerm);
                 $query->where('name', 'like', '%' . $inputTerm . '%')
                     ->orWhere($entityModelInstance->textField, 'like', '%' . $inputTerm . '%');
             });
@@ -219,7 +218,6 @@ class SearchRunner
         $subQuery->where('entity_type', '=', $entity->getMorphClass());
         $subQuery->where(function (Builder $query) use ($terms) {
             foreach ($terms as $inputTerm) {
-                $inputTerm = str_replace('\\', '\\\\', $inputTerm);
                 $query->orWhere('term', 'like', $inputTerm . '%');
             }
         });
@@ -356,9 +354,6 @@ class SearchRunner
                     $tagValue = (float) trim($connection->getPdo()->quote($tagValue), "'");
                     $query->whereRaw("value {$tagOperator} {$tagValue}");
                 } else {
-                    if ($tagOperator === 'like') {
-                        $tagValue = str_replace('\\', '\\\\', $tagValue);
-                    }
                     $query->where('value', $tagOperator, $tagValue);
                 }
             } else {

app/Settings/AppSettingsStore.php

@@ -1,95 +0,0 @@
-<?php
-
-namespace BookStack\Settings;
-
-use BookStack\Uploads\FaviconHandler;
-use BookStack\Uploads\ImageRepo;
-use Illuminate\Http\Request;
-
-class AppSettingsStore
-{
-    public function __construct(
-        protected ImageRepo $imageRepo,
-        protected FaviconHandler $faviconHandler,
-    ) {
-    }
-
-    public function storeFromUpdateRequest(Request $request, string $category)
-    {
-        $this->storeSimpleSettings($request);
-        if ($category === 'customization') {
-            $this->updateAppLogo($request);
-            $this->updateAppIcon($request);
-        }
-    }
-
-    protected function updateAppIcon(Request $request): void
-    {
-        $sizes = [180, 128, 64, 32];
-
-        // Update icon image if set
-        if ($request->hasFile('app_icon')) {
-            $iconFile = $request->file('app_icon');
-            $this->destroyExistingSettingImage('app-icon');
-            $image = $this->imageRepo->saveNew($iconFile, 'system', 0, 256, 256);
-            setting()->put('app-icon', $image->url);
-
-            foreach ($sizes as $size) {
-                $this->destroyExistingSettingImage('app-icon-' . $size);
-                $icon = $this->imageRepo->saveNew($iconFile, 'system', 0, $size, $size);
-                setting()->put('app-icon-' . $size, $icon->url);
-            }
-
-            $this->faviconHandler->saveForUploadedImage($iconFile);
-        }
-
-        // Clear icon image if requested
-        if ($request->get('app_icon_reset')) {
-            $this->destroyExistingSettingImage('app-icon');
-            setting()->remove('app-icon');
-            foreach ($sizes as $size) {
-                $this->destroyExistingSettingImage('app-icon-' . $size);
-                setting()->remove('app-icon-' . $size);
-            }
-
-            $this->faviconHandler->restoreOriginal();
-        }
-    }
-
-    protected function updateAppLogo(Request $request): void
-    {
-        // Update logo image if set
-        if ($request->hasFile('app_logo')) {
-            $logoFile = $request->file('app_logo');
-            $this->destroyExistingSettingImage('app-logo');
-            $image = $this->imageRepo->saveNew($logoFile, 'system', 0, null, 86);
-            setting()->put('app-logo', $image->url);
-        }
-
-        // Clear logo image if requested
-        if ($request->get('app_logo_reset')) {
-            $this->destroyExistingSettingImage('app-logo');
-            setting()->remove('app-logo');
-        }
-    }
-
-    protected function storeSimpleSettings(Request $request): void
-    {
-        foreach ($request->all() as $name => $value) {
-            if (strpos($name, 'setting-') !== 0) {
-                continue;
-            }
-
-            $key = str_replace('setting-', '', trim($name));
-            setting()->put($key, $value);
-        }
-    }
-
-    protected function destroyExistingSettingImage(string $settingKey)
-    {
-        $existingVal = setting()->get($settingKey);
-        if ($existingVal) {
-            $this->imageRepo->destroyByUrlAndType($existingVal, 'system');
-        }
-    }
-}