Removal of books from a shelf can remove more books than intended #5372

New Issue

OVERLORD · 2026-02-05T10:00:42+03:00

OVERLORD commented

2026-02-05 10:00:42 +03:00

Originally created by @someplace53 on GitHub (Jul 22, 2025).

Describe the Bug

If a user removes the a book from a shelf, where he/she cannot see all books, the books which are not seen will be removed, if the shelf is saved.

Steps to Reproduce

there might be bit to many permissions, but this works:

create a role role_a with following permissions: 'manage permissions on own books, chapter & pages'; Shelfs: View (own, all), Edit (own, all); Books: Create, View (own), Edit (own, all), Delete (own)
create a user_a, who is part of role_a
create a user_b, without roles
create a shelf "test_shelf"
create 2 books ("book_a" and "book_b") and put them into "test_shelf"
change the ownership of book_b to user_b
login as user_a
go to test_shelf (only one book should be visible) and click edit
remove book_a from the shelf and save
verify with another account (admin?) that the shelf is empty

If needed I can provide a db dump for this scenario (~60kb)

Expected Behaviour

If I remove a book from a shelf, I would expect that only that book will be removed, not other books I am not aware of, too.

Screenshots or Additional Context

No response

Browser Details

No response

Exact BookStack Version

v24.12.1, v25.5.02

Originally created by @someplace53 on GitHub (Jul 22, 2025). ### Describe the Bug If a user removes the a book from a shelf, where he/she cannot see all books, the books which are not seen will be removed, if the shelf is saved. ### Steps to Reproduce there might be bit to many permissions, but this works: 1. create a role role_a with following permissions: 'manage permissions on own books, chapter & pages'; Shelfs: View (own, all), Edit (own, all); Books: Create, View (own), Edit (own, all), Delete (own) 2. create a user_a, who is part of role_a 3. create a user_b, without roles 4. create a shelf "test_shelf" 5. create 2 books ("book_a" and "book_b") and put them into "test_shelf" 6. change the ownership of book_b to user_b 7. login as user_a 8. go to test_shelf (only one book should be visible) and click edit 9. remove book_a from the shelf and save 10. verify with another account (admin?) that the shelf is empty If needed I can provide a db dump for this scenario (~60kb) ### Expected Behaviour If I remove a book from a shelf, I would expect that only that book will be removed, not other books I am not aware of, too. ### Screenshots or Additional Context _No response_ ### Browser Details _No response_ ### Exact BookStack Version v24.12.1, v25.5.02

OVERLORD added the 🐛 Bug label 2026-02-05 10:00:42 +03:00

OVERLORD closed this issue

2026-02-05 10:00:43 +03:00

OVERLORD commented

2026-02-05 10:00:44 +03:00

@Pheasey commented on GitHub (Jul 25, 2025):

I'm unable to replicate this issue on v25.05.2 or development branch.

@Pheasey commented on GitHub (Jul 25, 2025): I'm unable to replicate this issue on [v25.05.2](https://github.com/BookStackApp/BookStack/releases) or development branch.

OVERLORD commented

2026-02-05 10:00:47 +03:00

@someplace53 commented on GitHub (Jul 30, 2025):

I improved the description on how to reproduce the bug and I retested it with a fresh container stack, which I can also provide.

@someplace53 commented on GitHub (Jul 30, 2025): I improved the description on how to reproduce the bug and I retested it with a fresh container stack, which I can also provide.

OVERLORD commented

2026-02-05 10:00:48 +03:00

@ssddanbrown commented on GitHub (Aug 25, 2025):

Hi @someplace53, thanks for reporting.

I can confirm the issue, and have addressed this along with testing coverage via 13a79b3f96.
These changes will be part of the next BookStack patch or feature release.

@ssddanbrown commented on GitHub (Aug 25, 2025): Hi @someplace53, thanks for reporting. I can confirm the issue, and have addressed this along with testing coverage via 13a79b3f96c7525d6c4807c5ec83f9d96885f74e. These changes will be part of the next BookStack patch or feature release.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#5372