[Feature Request] Allow some Books to be public while all others defaulting to private/login #348

New Issue

OVERLORD · 2026-02-04T18:48:04+03:00

OVERLORD commented

2026-02-04 18:48:04 +03:00

Originally created by @bensulli on GitHub (May 31, 2017).

In my wiki I want all content to default to private unless explicitly made public.

Currently setting custom permissions on a Book to allow public viewing doesn't override the "Allow public viewing" setting (login is needed to access even public books). However enabling "Allow public viewing" results in all current Books being public.

I don't want to have to explicitly make content private, but there's no mechanism to make individual items public without making everything public and then hiding certain content.

Originally created by @bensulli on GitHub (May 31, 2017). In my wiki I want all content to default to private unless explicitly made public. Currently setting custom permissions on a Book to allow public viewing doesn't override the "Allow public viewing" setting (login is needed to access even public books). However enabling "Allow public viewing" results in all current Books being public. I don't want to have to explicitly make content private, but there's no mechanism to make individual items public without making everything public and then hiding certain content.

OVERLORD closed this issue

2026-02-04 18:48:08 +03:00

OVERLORD commented

2026-02-04 18:48:14 +03:00

@Shackelford-Arden commented on GitHub (May 31, 2017):

This would be awesome. +1 This!

@Shackelford-Arden commented on GitHub (May 31, 2017): This would be awesome. +1 This!

OVERLORD commented

2026-02-04 18:48:20 +03:00

@ssddanbrown commented on GitHub (Jun 4, 2017):

Hi @bensulli, Thanks for this feature request. Looking into this actually lead me to find a bug in the permission system, Now fixed in v0.16.3.

As far as I can see, This is possible already. Within your users in BookStack you should find a user named Guest. This use is the user that any public visitor gets assigned. By default, This user is assigned the public role.

To achieve a 'whitelist' approach for public users you can do the following:

Update to v0.16.3 to avoid permission removal bug
Turn on the "Allow public viewing" setting.
Edit the 'Public' role and uncheck all permissions then save.
Go to the book you want to make visible publicly and edit the permissions via the dropdown to the right of the 'Edit' link.
Check 'Enable Custom Permissions' then set all the permissions you want, Ensuring you check the view permission for the public role.

While typing out the above, I've realised that, while possible, the permission system is not really set up for this kind of scenario so I've opened up issue #410 to action a better setup. I will close this issue though since what you have asked is still possible using the above steps. Let me know if you have any issues following those steps.

@ssddanbrown commented on GitHub (Jun 4, 2017): Hi @bensulli, Thanks for this feature request. Looking into this actually lead me to find a bug in the permission system, Now fixed in v0.16.3. As far as I can see, This is possible already. Within your users in BookStack you should find a user named `Guest`. This use is the user that any public visitor gets assigned. By default, This user is assigned the `public` role. To achieve a 'whitelist' approach for public users you can do the following: 1. *Update to v0.16.3 to avoid permission removal bug* 2. Turn on the "Allow public viewing" setting. 3. Edit the 'Public' role and uncheck all permissions then save. 4. Go to the book you want to make visible publicly and edit the permissions via the dropdown to the right of the 'Edit' link. 5. Check 'Enable Custom Permissions' then set all the permissions you want, Ensuring you check the `view` permission for the public role. While typing out the above, I've realised that, while possible, the permission system is not really set up for this kind of scenario so I've opened up issue #410 to action a better setup. I will close this issue though since what you have asked is still possible using the above steps. Let me know if you have any issues following those steps.

OVERLORD commented

2026-02-04 18:48:28 +03:00

@bensulli commented on GitHub (Jun 6, 2017):

That did the trick, thank you so much!

Love seeing the excellent work going into BookStack!

@bensulli commented on GitHub (Jun 6, 2017): That did the trick, thank you so much! Love seeing the excellent work going into BookStack!

OVERLORD commented

2026-02-04 18:48:42 +03:00

@srvprivate commented on GitHub (Jul 30, 2025):

Here is the code necessary for hiding the Left Bar Recent Activity for unauthenticated users, the right bar "Revisions" section, but maintains Recent activity for logged in users. This took me awhile. (This is in addition to whitelisting public roles)

<script>
document.addEventListener("DOMContentLoaded", function () {
    // Detect public user by checking for the "Log in" link in the header
    const isPublicUser = document.querySelector('a[href*="/login"]') !== null;

    if (isPublicUser) {
        // Hide left sidebar Recent Activity block
        const recentActivity = document.querySelector('#recent-activity');
        if (recentActivity) recentActivity.style.display = 'none';

        // Hide revision-like metadata in the right sidebar (Updated by, Created by)
        const entityMeta = document.querySelectorAll('.entity-meta-item');
        entityMeta.forEach(item => {
            const text = item.textContent.toLowerCase();
            if (text.includes('updated') || text.includes('created')) {
                item.style.display = 'none';
            }
        });

        // Hide "Revisions" links if any appear (future-proofing)
        const links = document.querySelectorAll('a[href*="/revisions"]');
        links.forEach(link => {
            link.style.display = 'none';
        });
    }
});
</script>

@srvprivate commented on GitHub (Jul 30, 2025): Here is the code necessary for hiding the Left Bar Recent Activity for unauthenticated users, the right bar "Revisions" section, but maintains Recent activity for logged in users. This took me awhile. (This is in addition to whitelisting public roles) ``` <script> document.addEventListener("DOMContentLoaded", function () { // Detect public user by checking for the "Log in" link in the header const isPublicUser = document.querySelector('a[href*="/login"]') !== null; if (isPublicUser) { // Hide left sidebar Recent Activity block const recentActivity = document.querySelector('#recent-activity'); if (recentActivity) recentActivity.style.display = 'none'; // Hide revision-like metadata in the right sidebar (Updated by, Created by) const entityMeta = document.querySelectorAll('.entity-meta-item'); entityMeta.forEach(item => { const text = item.textContent.toLowerCase(); if (text.includes('updated') || text.includes('created')) { item.style.display = 'none'; } }); // Hide "Revisions" links if any appear (future-proofing) const links = document.querySelectorAll('a[href*="/revisions"]'); links.forEach(link => { link.style.display = 'none'; }); } }); </script> ```

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#348