[PR #665] [MERGED] Adds ability to secure images behind auth #5682

New Issue

OVERLORD · 2026-02-05T10:14:06+03:00

OVERLORD commented

2026-02-05 10:14:06 +03:00

📋 Pull Request Information

Original PR: https://github.com/BookStackApp/BookStack/pull/665
Author: @ssddanbrown
Created: 1/13/2018
Status: ✅ Merged
Merged: 1/20/2018
Merged by: @ssddanbrown

Base: master ← Head: authed_images

📝 Commits (1)

0afa417 Added ability to secure images behind auth

📊 Changes

8 files changed (+67 additions, -45 deletions)

View changed files

📝 app/Http/Controllers/ImageController.php (+16 -0)
📝 app/Repos/ImageRepo.php (+3 -4)
📝 app/Services/AttachmentService.php (+31 -23)
📝 app/Services/ImageService.php (+6 -16)
📝 app/Services/UploadService.php (+0 -1)
📝 config/filesystems.php (+6 -1)
📝 routes/web.php (+3 -0)
➕ storage/uploads/images/.gitignore (+2 -0)

📄 Description

This feature puts images behind the authentication barrier so they are only viewable by logged-in users. Permission levels not taken into account, It's simply based on 'Is user authed?'.

Cannot be used alongside public viewing.
Set to be opt-in for now.

Public image access should still be served by the webserver as before, Secure image access goes through the app so will have a performance penalty.

Still in testing. Would be great for folks to test on their setups for any issues. (Do not test on production instances though). I experienced issues doing something similar when initially creating BookStack but so far everything has been working without issue on my dev machine.

Use Instructions

To use simply set STORAGE_TYPE=local_secure in your .env file.
Files will be stored in a storage/uploads/images folder similar to attachments.

If you are migrating to this option with existing images you will need to move all content in the folder public/uploads/images to storage/uploads/images.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/BookStackApp/BookStack/pull/665 **Author:** [@ssddanbrown](https://github.com/ssddanbrown) **Created:** 1/13/2018 **Status:** ✅ Merged **Merged:** 1/20/2018 **Merged by:** [@ssddanbrown](https://github.com/ssddanbrown) **Base:** `master` ← **Head:** `authed_images` --- ### 📝 Commits (1) - [`0afa417`](https://github.com/BookStackApp/BookStack/commit/0afa417b0a9f1648e3c400f341ffa14c8b96599d) Added ability to secure images behind auth ### 📊 Changes **8 files changed** (+67 additions, -45 deletions) <details> <summary>View changed files</summary> 📝 `app/Http/Controllers/ImageController.php` (+16 -0) 📝 `app/Repos/ImageRepo.php` (+3 -4) 📝 `app/Services/AttachmentService.php` (+31 -23) 📝 `app/Services/ImageService.php` (+6 -16) 📝 `app/Services/UploadService.php` (+0 -1) 📝 `config/filesystems.php` (+6 -1) 📝 `routes/web.php` (+3 -0) ➕ `storage/uploads/images/.gitignore` (+2 -0) </details> ### 📄 Description This feature puts images behind the authentication barrier so they are only viewable by logged-in users. Permission levels not taken into account, It's simply based on 'Is user authed?'. Cannot be used alongside public viewing. Set to be opt-in for now. Public image access should still be served by the webserver as before, Secure image access goes through the app so will have a performance penalty. Still in testing. Would be great for folks to test on their setups for any issues. (Do not test on production instances though). I experienced issues doing something similar when initially creating BookStack but so far everything has been working without issue on my dev machine. ## Use Instructions To use simply set `STORAGE_TYPE=local_secure` in your `.env` file. Files will be stored in a `storage/uploads/images` folder similar to attachments. If you are migrating to this option with existing images you will need to move all content in the folder `public/uploads/images` to `storage/uploads/images`. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

OVERLORD added the pull-request label 2026-02-05 10:14:06 +03:00

OVERLORD closed this issue

2026-02-05 10:14:10 +03:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#5682