mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-08 03:09:39 +03:00
Implement an advisory notice on the shelf permissions page regarding the lack of cascade #2351
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @tyler351 on GitHub (Aug 7, 2021).
When applying custom permissions to a shelf, using the "copy to books" options works for any existing books in that shelf but those same permissions don't seem to get applied to new books create within that shelf from then on unless you go back and use the button again.
Is this the intended result?
I'm on the latest installation (used the Ubuntu 20.04 script) not 100% on version number but will double check.
@tyler351 commented on GitHub (Aug 7, 2021):
After looking at a couple other threads (https://github.com/BookStackApp/BookStack/issues/2144#issuecomment-841674016 specifically) I see that permissions applied to shelves don't cascade automatically. So I guess In that case I'd like to ask is that possible to add? Or a limitation?
@Thorood commented on GitHub (Aug 20, 2021):
I'd like to comment on @tyler351.
This would be a really nice addition and also resolve a big security loophole.
@ssddanbrown commented on GitHub (Aug 22, 2021):
The lack of cascading permissions is due to the more complex shelf to book relationship, since books can be on multiple shelves. I have not been able to think of an auto-cascade option that wouldn't end up more confusing, or have more side-affects.
@tyler351 commented on GitHub (Aug 22, 2021):
@ssddanbrown
Ooohhhh gotcha. Yeah. That could get interesting haha. Makes total sense and understand the complexity now. Lol
@Thorood commented on GitHub (Aug 23, 2021):
A way to do this simply could be :
When a book is created -> cascade permissions from it's current shelf (at this moment the book have 0 or 1 shelf).
When addind the book to a shelf -> if the permissions are different then add a warning and either blook the addition of take the least permissive permission (but that can be a bit hard to define so the first option can be easier to implement).
@Thorood commented on GitHub (Aug 23, 2021):
@ssddanbrown I personnaly think that if someone use the permission at a Shelf level (instead of account level) it shows a need of "security" around the data so having a simple message explaining that the book is currently inhériting different permission from an other shelf woud not cause confusion.
What do you think ?
@Cave-Johnson commented on GitHub (Aug 23, 2021):
Maybe a solution would be to provide a flag to enable this in the admin panel, defaulting to the current configuration.
Have a button to enable inherited permissions with a warning saying this breaks having books on multiple shelves
Would be more overhead to maintain though
@dani commented on GitHub (Aug 23, 2021):
The current situation is IMHO the most confusing. When I enable public access for some shelves, but restrict others to logged in user, and create a new book in a restricted shelf, I certainly do not expect this new book to be public (this is what happens now, and represent a huge risk). Books being created in a shelf with restricted permissions should inherit those permissions. If I want to include it later in another shelf, I can update the permissions later
@ssddanbrown commented on GitHub (Aug 23, 2021):
Based on these conversations I think we need to do two things:
I don't really want to go down the route of adding different, optional, behaviour which would bring its own scenarios and maintenance burdens.
If there's no major reasonable objections I'll update the title of this issue to focus on (1) above.
@tyler351 commented on GitHub (Aug 24, 2021):
Sounds pretty dang reasonable to me. As nice as it would be to make that a default thing in some situations, knowing upfront that it doesn't happen and getting the option to apply the permissions when it's created seems like a great place to be.
Thanks for your work @ssddanbrown!
@ssddanbrown commented on GitHub (Aug 28, 2021):
Notice added, To be part of the next feature release. Thanks all for your input.