Privileges in Bookstack #5267

New Issue

OVERLORD · 2026-02-05T09:52:34+03:00

OVERLORD commented

2026-02-05 09:52:34 +03:00

Originally created by @qu1dam on GitHub (Apr 23, 2025).

Attempted Debugging

I have read the debugging page

Searched GitHub Issues

I have searched GitHub for the issue.

Describe the Scenario

Hello everyone,

I have the following situation: I would like to allow access to the Bookstack application within our internal environment so that it is available to everyone without the need to log in.
However, if a user chooses to log in, they should be able to see an additional shelf, which is also accessible to other users, but each user should only see their own book.

I can see that this should be possible through permission settings, but I can’t seem to get it to work properly.
If I create a separate group and grant that group view permissions so that a user added to it can see it, and then I set it so that the user should only see their own content — the permission settings don’t seem to apply as expected.

I would appreciate any help or guidance on how to achieve this, if it is even possible. Thank you!

Exact BookStack Version

v25.02

Log Content

No response

Hosting Environment

PHP 8.3.6, Ubuntu 24.04.2 LTS

Originally created by @qu1dam on GitHub (Apr 23, 2025). ### Attempted Debugging - [x] I have read the debugging page ### Searched GitHub Issues - [x] I have searched GitHub for the issue. ### Describe the Scenario Hello everyone, I have the following situation: I would like to allow access to the Bookstack application within our internal environment so that it is available to everyone without the need to log in. However, if a user chooses to log in, they should be able to see an additional shelf, which is also accessible to other users, but each user should only see their own book. I can see that this should be possible through permission settings, but I can’t seem to get it to work properly. If I create a separate group and grant that group view permissions so that a user added to it can see it, and then I set it so that the user should only see their own content — the permission settings don’t seem to apply as expected. I would appreciate any help or guidance on how to achieve this, if it is even possible. Thank you! ### Exact BookStack Version v25.02 ### Log Content _No response_ ### Hosting Environment PHP 8.3.6, Ubuntu 24.04.2 LTS

OVERLORD added the 🐕 Support label 2026-02-05 09:52:34 +03:00

OVERLORD closed this issue

2026-02-05 09:52:36 +03:00

OVERLORD commented

2026-02-05 09:52:39 +03:00

@ssddanbrown commented on GitHub (Apr 23, 2025):

Hi @qu1dam,

If I create a separate group and grant that group view permissions so that a user added to it can see it, and then I set it so that the user should only see their own content — the permission settings don’t seem to apply as expected.

"Own" permissions are only really relevant to single users (the assigned owner in the item permission view), not groups.

For your scenario, it sounds like you need to set role-specific permissions on the content (book, chapter,page,shelf), by setting just "View" permissions (and other permissions) for just the allows roles, then uncheck "Inherit defaults" on the "Everyone Else" option to prevent default view permissions allowing view access.

Alternatively, you can add specific permissions for the "Public" role (assuming this is still assigned to the guest user), providing no permissions. This method specifically prevents view to non-logged-in users, rather than limiting access to specific other roles.

Lastly: Shelf permissions don't auto-apply to child content, you'd have to copy the permissions to child books (which there is a button for on the permission pages). Book (and chapter) permissions auto-cascade unless overridden below.
It's generally easier to manage things at a book-level when it comes to scenarios where permissions are in play.

@ssddanbrown commented on GitHub (Apr 23, 2025): Hi @qu1dam, > If I create a separate group and grant that group view permissions so that a user added to it can see it, and then I set it so that the user should only see their own content — the permission settings don’t seem to apply as expected. "Own" permissions are only really relevant to single users (the assigned owner in the item permission view), not groups. For your scenario, it sounds like you need to set role-specific permissions on the content (book, chapter,page,shelf), by setting just "View" permissions (and other permissions) for just the allows roles, then uncheck "Inherit defaults" on the "Everyone Else" option to prevent default view permissions allowing view access. Alternatively, you can add specific permissions for the "Public" role (assuming this is still assigned to the guest user), providing no permissions. This method specifically prevents view to non-logged-in users, rather than limiting access to specific other roles. Lastly: Shelf permissions don't auto-apply to child content, you'd have to copy the permissions to child books (which there is a button for on the permission pages). Book (and chapter) permissions auto-cascade unless overridden below. It's generally easier to manage things at a book-level when it comes to scenarios where permissions are in play.

OVERLORD commented

2026-02-05 09:52:41 +03:00

@qu1dam commented on GitHub (Apr 23, 2025):

Thanks for the response.

For example, I would like to ask if the following scenario is possible, because I have set it up this way, but the privileges still aren't being restricted as expected.

Currently, view privileges are enabled for everyone who visits the site, and all users have access to books and shelves.

I created an additional Shelf and added a group called "Employees" to it, who have view-only access, while everyone else is denied access.

In the "Employees" group, I assigned privileges to view only their own content.

There are currently two users in that group, but when they log in, both can see each other's books, even though user1 should only see their own book, and user2 likewise should only see their own.

Right now, logged-in users who belong to the "Employees" group can see books created by each other.

@qu1dam commented on GitHub (Apr 23, 2025): Thanks for the response. For example, I would like to ask if the following scenario is possible, because I have set it up this way, but the privileges still aren't being restricted as expected. Currently, view privileges are enabled for everyone who visits the site, and all users have access to books and shelves. I created an additional Shelf and added a group called "Employees" to it, who have view-only access, while everyone else is denied access. In the "Employees" group, I assigned privileges to view only their own content. There are currently two users in that group, but when they log in, both can see each other's books, even though user1 should only see their own book, and user2 likewise should only see their own. Right now, logged-in users who belong to the "Employees" group can see books created by each other.

OVERLORD commented

2026-02-05 09:52:43 +03:00

@ssddanbrown commented on GitHub (Apr 24, 2025):

Again, it's hard to understand your scenario or your desire, since permissions can be complex.

Do the books have book-level permissions set upon them? (Permissions view when looking at the book). Maybe copied from the shelf?
If the Employees have a book-level permission there, then that will override any role-level "Own" permissions, since it's more specific, and I'd expect that anyone in the Employees role can see any book with book-level permissions which allow the Employees view permission.

The Own permissions don't really work well with item-level permissions, since any item-level permission will take precedence.

@ssddanbrown commented on GitHub (Apr 24, 2025): Again, it's hard to understand your scenario or your desire, since permissions can be complex. Do the books have book-level permissions set upon them? (Permissions view when looking at the book). Maybe copied from the shelf? If the `Employees` have a book-level permission there, then that will override any role-level "Own" permissions, since it's more specific, and I'd expect that anyone in the `Employees` role can see any book with book-level permissions which allow the `Employees` view permission. The `Own` permissions don't really work well with item-level permissions, since any item-level permission will take precedence.

OVERLORD commented

2026-02-05 09:52:44 +03:00

@ssddanbrown commented on GitHub (Jun 23, 2025):

Since there's been no further follow-up on this I'll go ahead and close it off.

@ssddanbrown commented on GitHub (Jun 23, 2025): Since there's been no further follow-up on this I'll go ahead and close it off.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#5267