Viewers are able to copy pages across books #1411

New Issue

OVERLORD · 2026-02-05T00:49:58+03:00

OVERLORD commented

2026-02-05 00:49:58 +03:00

Originally created by @grighi on GitHub (Oct 17, 2019).

Describe the bug
Viewers are able to copy pages across books. I may be missing something, but this seems to be different than the intended role (i.e. able to view but not able to edit books).

Steps To Reproduce
Steps to reproduce the behavior:

Login in as a user with role Viewer
Open the page of a book
Copy is in the Action pane for a page

Expected behavior
For viewers, the only button in the action pane should be export.

Your Configuration (please complete the following information):

Exact BookStack Version (Found in settings): 0.27.4

Originally created by @grighi on GitHub (Oct 17, 2019). **Describe the bug** Viewers are able to copy pages across books. I may be missing something, but this seems to be different than the intended role (i.e. able to view but not able to edit books). **Steps To Reproduce** Steps to reproduce the behavior: 1. Login in as a user with role Viewer 2. Open the page of a book 3. Copy is in the Action pane for a page **Expected behavior** For viewers, the only button in the action pane should be export. **Your Configuration (please complete the following information):** - Exact BookStack Version (Found in settings): 0.27.4

OVERLORD closed this issue

2026-02-05 00:50:01 +03:00

OVERLORD commented

2026-02-05 00:50:05 +03:00

@ssddanbrown commented on GitHub (Oct 17, 2019):

Hi @grighi,
The "Copy" option should only show to someone if they have permission on any book or chapter to create pages within. You may see this for such "Viewer" roles, where they don't have creation abilities at the role level, if custom entity-level permissions have been granted.

You could test this by acting as a viewer, and click the option to copy a page, then open the "Destination" panel. If you see a few select chapters or books in there then it's likely custom set permissions at play.

@ssddanbrown commented on GitHub (Oct 17, 2019): Hi @grighi, The "Copy" option should only show to someone if they have permission on any book or chapter to create pages within. You may see this for such "Viewer" roles, where they don't have creation abilities at the role level, if custom entity-level permissions have been granted. You could test this by acting as a viewer, and click the option to copy a page, then open the "Destination" panel. If you see a few select chapters or books in there then it's likely custom set permissions at play.

OVERLORD commented

2026-02-05 00:50:10 +03:00

@grighi commented on GitHub (Oct 17, 2019):

Yep, tried to reproduce it and realized I had changed a book permission, thanks.

@grighi commented on GitHub (Oct 17, 2019): Yep, tried to reproduce it and realized I had changed a book permission, thanks.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#1411