Delete uploaded images #223

New Issue

Closed

opened 2026-02-04 17:47:36 +03:00 by OVERLORD · 2 comments

OVERLORD commented 2026-02-04 17:47:36 +03:00

Owner

Copy Link

Originally created by @ghost on GitHub (Dec 29, 2016).

For Feature Requests

Desired Feature: A normal user who has access to delete images, should able to delete uploaded images.

Issue

We're using BookStack v0.13.1, we are facing problems when we trying to delete images.

Note

• Admin level user who has full access is able to delete images.
• A normal user is not able to delete an image, even though he has access to delete images.
• We tried by giving access to attachments also, even though we are getting same error.

Roles

Admin level access

User level access

Error what we are getting

We've checked laravel.log and it shows as below.

[2016-12-29 05:32:08] production.ERROR: exception 'BadMethodCallException' with message 'Call to undefined method Illuminate\Database\Query\Builder::jointPermissions()' in /var/www/html/vendor/laravel/framework/src/Illuminate/Database/Query/Builder.php:2440 Stack trace: #0 [internal function]: Illuminate\Database\Query\Builder->__call('jointPermission...', Array) #1 [internal function]: Illuminate\Database\Query\Builder->jointPermissions() #2 /var/www/html/vendor/laravel/framework/src/Illuminate/Database/Eloquent/Builder.php(1436): call_user_func_array(Array, Array) #3 [internal function]: Illuminate\Database\Eloquent\Builder->__call('jointPermission...', Array) #4 [internal function]: Illuminate\Database\Eloquent\Builder->jointPermissions() #5 /var/www/html/bootstrap/cache/compiled.php(11602): call_user_func_array(Array, Array) #6 /var/www/html/vendor/laravel/framework/src/Illuminate/Database/Eloquent/Builder.php(1007): Illuminate\Database\Eloquent\Model->__call('jointPermission...', Array) #7 /var/www/html/vendor/laravel/framework/src/Illuminate/Database/Eloquent/Builder.php(1007): BookStack\Image->jointPermissions() #8 [internal function]: Illuminate\Database\Eloquent\Builder->Illuminate\Database\Eloquent\{closure}() #9 /var/www/html/vendor/laravel/framework/src/Illuminate/Database/Eloquent/Relations/Relation.php(184): call_user_func(Object(Closure)) #10 /var/www/html/vendor/laravel/framework/src/Illuminate/Database/Eloquent/Builder.php(1008): Illuminate\Database\Eloquent\Relations\Relation::noConstraints(Object(Closure)) #11 /var/www/html/vendor/laravel/framework/src/Illuminate/Database/Eloquent/Builder.php(810): Illuminate\Database\Eloquent\Builder->getHasRelationQuery('jointPermission...') #12 /var/www/html/vendor/laravel/framework/src/Illuminate/Database/Eloquent/Builder.php(881): Illuminate\Database\Eloquent\Builder->has('jointPermission...', '>=', 1, 'and', Object(Closure)) #13 /var/www/html/app/Services/PermissionService.php(458): Illuminate\Database\Eloquent\Builder->whereHas('jointPermission...', Object(Closure)) #14 [internal function]: BookStack\Services\PermissionService->BookStack\Services\{closure}(Object(Illuminate\Database\Eloquent\Builder)) #15 /var/www/html/vendor/laravel/framework/src/Illuminate/Database/Eloquent/Builder.php(771): call_user_func(Object(Closure), Object(Illuminate\Database\Eloquent\Builder)) #16 /var/www/html/app/Services/PermissionService.php(459): Illuminate\Database\Eloquent\Builder->where(Object(Closure)) #17 /var/www/html/app/Services/PermissionService.php(415): BookStack\Services\PermissionService->entityRestrictionQuery(Object(Illuminate\Database\Eloquent\Builder)) #18 /var/www/html/app/helpers.php(56): BookStack\Services\PermissionService->checkOwnableUserAccess(Object(BookStack\Image), 'image-delete') #19 /var/www/html/app/Http/Controllers/Controller.php(103): userCan('image-delete', Object(BookStack\Image)) #20 /var/www/html/app/Http/Controllers/ImageController.php(160): BookStack\Http\Controllers\Controller->checkOwnablePermission('image-delete', Object(BookStack\Image)) #21 [internal function]: BookStack\Http\Controllers\ImageController->destroy(Object(BookStack\Repos\PageRepo), Object(Illuminate\Http\Request), '643') #22 /var/www/html/bootstrap/cache/compiled.php(9385): call_user_func_array(Array, Array) #23 /var/www/html/bootstrap/cache/compiled.php(9412): Illuminate\Routing\Controller->callAction('destroy', Array) #24 /var/www/html/bootstrap/cache/compiled.php(8470): Illuminate\Routing\ControllerDispatcher->dispatch(Object(Illuminate\Routing\Route), Object(BookStack\Http\Controllers\ImageController), 'destroy') #25 /var/www/html/bootstrap/cache/compiled.php(8451): Illuminate\Routing\Route->runController() #26 /var/www/html/bootstrap/cache/compiled.php(8147): Illuminate\Routing\Route->run(Object(Illuminate\Http\Request)) #27 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(53): Illuminate\Routing\Router->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) #28 /var/www/html/app/Http/Controllers/Controller.php(44): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) #29 /var/www/html/bootstrap/cache/compiled.php(9862): BookStack\Http\Controllers\Controller->BookStack\Http\Controllers\{closure}(Object(Illuminate\Http\Request), Object(Closure)) #30 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(33): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) #31 /var/www/html/app/Http/Middleware/Authenticate.php(47): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) #32 /var/www/html/bootstrap/cache/compiled.php(9870): BookStack\Http\Middleware\Authenticate->handle(Object(Illuminate\Http\Request), Object(Closure)) #33 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(33): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) #34 /var/www/html/bootstrap/cache/compiled.php(9978): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) #35 /var/www/html/bootstrap/cache/compiled.php(9870): Illuminate\Routing\Middleware\SubstituteBindings->handle(Object(Illuminate\Http\Request), Object(Closure)) #36 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(33): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) #37 /var/www/html/bootstrap/cache/compiled.php(3151): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) #38 /var/www/html/bootstrap/cache/compiled.php(9870): Illuminate\Foundation\Http\Middleware\VerifyCsrfToken->handle(Object(Illuminate\Http\Request), Object(Closure)) #39 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(33): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) #40 /var/www/html/bootstrap/cache/compiled.php(13464): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) #41 /var/www/html/bootstrap/cache/compiled.php(9870): Illuminate\View\Middleware\ShareErrorsFromSession->handle(Object(Illuminate\Http\Request), Object(Closure)) #42 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(33): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) #43 /var/www/html/bootstrap/cache/compiled.php(11907): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) #44 /var/www/html/bootstrap/cache/compiled.php(9870): Illuminate\Session\Middleware\StartSession->handle(Object(Illuminate\Http\Request), Object(Closure)) #45 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(33): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) #46 /var/www/html/bootstrap/cache/compiled.php(13210): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) #47 /var/www/html/bootstrap/cache/compiled.php(9870): Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse->handle(Object(Illuminate\Http\Request), Object(Closure)) #48 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(33): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) #49 /var/www/html/bootstrap/cache/compiled.php(13147): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) #50 /var/www/html/bootstrap/cache/compiled.php(9870): Illuminate\Cookie\Middleware\EncryptCookies->handle(Object(Illuminate\Http\Request), Object(Closure)) #51 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(33): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) #52 /var/www/html/bootstrap/cache/compiled.php(9855): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) #53 /var/www/html/bootstrap/cache/compiled.php(8148): Illuminate\Pipeline\Pipeline->then(Object(Closure)) #54 /var/www/html/bootstrap/cache/compiled.php(8139): Illuminate\Routing\Router->runRouteWithinStack(Object(Illuminate\Routing\Route), Object(Illuminate\Http\Request)) #55 /var/www/html/bootstrap/cache/compiled.php(8130): Illuminate\Routing\Router->dispatchToRoute(Object(Illuminate\Http\Request)) #56 /var/www/html/bootstrap/cache/compiled.php(2472): Illuminate\Routing\Router->dispatch(Object(Illuminate\Http\Request)) #57 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(53): Illuminate\Foundation\Http\Kernel->Illuminate\Foundation\Http\{closure}(Object(Illuminate\Http\Request)) #58 /var/www/html/bootstrap/cache/compiled.php(3213): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) #59 /var/www/html/bootstrap/cache/compiled.php(9870): Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode->handle(Object(Illuminate\Http\Request), Object(Closure)) #60 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(33): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) #61 /var/www/html/bootstrap/cache/compiled.php(9855): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) #62 /var/www/html/bootstrap/cache/compiled.php(2416): Illuminate\Pipeline\Pipeline->then(Object(Closure)) #63 /var/www/html/bootstrap/cache/compiled.php(2400): Illuminate\Foundation\Http\Kernel->sendRequestThroughRouter(Object(Illuminate\Http\Request)) #64 /var/www/html/public/index.php(54): Illuminate\Foundation\Http\Kernel->handle(Object(Illuminate\Http\Request)) #65 {main}

For Bug Reports

PHP Version: 5.6.27

MySQL Version: 5.6.32

Expected Behavior: User should able to delete uploaded images, if he has access to delete images.

Actual Behavior: A normal user who has access to delete images, is not able to delete uploaded images.

Please let me know if you need any other information.

Originally created by @ghost on GitHub (Dec 29, 2016). ### For Feature Requests Desired Feature: A normal user who has access to delete images, should able to delete uploaded images. ### Issue We're using **BookStack v0.13.1**, we are facing problems when we trying to delete images. **Note** - Admin level user who has full access is able to delete images. - A normal user is not able to delete an image, even though he has access to delete images. - We tried by giving access to attachments also, even though we are getting same error. ### Roles **Admin level access**  **User level access**  ### Error what we are getting  We've checked **laravel.log** and it shows as below. `[2016-12-29 05:32:08] production.ERROR: exception 'BadMethodCallException' with message 'Call to undefined method Illuminate\Database\Query\Builder::jointPermissions()' in /var/www/html/vendor/laravel/framework/src/Illuminate/Database/Query/Builder.php:2440 Stack trace: #0 [internal function]: Illuminate\Database\Query\Builder->__call('jointPermission...', Array) #1 [internal function]: Illuminate\Database\Query\Builder->jointPermissions() #2 /var/www/html/vendor/laravel/framework/src/Illuminate/Database/Eloquent/Builder.php(1436): call_user_func_array(Array, Array) #3 [internal function]: Illuminate\Database\Eloquent\Builder->__call('jointPermission...', Array) #4 [internal function]: Illuminate\Database\Eloquent\Builder->jointPermissions() #5 /var/www/html/bootstrap/cache/compiled.php(11602): call_user_func_array(Array, Array) #6 /var/www/html/vendor/laravel/framework/src/Illuminate/Database/Eloquent/Builder.php(1007): Illuminate\Database\Eloquent\Model->__call('jointPermission...', Array) #7 /var/www/html/vendor/laravel/framework/src/Illuminate/Database/Eloquent/Builder.php(1007): BookStack\Image->jointPermissions() #8 [internal function]: Illuminate\Database\Eloquent\Builder->Illuminate\Database\Eloquent\{closure}() #9 /var/www/html/vendor/laravel/framework/src/Illuminate/Database/Eloquent/Relations/Relation.php(184): call_user_func(Object(Closure)) #10 /var/www/html/vendor/laravel/framework/src/Illuminate/Database/Eloquent/Builder.php(1008): Illuminate\Database\Eloquent\Relations\Relation::noConstraints(Object(Closure)) #11 /var/www/html/vendor/laravel/framework/src/Illuminate/Database/Eloquent/Builder.php(810): Illuminate\Database\Eloquent\Builder->getHasRelationQuery('jointPermission...') #12 /var/www/html/vendor/laravel/framework/src/Illuminate/Database/Eloquent/Builder.php(881): Illuminate\Database\Eloquent\Builder->has('jointPermission...', '>=', 1, 'and', Object(Closure)) #13 /var/www/html/app/Services/PermissionService.php(458): Illuminate\Database\Eloquent\Builder->whereHas('jointPermission...', Object(Closure)) #14 [internal function]: BookStack\Services\PermissionService->BookStack\Services\{closure}(Object(Illuminate\Database\Eloquent\Builder)) #15 /var/www/html/vendor/laravel/framework/src/Illuminate/Database/Eloquent/Builder.php(771): call_user_func(Object(Closure), Object(Illuminate\Database\Eloquent\Builder)) #16 /var/www/html/app/Services/PermissionService.php(459): Illuminate\Database\Eloquent\Builder->where(Object(Closure)) #17 /var/www/html/app/Services/PermissionService.php(415): BookStack\Services\PermissionService->entityRestrictionQuery(Object(Illuminate\Database\Eloquent\Builder)) #18 /var/www/html/app/helpers.php(56): BookStack\Services\PermissionService->checkOwnableUserAccess(Object(BookStack\Image), 'image-delete') #19 /var/www/html/app/Http/Controllers/Controller.php(103): userCan('image-delete', Object(BookStack\Image)) #20 /var/www/html/app/Http/Controllers/ImageController.php(160): BookStack\Http\Controllers\Controller->checkOwnablePermission('image-delete', Object(BookStack\Image)) #21 [internal function]: BookStack\Http\Controllers\ImageController->destroy(Object(BookStack\Repos\PageRepo), Object(Illuminate\Http\Request), '643') #22 /var/www/html/bootstrap/cache/compiled.php(9385): call_user_func_array(Array, Array) #23 /var/www/html/bootstrap/cache/compiled.php(9412): Illuminate\Routing\Controller->callAction('destroy', Array) #24 /var/www/html/bootstrap/cache/compiled.php(8470): Illuminate\Routing\ControllerDispatcher->dispatch(Object(Illuminate\Routing\Route), Object(BookStack\Http\Controllers\ImageController), 'destroy') #25 /var/www/html/bootstrap/cache/compiled.php(8451): Illuminate\Routing\Route->runController() #26 /var/www/html/bootstrap/cache/compiled.php(8147): Illuminate\Routing\Route->run(Object(Illuminate\Http\Request)) #27 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(53): Illuminate\Routing\Router->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) #28 /var/www/html/app/Http/Controllers/Controller.php(44): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) #29 /var/www/html/bootstrap/cache/compiled.php(9862): BookStack\Http\Controllers\Controller->BookStack\Http\Controllers\{closure}(Object(Illuminate\Http\Request), Object(Closure)) #30 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(33): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) #31 /var/www/html/app/Http/Middleware/Authenticate.php(47): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) #32 /var/www/html/bootstrap/cache/compiled.php(9870): BookStack\Http\Middleware\Authenticate->handle(Object(Illuminate\Http\Request), Object(Closure)) #33 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(33): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) #34 /var/www/html/bootstrap/cache/compiled.php(9978): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) #35 /var/www/html/bootstrap/cache/compiled.php(9870): Illuminate\Routing\Middleware\SubstituteBindings->handle(Object(Illuminate\Http\Request), Object(Closure)) #36 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(33): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) #37 /var/www/html/bootstrap/cache/compiled.php(3151): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) #38 /var/www/html/bootstrap/cache/compiled.php(9870): Illuminate\Foundation\Http\Middleware\VerifyCsrfToken->handle(Object(Illuminate\Http\Request), Object(Closure)) #39 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(33): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) #40 /var/www/html/bootstrap/cache/compiled.php(13464): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) #41 /var/www/html/bootstrap/cache/compiled.php(9870): Illuminate\View\Middleware\ShareErrorsFromSession->handle(Object(Illuminate\Http\Request), Object(Closure)) #42 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(33): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) #43 /var/www/html/bootstrap/cache/compiled.php(11907): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) #44 /var/www/html/bootstrap/cache/compiled.php(9870): Illuminate\Session\Middleware\StartSession->handle(Object(Illuminate\Http\Request), Object(Closure)) #45 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(33): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) #46 /var/www/html/bootstrap/cache/compiled.php(13210): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) #47 /var/www/html/bootstrap/cache/compiled.php(9870): Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse->handle(Object(Illuminate\Http\Request), Object(Closure)) #48 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(33): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) #49 /var/www/html/bootstrap/cache/compiled.php(13147): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) #50 /var/www/html/bootstrap/cache/compiled.php(9870): Illuminate\Cookie\Middleware\EncryptCookies->handle(Object(Illuminate\Http\Request), Object(Closure)) #51 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(33): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) #52 /var/www/html/bootstrap/cache/compiled.php(9855): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) #53 /var/www/html/bootstrap/cache/compiled.php(8148): Illuminate\Pipeline\Pipeline->then(Object(Closure)) #54 /var/www/html/bootstrap/cache/compiled.php(8139): Illuminate\Routing\Router->runRouteWithinStack(Object(Illuminate\Routing\Route), Object(Illuminate\Http\Request)) #55 /var/www/html/bootstrap/cache/compiled.php(8130): Illuminate\Routing\Router->dispatchToRoute(Object(Illuminate\Http\Request)) #56 /var/www/html/bootstrap/cache/compiled.php(2472): Illuminate\Routing\Router->dispatch(Object(Illuminate\Http\Request)) #57 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(53): Illuminate\Foundation\Http\Kernel->Illuminate\Foundation\Http\{closure}(Object(Illuminate\Http\Request)) #58 /var/www/html/bootstrap/cache/compiled.php(3213): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) #59 /var/www/html/bootstrap/cache/compiled.php(9870): Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode->handle(Object(Illuminate\Http\Request), Object(Closure)) #60 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(33): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) #61 /var/www/html/bootstrap/cache/compiled.php(9855): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) #62 /var/www/html/bootstrap/cache/compiled.php(2416): Illuminate\Pipeline\Pipeline->then(Object(Closure)) #63 /var/www/html/bootstrap/cache/compiled.php(2400): Illuminate\Foundation\Http\Kernel->sendRequestThroughRouter(Object(Illuminate\Http\Request)) #64 /var/www/html/public/index.php(54): Illuminate\Foundation\Http\Kernel->handle(Object(Illuminate\Http\Request)) #65 {main} ` ### For Bug Reports PHP Version: 5.6.27 MySQL Version: 5.6.32 Expected Behavior: User should able to delete uploaded images, if he has access to delete images. Actual Behavior: A normal user who has access to delete images, is not able to delete uploaded images. #### Please let me know if you need any other information.

OVERLORD added the 🐛 Bug label 2026-02-04 17:47:36 +03:00

OVERLORD closed this issue 2026-02-04 17:47:41 +03:00

OVERLORD commented 2026-02-04 17:47:57 +03:00

Author

Owner

Copy Link

@ssddanbrown commented on GitHub (Jan 8, 2017):

@bharadwajag Thank you for reporting this bug and apologies for any problems this may have caused you.

This will be fixed in the next release.

If you need this fixed sooner you can simply change Line 398 in app/Services/PermissionService.php to the following:

$nonJointPermissions = ['restrictions', 'image', 'attachment'];

@ssddanbrown commented on GitHub (Jan 8, 2017): @bharadwajag Thank you for reporting this bug and apologies for any problems this may have caused you. This will be fixed in the next release. If you need this fixed sooner you can simply change [Line 398 in app/Services/PermissionService.php](https://github.com/BookStackApp/BookStack/blob/v0.13.1/app/Services/PermissionService.php#L398) to the following: ``` $nonJointPermissions = ['restrictions', 'image', 'attachment']; ```

OVERLORD commented 2026-02-04 17:48:01 +03:00

Author

Owner

Copy Link

@ghost commented on GitHub (Jan 9, 2017):

@ssddanbrown
Happy to see this, thank you very much.

@ghost commented on GitHub (Jan 9, 2017): @ssddanbrown Happy to see this, thank you very much.

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

development

l10n_development

further_theme_development

release

llm_only

vectors

v25-11

docker_env

drawio_rendering

user_permissions

ldap_host_failover

svg_image

prosemirror

captcha_example

fix/video-export

v25.12.3

v25.12.2

v25.12.1

v25.12

v25.11.6

v25.11.5

v25.11.4

v24.11.4

v25.11.3

v25.11.2

v25.11.1

v25.11

v25.07.3

v25.07.2

v25.07.1

v25.07

v25.05.2

v25.05.1

v25.05

v25.02.5

v25.02.4

v25.02.3

v25.02.2

v25.02.1

v25.02

v24.12.1

v24.12

v24.10.3

v24.10.2

v24.10.1

v24.10

v24.05.4

v24.05.3

v24.05.2

v24.05.1

v24.05

v24.02.3

v24.02.2

v24.02.1

v24.02

v23.12.3

v23.12.2

v23.12.1

v23.12

v23.10.4

v23.10.3

v23.10.2

v23.10.1

v23.10

v23.08.3

v23.08.2

v23.08.1

v23.08

v23.06.2

v23.06.1

v23.06

v23.05.2

v23.05.1

v23.05

v23.02.3

v23.02.2

v23.02.1

v23.02

v23.01.1

v23.01

v22.11.1

v22.11

v22.10.2

v22.10.1

v22.10

v22.09.1

v22.09

v22.07.3

v22.07.2

v22.07.1

v22.07

v22.06.2

v22.06.1

v22.06

v22.04.2

v22.04.1

v22.04

v22.03.1

v22.03

v22.02.3

v22.02.2

v22.02.1

v22.02

v21.12.5

v21.12.4

v21.12.3

v21.12.2

v21.12.1

v21.12

v21.11.3

v21.11.2

v21.11.1

v21.11

v21.10.3

v21.10.2

v21.10.1

v21.10

v21.08.6

v21.08.5

v21.08.4

v21.08.3

v21.08.2

v21.08.1

v21.08

v21.05.4

v21.05.3

v21.05.2

v21.05.1

v21.05

v21.04.6

v21.04.5

v21.04.4

v21.04.3

v21.04.2

v21.04.1

v21.04

v0.31.8

v0.31.7

v0.31.6

v0.31.5

v0.31.4

v0.31.3

v0.31.2

v0.31.1

v0.31.0

v0.30.7

v0.30.6

v0.30.5

v0.30.4

v0.30.3

v0.30.2

v0.30.1

v0.30.0

v0.29.3

v0.29.2

v0.29.1

v0.29.0

v0.28.3

v0.28.2

v0.28.1

v0.28.0

v0.27.5

v0.27.4

v0.27.3

v0.27.2

v0.27.1

v0.27

v0.26.4

v0.26.3

v0.26.2

v0.26.1

v0.26.0

v0.25.5

v0.25.4

v0.25.3

v0.25.2

v0.25.1

v0.25.0

v0.24.3

v0.24.2

v0.24.1

v0.24.0

v0.23.2

v0.23.1

v0.23.0

v0.22.0

v0.21.0

v0.20.3

v0.20.2

v0.20.1

v0.20.0

v0.19.0

v0.18.5

v0.18.4

v0.18.3

v0.18.2

v0.18.1

v0.18.0

v0.17.4

v0.17.3

v0.17.2

v0.17.1

v0.17.0

v0.16.3

v0.16.2

v0.16.1

v0.16.0

v0.15.3

v0.15.2

v0.15.1

v0.15.0

v0.14.3

v0.14.2

v0.14.1

v0.14.0

v0.13.1

v0.13.0

v0.12.2

v0.12.1

v0.12.0

v0.11.2

v0.11.1

v0.11.0

v0.10.0

v0.9.3

v0.9.2

v0.9.1

v0.9.0

v0.8.2

v0.8.1

v0.8.0

v0.7.6

v0.7.5

v0.7.4

v0.7.3

0.7.2

v.0.7.1

v0.7.0

v0.6.3

v0.6.2

v0.6.1

v0.6.0

v0.5.0

Labels

Clear labels

🎨 Design

📖 Docs Update

🐛 Bug

🐛 Bug

:cat2:🐈 Possible duplicate

💿 Database

☕ Open to discussion

💻 Front-End

🐕 Support

🚪 Authentication

🌍 Translations

🔌 API Task

🏭 Back-End

⛲ Upstream

🔨 Feature Request

🛠️ Enhancement

🛠️ Enhancement

🛠️ Enhancement

❤️ Happy feedback

🔒 Security

🔍 Pending Validation

💆 UX

📝 WYSIWYG Editor

🌔 Out of scope

🔩 API Request

:octocat: Admin/Meta

🖌️ View Customization

❓ Question

🚀 Priority

🛡️ Blocked

🚚 Export System

♿ A11y

🔧 Maintenance

> Markdown Editor

No Label 🐛 Bug

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

OVERLORD

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#223