mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-05 00:29:48 +03:00
Specific startpage should depend from user rights / role #933
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @ezzra on GitHub (Dec 1, 2018).
When using a "Specific Page" for Application Homepage, even users without any rights can see this page.
I have set a specific page as application homepage and I use it to present my users some useful informations and even important news from time to time. I also have enabled registration, so new team members can register by their own. Because only actual team members should get rights for the wiki, their starting role ("unconfirmed") is without any rights. If I checked the account, I have to confirm their registration and set an actual member role for them.
The problem is, that even with the first standard role "unconfirmed", they can see the starting page with the more or less sensitive informations. And because the registration needs to be open to everyone (I cannot use the domain restrictions), anyone can register and read the content of this starting page.
Thats of course a security issue for me and I chose a workaround, to just put a link on the welcome page to the "actual" welcome page which is not accessible for "unconfirmed". But of course, thats pretty inconvenient.
Aside from that, I would really love to present different welcome pages to different team groups, I guess that would be a big improvement and would even fix this security issue.
@ssddanbrown commented on GitHub (Nov 8, 2022):
I'm going to go ahead and close this off since it's had relatively little further desire since opening.
If happy to hack, it would be possible to implement something like this using the visual theme system.
@crazyyzarc commented on GitHub (Apr 10, 2025):
@ssddanbrown there is still interest on my part. Maybe you can make it simple for now by setting a different landing page for all logged-in users compared to non-logged-in users. With hacks this is also possible?