mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-09 11:19:38 +03:00
[Bug Report]: #2451
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @a030225033 on GitHub (Oct 22, 2021).
Describe the Bug
uploads/images since you don’t need account secret, you can browse
patch
/uploads/images/gallery/
Steps to Reproduce
know url
Expected Behaviour
input account
Screenshots or Additional Context
No response
Exact BookStack Version
v21.08.6
PHP Version
php 7.4
Hosting Environment
ubuntu 20.04
nginx
@jhrdt commented on GitHub (Oct 22, 2021):
Hi @a030225033,
the public availability of uploaded images is the default behaviour.
You can change the storage_type in your .env to ensure, such that only logged-in users can see uploaded images.
Please consult the docs for more information: https://www.bookstackapp.com/docs/admin/security/#securing-images
@a030225033 commented on GitHub (Oct 22, 2021):
setting
env
STORAGE_TYPE=local_secure
nginx
location /uploads {
autoindex off;
}
No effect
@jhrdt commented on GitHub (Oct 22, 2021):
Hi @a030225033,
do you did that?
@ssddanbrown commented on GitHub (Oct 22, 2021):
In addition,
autoindexshould be off by default with nginx so I'd suspect that something else could overriding the setting. Alternatively nginx has not be restarted for the setting to take affect. Or the location block has been added in an incorrect way.@a030225033 commented on GitHub (Oct 25, 2021):
nginx -s reload Still the same ineffective
@ssddanbrown commented on GitHub (Oct 25, 2021):
@a030225033 What about the advice provided by @jhrdt above? That's more direct to ensuring the
local_secureoption is active. Otherwise you'll need to search for a reason whyautoindexesare active at all. There sounds like there's something else going at play on your server. If you're following any specific instructions feel free to provide those upon further information regarding your setup (Was this a fresh operating system install? Was there an existing website before setting up BookStack?)@ssddanbrown commented on GitHub (Oct 31, 2021):
Since there's been no follow-up I'm going to close this. If the issue remains and is something you still require to be fixed please message me from this issue or open a new issue, referencing this one.