clear statement about WKHTMLTOPDF only with security flaws possible #2673

New Issue

OVERLORD · 2026-02-05T04:45:31+03:00

OVERLORD commented

2026-02-05 04:45:31 +03:00

Originally created by @ManfredHerrmann on GitHub (Feb 24, 2022).

Describe the Bug

The documentation about is a bit missleading?

Note: as of BookStack v21.08 you’ll need to also enable untrusted server fetching in your .env file like below. This change was made for security since, in many cases, wkhtmltopdf will perform fetches to external URLs which may be defined by users. You should only enable the below option in environments where only trusted users can export content.

It took me long time for trying the "NOT optional"
ALLOW_UNTRUSTED_SERVER_FETCHING=true

Steps to Reproduce

enable WKHTMLTOPDF
without "unsecure fetches"

# In .env file
WKHTMLTOPDF=/home/user/bins/wkhtmltopdf

Expected Behaviour

My missunderstanding was "optional security"

# In .env file
WKHTMLTOPDF=/home/user/bins/wkhtmltopdf

"optional" ... with less functionality
ALLOW_UNTRUSTED_SERVER_FETCHING=true

Screenshots or Additional Context

No response

Exact BookStack Version

v21.12.5

PHP Version

No response

Hosting Environment

Ubuntu 20.04

Originally created by @ManfredHerrmann on GitHub (Feb 24, 2022). ### Describe the Bug The documentation about is a bit missleading? > Note: as of BookStack v21.08 you’ll need to also enable untrusted server fetching in your .env file like below. This change was made for security since, in many cases, wkhtmltopdf will perform fetches to external URLs which may be defined by users. You should only enable the below option in environments where only trusted users can export content. It took me long time for trying the "NOT optional" `ALLOW_UNTRUSTED_SERVER_FETCHING=true` ### Steps to Reproduce enable WKHTMLTOPDF without "unsecure fetches" ``` # In .env file WKHTMLTOPDF=/home/user/bins/wkhtmltopdf ``` ### Expected Behaviour My missunderstanding was "optional security" ``` # In .env file WKHTMLTOPDF=/home/user/bins/wkhtmltopdf ``` "optional" ... with less functionality `ALLOW_UNTRUSTED_SERVER_FETCHING=true` ### Screenshots or Additional Context _No response_ ### Exact BookStack Version v21.12.5 ### PHP Version _No response_ ### Hosting Environment Ubuntu 20.04

OVERLORD added the 🐛 Bug label 2026-02-05 04:45:31 +03:00

OVERLORD closed this issue

2026-02-05 04:45:33 +03:00

OVERLORD commented

2026-02-05 04:45:34 +03:00

@ssddanbrown commented on GitHub (Feb 24, 2022):

Hi @ManfredHerrmann,

The use of also within "you’ll need to also enable untrusted server fetching", and the lack of mention of "optional" makes it seem clear to me that this was a requirement. I'm not clear how it's misleading.

Any constructive recommendation in regards to how the docs can be altered to make it clearer?
I didn't want to have both config lines in the same box as I was worried users may copy and paste without understanding the security risk. It also represents it as a seperate option (Since it is and may control other abilities) rather than being something specific to the WKHTMLTOPDF option.

@ssddanbrown commented on GitHub (Feb 24, 2022): Hi @ManfredHerrmann, The use of `also` within "you’ll need to also enable untrusted server fetching", and the lack of mention of "optional" makes it seem clear to me that this was a requirement. I'm not clear how it's misleading. Any constructive recommendation in regards to how the docs can be altered to make it clearer? I didn't want to have both config lines in the same box as I was worried users may copy and paste without understanding the security risk. It also represents it as a seperate option (Since it is and may control other abilities) rather than being something specific to the WKHTMLTOPDF option.

OVERLORD commented

2026-02-05 04:45:41 +03:00

@ManfredHerrmann commented on GitHub (Feb 25, 2022):

Hi @ssddanbrown,
sorry for my "bug report" ... it is the first time I try to contribute to famous OpenSource like BookStack :o)

this sentence ... I see its not that easy to express
You should only enable the below option in environments where only trusted users can export content.

my "constructive recommendation"
You should only enable WKHTMLTOPDF + ALLOW_UNTRUSTED_SERVER_FETCHING where only trusted users can export content.

I hope this make sense to you and to all other.

@ManfredHerrmann commented on GitHub (Feb 25, 2022): Hi @ssddanbrown, sorry for my "bug report" ... it is the first time I try to contribute to famous OpenSource like BookStack :o) this sentence ... I see its not that easy to express `You should only enable the below option in environments where only trusted users can export content.` my "constructive recommendation" `You should only enable WKHTMLTOPDF + ALLOW_UNTRUSTED_SERVER_FETCHING where only trusted users can export content.` I hope this make sense to you and to all other.

OVERLORD commented

2026-02-05 04:45:45 +03:00

@ssddanbrown commented on GitHub (Feb 25, 2022):

Thank you @ManfredHerrmann.

I've now updated the wording on https://www.bookstackapp.com/docs/admin/pdf-rendering/.
Specifically:

As of BookStack v21.08 the ALLOW_UNTRUSTED_SERVER_FETCHING must also be set to true for wkhtmltopdf to be enabled, without this dompdf will be used instead.

Hopefully this is much clearer in stating this option is required.
Will hence close this off.

@ssddanbrown commented on GitHub (Feb 25, 2022): Thank you @ManfredHerrmann. I've now updated the wording on https://www.bookstackapp.com/docs/admin/pdf-rendering/. Specifically: > As of BookStack v21.08 the ALLOW_UNTRUSTED_SERVER_FETCHING must also be set to true for wkhtmltopdf to be enabled, without this dompdf will be used instead. Hopefully this is much clearer in stating this option is required. Will hence close this off.

OVERLORD commented

2026-02-05 04:45:49 +03:00

@ManfredHerrmann commented on GitHub (Feb 25, 2022):

well done @ssddanbrown, thanks

@ManfredHerrmann commented on GitHub (Feb 25, 2022): well done @ssddanbrown, thanks

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#2673