mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-05 00:29:48 +03:00
Without permissions it is possible to view a page #2271
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @pgarciasoffid on GitHub (May 31, 2021).
Describe the bug
It is possible to view a page without permissions, only need to know the page URL
Steps To Reproduce
Steps to reproduce the behavior:
Expected behavior
Display a message: Page not found.
Screenshots
If applicable, add screenshots to help explain your problem.
Your Configuration (please complete the following information):
Additional context
@ssddanbrown commented on GitHub (May 31, 2021):
Thanks for reporting @pgarciasoffid.
From my testing following those steps, I cannot reproduce.
Please could you provide screenshots of the following to confirm your scenario:
@pgarciasoffid commented on GitHub (May 31, 2021):
Screenshot of the entire permission view for both the page and book.
Screenshot of the roles, for both users you're testing as.
Screenshot of the role view for all roles assigned to those two users.
It is possible to access to view that page without a user.
Tanks @ssddanbrown
@ssddanbrown commented on GitHub (May 31, 2021):
Thanks @pgarciasoffid.
Could you also screenshot the edit page for the "Guest" user account?
@pgarciasoffid commented on GitHub (May 31, 2021):
Yeah
@ssddanbrown commented on GitHub (May 31, 2021):
@pgarciasoffid Strange, All that looks as expected.
Within your Page/Book permission pages, I noticed in your screenshots that the "Enable custom permissions" checkbox is active/focused which indicates it may have been selected before taking the screenshot. Are you saving permissions after selecting that checkbox? Or is the checkbox unchecked by default and you've checked it before taking the screenshot?
That checkbox should remain checked when you refresh the permissions page if custom permissions are active.
@pgarciasoffid commented on GitHub (May 31, 2021):
@ssddanbrown That is the key :)
I am testing, and if I check "Enable Custom Permissions" without any custom change, the page is not found. But if I save the permission without the check, I can access that page.
Is that a correct behavior?
Thanks!!
@ssddanbrown commented on GitHub (May 31, 2021):
@pgarciasoffid Yes, By default the normal role permissions are used but selecting the "Enable custom permissions" overrides those, and instead applies only the permissions selected for that item (In addition to providing the "Admin" role with all permissions by default).
As an added tip: Book and chapter permissions will auto-cascade to child items, No need to set permissions on a page if they're the same as the parent chapter/book.
@pgarciasoffid commented on GitHub (May 31, 2021):
Thanks @ssddanbrown :)