mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-07 19:06:05 +03:00
Permission #5365
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Yarrax on GitHub (Jul 16, 2025).
Describe the Bug
Hello. I have a question about Permissions.
The permission rules are currently set up like this:
The problem we're facing is that if someone in our team creates a book, others can't see it. That's fine.
But if the author wants the book to be visible to others without giving them editing rights, then we need to change the "Common user" permissions.
In that case, according to the current setup, the role for "Common User" would look like this:
However, with this setup, the owner’s permissions get overwritten. As a result, even the owner of the book can’t edit or delete it anymore, regardless of the system settings.
It's looks like bug.
It seemed correct to me that overriding a role shouldn't affect the owner. In other words, system-level settings should take precedence over role changes applied to an object.
Steps to Reproduce
Expected Behaviour
Owner have permissions to create, edit and delete sub-objects (chapters, pages etc.)
Screenshots or Additional Context
No response
Browser Details
No response
Exact BookStack Version
v25.05
@ssddanbrown commented on GitHub (Jul 16, 2025):
Hi @Yarrax,
That's expected (assuming the owner is part of that group) since the role level permissions are more specific, and the item-level role permission override acts as a deny as much as an allow.
I appreciate this may be a hinderance to many scenarios though.
Existing issue #5672 is already open to suggest a means to allow overrides via a means which still allows inheritance in some form.
@ssddanbrown commented on GitHub (Jul 23, 2025):
Since there's been no further follow-up on this I'll go ahead and close it off.