mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-05 00:29:48 +03:00
Creating a book with chapters from user1 (administrator) show up on user2 recently viewed on the home page #2214
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Mynster9361 on GitHub (Apr 22, 2021).
Describe the bug
Creating a book with chapters from user1 (administrator) show up on user2 recently viewed on the home page.
The user2 that did not create it and does not have access to that page is able to use the shortcut from recently viewed and then see the content of that chapter and pages within that chapter and also edit them as long as there is not setup any custom permissions.
You are able to go to the chapter but from there you are not able to access the book (You get an error if you try and alter the url directly to the book)
Steps To Reproduce
Steps to reproduce the behavior:
Expected behavior
I do not expect to see user1 recently created chapter from user2 recently viewed.
And i do not expect that user2 can access the chapter and pages within that chapter
Screenshots
If applicable, add screenshots to help explain your problem.
Created book with chapter and page from user1
Shortcut in recently viewed on user2 home page
Book permissions
Chapter permissions
User2 group role
Public role access
Your Configuration (please complete the following information):
Additional context
If i set custom permissions on the book user2 is no longer able to access the chapter or the content within the chapters
@ssddanbrown commented on GitHub (Apr 27, 2021):
Thanks for reporting @Mynster9361, I can confirm this on my instance.
This is, in particular, evident when the secondary user is fresh with little of their own activity. Needs a reworking of the code/scoping within
e4660a5ba2/app/Actions/ViewService.php (L98)Have assigned to be addressed in the next patch release.
Note, with that shown permission setup "User 2" will always have access to any page or chapter by default unless their permissions are specifically over-ridden. They could see them in the recently updated or via search. Just mentioning in case your intentions/thinking was different.
@Mynster9361 commented on GitHub (Apr 27, 2021):
I did not even realize that.
Thanks a lot :)
Sounds good with the update aswell :)
@ssddanbrown commented on GitHub (Apr 28, 2021):
Patch applied and released in: https://github.com/BookStackApp/BookStack/releases/tag/v21.04.3
Let me know if the issue still persists but that should do it, I did add a test to cover this scenario to help prevent regression.