Improve documentation/add-clarification around the storage options and thier permission enforcement, including notice on roles view #3050

New Issue

OVERLORD · 2026-02-05T05:59:43+03:00

OVERLORD commented

2026-02-05 05:59:43 +03:00

Originally created by @brynmoorhouse on GitHub (Aug 30, 2022).

Attempted Debugging

I have read the debugging page

Searched GitHub Issues

I have searched GitHub for the issue.

Describe the Scenario

This is possibly me misunderstanding the feature, or it might be a bug, but I've enabled the following in my .env
STORAGE_TYPE=local_secure
I've verified that all images are being uploaded to storage/uploads (outside the public directory), but yet I can still enter the direct image URL in an incognito tab to view the image. I'd expect that I'd need to be logged in to view the image?

I did find issue #2998, which is the same scenario, apart from I have not set STORAGE_IMAGE_TYPE at all, which if I've read the docs correctly, means that it will use STORAGE_TYPE

Thanks,

Exact BookStack Version

v22.07.3

Log Content

No response

PHP Version

8.1

Hosting Environment

Debian 10, NGINx, PHP 8.1 fpm

Originally created by @brynmoorhouse on GitHub (Aug 30, 2022). ### Attempted Debugging - [X] I have read the debugging page ### Searched GitHub Issues - [X] I have searched GitHub for the issue. ### Describe the Scenario This is possibly me misunderstanding the feature, or it might be a bug, but I've enabled the following in my .env `STORAGE_TYPE=local_secure` I've verified that all images are being uploaded to storage/uploads (outside the public directory), but yet I can still enter the direct image URL in an incognito tab to view the image. I'd expect that I'd need to be logged in to view the image? I did find issue #2998, which is the same scenario, apart from I have not set STORAGE_IMAGE_TYPE at all, which if I've read the docs correctly, means that it will use STORAGE_TYPE Thanks, ### Exact BookStack Version v22.07.3 ### Log Content _No response_ ### PHP Version 8.1 ### Hosting Environment Debian 10, NGINx, PHP 8.1 fpm

OVERLORD added the 🛠️ Enhancement 📖 Docs Update 🔒 Security 💆 UX labels 2026-02-05 05:59:43 +03:00

OVERLORD closed this issue

2026-02-05 05:59:45 +03:00

Sign in to join this conversation.

Branches Tags

development

l10n_development

release

v26-03

ci_fixing

codeberg-actions

lexical_may_2026

MilnerMart/development

sort_rule_text

GamerClassN7/impersonations-for-admin

Zhey-on/feature/csp-image-css-controls-6033

tortillas5/development

clauvaldez/mfaReset

llm_only

vectors

McTom234/oidc-key-algorithms

docker_env

drawio_rendering

user_permissions

ldap_host_failover

svg_image

prosemirror

captcha_example

fix/video-export

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#3050