mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-07-16 05:33:49 +03:00
Permission Bug - Page create fails within chapter if lacking permissions to view the parent book #734
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @andresilva-cc on GitHub (Jul 3, 2018).
First, let me explain what I'm trying to do:
I have a book which is composed of several chapters. There's a new user who needs access to only a specific chapter in this book, he should be able to create and edit pages in this chapter, but he shouldn't be able to see the other chapters.
Before this modification, I activated custom permission for this book, where group "Telecom" has full access to it, and all chapters inherit this permission. So what I tried to do is: I activated the custom permissions on this chapter, enabled full access to "Telecom" group (to keep this permission), but I also enabled full access to the group this user belongs (it's a "personal" group, only he is in the group). So the permissions are like this:
So, what I realized is that he can't see the book. Ok, that's fine, I think that was expected, he can still access the chapter by using the URL or in the recents panel. The problem is, he can't create new pages, it gives him a 404 error.
I can't understand why this is happening, I gave full access to the chapter, but he still can't create new pages. I can solve this by enabling some permissions on the book itself, but then he would be able to see all the chapters.
@andresilva-cc commented on GitHub (Jul 9, 2018):
Anyone?
@ssddanbrown commented on GitHub (Jul 14, 2018):
Hi @DeehSlash, Thanks for reporting and sorry for the slow response, It's taken me a couple of goes to understand your exact scenario. I understand the issue now and can confirm the bug.
I've marked the fix for the next release.
Developer Notes
At some point during page creation the book is searched for within Entity repo. This needs to be carefully changed to ignore view permissions, If it's required at all.