Improve documentation/add-clarification around the storage options and thier permission enforcement, including notice on roles view #3050

New Issue

OVERLORD · 2026-02-05T05:59:43+03:00

OVERLORD commented

2026-02-05 05:59:43 +03:00

Originally created by @brynmoorhouse on GitHub (Aug 30, 2022).

Attempted Debugging

I have read the debugging page

Searched GitHub Issues

I have searched GitHub for the issue.

Describe the Scenario

This is possibly me misunderstanding the feature, or it might be a bug, but I've enabled the following in my .env
STORAGE_TYPE=local_secure
I've verified that all images are being uploaded to storage/uploads (outside the public directory), but yet I can still enter the direct image URL in an incognito tab to view the image. I'd expect that I'd need to be logged in to view the image?

I did find issue #2998, which is the same scenario, apart from I have not set STORAGE_IMAGE_TYPE at all, which if I've read the docs correctly, means that it will use STORAGE_TYPE

Thanks,

Exact BookStack Version

v22.07.3

Log Content

No response

PHP Version

8.1

Hosting Environment

Debian 10, NGINx, PHP 8.1 fpm

Originally created by @brynmoorhouse on GitHub (Aug 30, 2022). ### Attempted Debugging - [X] I have read the debugging page ### Searched GitHub Issues - [X] I have searched GitHub for the issue. ### Describe the Scenario This is possibly me misunderstanding the feature, or it might be a bug, but I've enabled the following in my .env `STORAGE_TYPE=local_secure` I've verified that all images are being uploaded to storage/uploads (outside the public directory), but yet I can still enter the direct image URL in an incognito tab to view the image. I'd expect that I'd need to be logged in to view the image? I did find issue #2998, which is the same scenario, apart from I have not set STORAGE_IMAGE_TYPE at all, which if I've read the docs correctly, means that it will use STORAGE_TYPE Thanks, ### Exact BookStack Version v22.07.3 ### Log Content _No response_ ### PHP Version 8.1 ### Hosting Environment Debian 10, NGINx, PHP 8.1 fpm

OVERLORD added the 🛠️ Enhancement 📖 Docs Update 🔒 Security 💆 UX labels 2026-02-05 05:59:43 +03:00

OVERLORD closed this issue

2026-02-05 05:59:45 +03:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#3050