mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-08 19:06:06 +03:00
Public image access denied #5515
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @RFrost619 on GitHub (Nov 20, 2025).
Describe the Bug
After upgrading to v25.11.2, public users who have access to a page do not receive access to images.
Steps to Reproduce
Upgrade docker image container from v25.11.1 to v25.11.2. Refresh web page when user is not authenticated. Unauthenticated users lose access to images.
Expected Behaviour
Users should retain access to images where they have been provided access to the web page.
Screenshots or Additional Context
Attempted to run the following commands which had no effect:
php artisan bookstack:regenerate-permissions
php artisan bookstack:regenerate-references
Permissions on the files appear to be correct, and downgrading the version resolves the problem.
Browser Details
Firefox and chrome were used to test
Exact BookStack Version
v25.11.2
@ssddanbrown commented on GitHub (Nov 21, 2025):
Hi @RFrost619,
Thanks for reporting, I think I may have just not consider a config & user scenario when making recent image control changes.
Just to confirm, do you have any
STORAGE_*options set within your BookStack env config? And if so, what settings/values do you have set? (where not containing credentials).@RFrost619 commented on GitHub (Nov 21, 2025):
Hi @ssddanbrown,
Of course!
I do have STORAGE_TYPE=local_secure_restricted. Outside of the basic app, port, password options, I am using OIDC and mail variables.
Cleansed .env:
APP_URL=https://my.site.url
APP_PORT=443
DB_PASSWORD=strong_pass_1
DB_ROOT_PASSWORD=strong_pass_2
WEB_PORT=8080
STORAGE_TYPE=local_secure_restricted
AUTH_METHOD=oidc
AUTH_AUTO_INITIATE=false
OIDC_NAME=authentik
OIDC_DISPLAY_NAME_CLAIMS=name
OIDC_CLIENT_ID=client_id
OIDC_CLIENT_SECRET=client_secret
OIDC_ISSUER=https://authentik.io/application/o/bookstack/
OIDC_ISSUER_DISCOVER=true
OIDC_END_SESSION_ENDPOINT=true
OIDC_USER_TO_GROUPS=true
OIDC_GROUPS_CLAIM=groups
OIDC_ADDITIONAL_SCOPES=groups
OIDC_REMOVE_FROM_GROUPS=true
MAIL_DRIVER=smtp
MAIL_HOST=smtp.mail.com
MAIL_PORT=465
MAIL_ENCRYPTION=tls
MAIL_USERNAME=bookstack@site.url
MAIL_PASSWORD=strong_pass_3
MAIL_FROM=bookstack@site.url
MAIL_FROM_NAME=BookStack
@ssddanbrown commented on GitHub (Nov 21, 2025):
@RFrost619 Thanks for providing those details.
This confirms the scenario I had thought I had missed, where
local_secure_restrictedis used with public/guest access.Apologies, I'll prioritise this to a patch release.
@ssddanbrown commented on GitHub (Nov 21, 2025):
This has now been addressed as part of #5909, and will be part of Bookstack v25.11.3 which will be released shortly.
Thanks again @RFrost619 for raising.
@RFrost619 commented on GitHub (Dec 1, 2025):
Just wanted to circle around and confirm this issue is resolved for me in the latest version. I also wanted to say thanks again for the amazing work!