Attachment Links do not Use APP_URL #5506

New Issue

OVERLORD · 2026-02-05T10:07:31+03:00

OVERLORD commented

2026-02-05 10:07:31 +03:00

Originally created by @Bravehartk2 on GitHub (Nov 18, 2025).

Describe the Bug

When switching domains or from a local domain to a public domain via proxy, attachments and uploaded images for the logo etc. are referenced by the old local hostname they where uploaded from instead using the APP_URL environment variable as it would be expected.
Hence you'll. get mixed content in the browser and it's not possible to download attachements if the original url was not public available.
The links should be dynamic or relativ to make sure, the files can be served even, if the domain changes.

After reuploading the attachments / logo images, the resource can be loaded. But thats not an option for all attachments for an instance that is used for years with hundreds of attachments.

Steps to Reproduce

use a local domain or hostname
upload logo or icon in the settings
attach files to a page
address the host via an public URL (I additionally had to use a proxy, hence I run it on HomeAssistant inside my internal network)
set the APP_URL to the public domain in the .env file
Open the page in Browser and see http request in developer toolbar => mixed content error + old url for requesting the files
try to download an attachment => fails due to old, not accessible domain is used

Expected Behaviour

I would expect the application to use the APP_URL as prefix for all generated URLs and not saving the domain that was used to upload the image / attachment at all. Or analog wordpress there should be a replacement command or interface, where the URLs in the DB can be replaced. Or the URLs should always be relative or generated in the form "BASE_URL/REL_PATH_FROM_DB".

Screenshots or Additional Context

No response

Browser Details

No response

Exact BookStack Version

3.2.1

Originally created by @Bravehartk2 on GitHub (Nov 18, 2025). ### Describe the Bug When switching domains or from a local domain to a public domain via proxy, attachments and uploaded images for the logo etc. are referenced by the old local hostname they where uploaded from instead using the APP_URL environment variable as it would be expected. Hence you'll. get mixed content in the browser and it's not possible to download attachements if the original url was not public available. The links should be dynamic or relativ to make sure, the files can be served even, if the domain changes. After reuploading the attachments / logo images, the resource can be loaded. But thats not an option for all attachments for an instance that is used for years with hundreds of attachments. ### Steps to Reproduce 1. use a local domain or hostname 2. upload logo or icon in the settings 3. attach files to a page 4. address the host via an public URL (I additionally had to use a proxy, hence I run it on HomeAssistant inside my internal network) 5. set the APP_URL to the public domain in the .env file 6. Open the page in Browser and see http request in developer toolbar => mixed content error + old url for requesting the files 7. try to download an attachment => fails due to old, not accessible domain is used ### Expected Behaviour I would expect the application to use the APP_URL as prefix for all generated URLs and not saving the domain that was used to upload the image / attachment at all. Or analog wordpress there should be a replacement command or interface, where the URLs in the DB can be replaced. Or the URLs should always be relative or generated in the form "BASE_URL/REL_PATH_FROM_DB". ### Screenshots or Additional Context _No response_ ### Browser Details _No response_ ### Exact BookStack Version 3.2.1

OVERLORD added the 🐛 Bug label 2026-02-05 10:07:31 +03:00

OVERLORD closed this issue

2026-02-05 10:07:34 +03:00

OVERLORD commented

2026-02-05 10:07:36 +03:00

@ssddanbrown commented on GitHub (Nov 18, 2025):

Hi @Bravehartk2,

Or analog wordpress there should be a replacement command or interface, where the URLs in the DB can be replaced.

There is. Please see the "Update System URL" section here:
https://www.bookstackapp.com/docs/admin/commands/#update-system-url

@ssddanbrown commented on GitHub (Nov 18, 2025): Hi @Bravehartk2, > Or analog wordpress there should be a replacement command or interface, where the URLs in the DB can be replaced. There is. Please see the "Update System URL" section here: https://www.bookstackapp.com/docs/admin/commands/#update-system-url

OVERLORD commented

2026-02-05 10:07:38 +03:00

@Bravehartk2 commented on GitHub (Nov 19, 2025):

THX for the fast reply!
I will check, if I can access the docker instance trough the hass.io docker stack implementation. But for the "normal user" it would be great, if the Base-Domain for all stuff can be configured via env or even via interface (for Home Assistant analog certs, ssl and port).

@Bravehartk2 commented on GitHub (Nov 19, 2025): THX for the fast reply! I will check, if I can access the docker instance trough the hass.io docker stack implementation. But for the "normal user" it would be great, if the Base-Domain for all stuff can be configured via env or even via interface (for Home Assistant analog certs, ssl and port).

OVERLORD commented

2026-02-05 10:07:40 +03:00

@Bravehartk2 commented on GitHub (Dec 21, 2025):

If someone strumbles upon this issue here:
It was hard to get this done unter Home Assistent. You have to:

Enable SSH for supervisor on port 22222 via USB stick (see: https://developers.home-assistant.io/docs/operating-system/debugging/)
Determine the database connection (f.e Mariadb addon -> Databases)
Determine mariadb host name via docker inspect addon_core_mariadb
Get the ID or name of the bookstack docker container via docker container ls
Run this commad (see https://www.bookstackapp.com/docs/admin/commands/#update-system-url and https://hub.docker.com/r/linuxserver/bookstack):
docker exec -it -e DB_HOST=core-mariadb -e DB_USERNAME=USERNAME_PLACEHOLDER -e DB_PASSWORD='PW_PLACEHOLDER' -e DB_DATABASE=DB_NAME_FROM_MARIADB_INSPECT addon_a0d7b954_bookstack php /var/www/bookstack/a rtisan bookstack:update-url http://pi1:8080 https://books.nicedomain.com
Clear the cache: docker exec -it addon_a0d7b954_bookstack php /var/www /bookstack/artisan cache:clear

Perhaps this is useful to someone ...

@Bravehartk2 commented on GitHub (Dec 21, 2025): If someone strumbles upon this issue here: It was hard to get this done unter Home Assistent. You have to: 1. Enable SSH for supervisor on port 22222 via USB stick (see: https://developers.home-assistant.io/docs/operating-system/debugging/) 2. Determine the database connection (f.e Mariadb addon -> Databases) 3. Determine mariadb host name via `docker inspect addon_core_mariadb` 3. Get the ID or name of the bookstack docker container via `docker container ls` 4. Run this commad (see https://www.bookstackapp.com/docs/admin/commands/#update-system-url and https://hub.docker.com/r/linuxserver/bookstack): `docker exec -it -e DB_HOST=core-mariadb -e DB_USERNAME=USERNAME_PLACEHOLDER -e DB_PASSWORD='PW_PLACEHOLDER' -e DB_DATABASE=DB_NAME_FROM_MARIADB_INSPECT addon_a0d7b954_bookstack php /var/www/bookstack/a rtisan bookstack:update-url http://pi1:8080 https://books.nicedomain.com` 5. Clear the cache: `docker exec -it addon_a0d7b954_bookstack php /var/www /bookstack/artisan cache:clear` Perhaps this is useful to someone ...

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#5506