Prevent editing of account-details #5193

New Issue

OVERLORD · 2026-02-05T09:47:29+03:00

OVERLORD commented

2026-02-05 09:47:29 +03:00

Originally created by @demlak on GitHub (Feb 24, 2025).

Attempted Debugging

I have read the debugging page

Searched GitHub Issues

I have searched GitHub for the issue.

Describe the Scenario

Disable editing of account details

Hi.. i use bookstack in a school and since we use OpenID as auth_method, i want to disable editing some settings in the personal profile: changing name, activating 2FA, deleting account and changing avatar.
Similar to https://github.com/BookStackApp/BookStack/issues/3156

Since the only setting that will be left, is language-change, but it is absolutly OK to do without language-change.. so, maybe, we could do without the my-account-page at all.

i don't know, what is the best solution on this..

i see:

editing server-config to not access /my-account anymore. I don't know, if this will break other things
custom-CSS for hiding the navigation-entry to get there. This will be kind of security by obscurity
change page via logical-theme system by replacing code or by hooking into the save-dialog, like in https://github.com/BookStackApp/BookStack/issues/3156, if i understand it correctly
change php in Bookstack-source-code to not give access at all.. this is obviously a bad idea for updating bookstack

What would be a good / the best Solution?

thx
demlak

Exact BookStack Version

v24.12.1

Log Content

No response

Hosting Environment

Bookstack in an LXC installed via helper-scripts.com on a proxmox.

Originally created by @demlak on GitHub (Feb 24, 2025). ### Attempted Debugging - [x] I have read the debugging page ### Searched GitHub Issues - [x] I have searched GitHub for the issue. ### Describe the Scenario Disable editing of account details Hi.. i use bookstack in a school and since we use OpenID as auth_method, i want to disable editing some settings in the personal profile: changing name, activating 2FA, deleting account and changing avatar. Similar to https://github.com/BookStackApp/BookStack/issues/3156 Since the only setting that will be left, is language-change, but it is absolutly OK to do without language-change.. so, maybe, we could do without the my-account-page at all. i don't know, what is the best solution on this.. i see: - editing server-config to not access `/my-account` anymore. I don't know, if this will break other things - custom-CSS for hiding the navigation-entry to get there. This will be kind of `security by obscurity` - change page via logical-theme system by replacing code or by hooking into the save-dialog, like in https://github.com/BookStackApp/BookStack/issues/3156, if i understand it correctly - change php in Bookstack-source-code to not give access at all.. this is obviously a bad idea for updating bookstack What would be a good / the best Solution? thx demlak ### Exact BookStack Version v24.12.1 ### Log Content _No response_ ### Hosting Environment Bookstack in an LXC installed via helper-scripts.com on a proxmox.

OVERLORD added the 🐕 Support label 2026-02-05 09:47:29 +03:00

OVERLORD closed this issue

2026-02-05 09:47:31 +03:00

OVERLORD commented

2026-02-05 09:47:33 +03:00

@ssddanbrown commented on GitHub (Feb 25, 2025):

Hi @demlak,

Personally I'd probably go with the webserver approach, since that should be most simple.
Note though, URLs for things could change in the future but no options here are safe to future changes, since this isn't something officially supported.

I don't know, if this will break other things

The only other things I can think of is that shortcut and notification preferences are also on the my-account path.
If you want to allow those, you'd need to get a bit more selective/targeted.
A full list of the routes/methods using my-account can be seen here:
dca14feaaa/routes/web.php (L252-L263)

@ssddanbrown commented on GitHub (Feb 25, 2025): Hi @demlak, Personally I'd probably go with the webserver approach, since that should be most simple. Note though, URLs for things could change in the future but no options here are safe to future changes, since this isn't something officially supported. > I don't know, if this will break other things The only other things I can think of is that shortcut and notification preferences are also on the `my-account` path. If you want to allow those, you'd need to get a bit more selective/targeted. A full list of the routes/methods using `my-account` can be seen here: https://github.com/BookStackApp/BookStack/blob/dca14feaaad686bfbe9acb59f5eb11b815501e5b/routes/web.php#L252-L263

OVERLORD commented

2026-02-05 09:47:35 +03:00

@demlak commented on GitHub (Feb 25, 2025):

hmm.. i tried several things inside /.htaccess file to redirect /my-account to /.. but i was not successfull.. maybe you can help?

@demlak commented on GitHub (Feb 25, 2025): hmm.. i tried several things inside `/.htaccess` file to redirect `/my-account` to `/`.. but i was not successfull.. maybe you can help?

OVERLORD commented

2026-02-05 09:47:37 +03:00

@ssddanbrown commented on GitHub (Feb 25, 2025):

@demlak .htaccess files are rarely used and best avoided.

Your apache webserver config for BookStack should be found at /etc/apache2/sites-available/bookstack.conf, Add config/options in there.

@ssddanbrown commented on GitHub (Feb 25, 2025): @demlak `.htaccess` files are rarely used and best avoided. Your apache webserver config for BookStack should be found at `/etc/apache2/sites-available/bookstack.conf`, Add config/options in there.

OVERLORD commented

2026-02-05 09:47:39 +03:00

@demlak commented on GitHub (Feb 27, 2025):

hey.. thx a lot..
i am a little bit confused, because "my-account" is kind of "virtual".. it is not "physicaly" on the disc..

this is the original conf-file.. any hints on that?

<VirtualHost *:80>
  ServerAdmin webmaster@localhost
  DocumentRoot /opt/bookstack/public/

  <Directory /opt/bookstack/public/>
      Options -Indexes +FollowSymLinks
      AllowOverride None
      Require all granted
      <IfModule mod_rewrite.c>
          <IfModule mod_negotiation.c>
              Options -MultiViews -Indexes
          </IfModule>

          RewriteEngine On
          
          # Handle Authorization Header
          RewriteCond %{HTTP:Authorization} .
          RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

          # Redirect Trailing Slashes If Not A Folder...
          RewriteCond %{REQUEST_FILENAME} !-d
          RewriteCond %{REQUEST_URI} (.+)/$
          RewriteRule ^ %1 [L,R=301]

          # Handle Front Controller...
          RewriteCond %{REQUEST_FILENAME} !-d
          RewriteCond %{REQUEST_FILENAME} !-f
          RewriteRule ^ index.php [L]
      </IfModule>
  </Directory>
  
    ErrorLog /var/log/apache2/error.log
    CustomLog /var/log/apache2/access.log combined

</VirtualHost>

@demlak commented on GitHub (Feb 27, 2025): hey.. thx a lot.. i am a little bit confused, because "my-account" is kind of "virtual".. it is not "physicaly" on the disc.. this is the original conf-file.. any hints on that? ``` <VirtualHost *:80> ServerAdmin webmaster@localhost DocumentRoot /opt/bookstack/public/ <Directory /opt/bookstack/public/> Options -Indexes +FollowSymLinks AllowOverride None Require all granted <IfModule mod_rewrite.c> <IfModule mod_negotiation.c> Options -MultiViews -Indexes </IfModule> RewriteEngine On # Handle Authorization Header RewriteCond %{HTTP:Authorization} . RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] # Redirect Trailing Slashes If Not A Folder... RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_URI} (.+)/$ RewriteRule ^ %1 [L,R=301] # Handle Front Controller... RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^ index.php [L] </IfModule> </Directory> ErrorLog /var/log/apache2/error.log CustomLog /var/log/apache2/access.log combined </VirtualHost> ```

OVERLORD commented

2026-02-05 09:47:41 +03:00

@ssddanbrown commented on GitHub (Mar 1, 2025):

@demlak I have not tested this, but going via the apache documentation I'd try adding something like this above the existing <Directory ...> section:

<Location "/my-account">
   Require all denied
</Location>

Will need to test it though as I'm not exactly sure on the ordering of rules/config-blocks for apache config.

@ssddanbrown commented on GitHub (Mar 1, 2025): @demlak I have not tested this, but going via the apache documentation I'd try adding something like this above the existing `<Directory ...>` section: ```apache2 <Location "/my-account"> Require all denied </Location> ``` Will need to test it though as I'm not exactly sure on the ordering of rules/config-blocks for apache config.

OVERLORD commented

2026-02-05 09:47:42 +03:00

@demlak commented on GitHub (Mar 1, 2025):

Competent as always =)

Works! Thx a lot

this is a good base.. now i will use the theme-system to hide the profile from user-menu

Edit:
For anyone wanting todo the same thing:

Add and activate a theme like described here https://github.com/BookStackApp/BookStack/blob/development/dev/docs/visual-theme-system.md

The file we want to copy for editing, is resources/views/layouts/parts/header-user-menu.blade.php
Just copy it to your theme-folder like themes/my-theme/layouts/parts/header-user-menu.blade.php and edit it there to delete the coresponding <li>-entry:

        <li>
            <a href="{{ url('/my-account') }}" class="icon-item">
                @icon('user-preferences')
                <div>{{ trans('preferences.my_account') }}</div>
            </a>
        </li>

@demlak commented on GitHub (Mar 1, 2025): Competent as always =) Works! Thx a lot this is a good base.. now i will use the theme-system to hide the profile from user-menu Edit: For anyone wanting todo the same thing: Add and activate a theme like described here [https://github.com/BookStackApp/BookStack/blob/development/dev/docs/visual-theme-system.md](url) The file we want to copy for editing, is `resources/views/layouts/parts/header-user-menu.blade.php` Just copy it to your theme-folder like `themes/my-theme/layouts/parts/header-user-menu.blade.php` and edit it there to delete the coresponding `<li>`-entry: ``` <li> <a href="{{ url('/my-account') }}" class="icon-item"> @icon('user-preferences') <div>{{ trans('preferences.my_account') }}</div> </a> </li> ```

OVERLORD commented

2026-02-05 09:47:43 +03:00

@ssddanbrown commented on GitHub (Mar 20, 2025):

I'll go ahead and close this off since you found a solution.

@ssddanbrown commented on GitHub (Mar 20, 2025): I'll go ahead and close this off since you found a solution.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#5193