mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-05 00:29:48 +03:00
Any user who can view can change book\chapter\page permissions #688
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @FDmitryG on GitHub (May 23, 2018).
For Bug Reports
Expected Behavior
User with only View permissions can't modify permissions to book\chapter\page he can view.
Current Behavior
Any user that can view any book \ chapter \ page can change permissions to it. So he can set Create \ Update \ Delete permissions for group that he belong.
@ssddanbrown commented on GitHub (May 23, 2018):
Hi @FDmitryG, Thanks for raising this issue.
Can you please post a screenshot of the Role Permissions set on the role in question?
When configuring a role you have the following permissions available:
Does un-ticking these not take effect?
@FDmitryG commented on GitHub (May 24, 2018):
Hi!
Sorry, it is my fault (((
I mixed up this two options in my test user role.
I corrected mistake and check again and all works right!