Skip to content

Privileges in Bookstack #5589

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
2 tasks done
qu1dam opened this issue Apr 23, 2025 · 3 comments
Open
2 tasks done

Privileges in Bookstack #5589

qu1dam opened this issue Apr 23, 2025 · 3 comments

Comments

@qu1dam
Copy link

qu1dam commented Apr 23, 2025

Attempted Debugging

  • I have read the debugging page

Searched GitHub Issues

  • I have searched GitHub for the issue.

Describe the Scenario

Hello everyone,

I have the following situation: I would like to allow access to the Bookstack application within our internal environment so that it is available to everyone without the need to log in.
However, if a user chooses to log in, they should be able to see an additional shelf, which is also accessible to other users, but each user should only see their own book.

I can see that this should be possible through permission settings, but I can’t seem to get it to work properly.
If I create a separate group and grant that group view permissions so that a user added to it can see it, and then I set it so that the user should only see their own content — the permission settings don’t seem to apply as expected.

I would appreciate any help or guidance on how to achieve this, if it is even possible. Thank you!

Exact BookStack Version

v25.02

Log Content

No response

Hosting Environment

PHP 8.3.6, Ubuntu 24.04.2 LTS

@ssddanbrown
Copy link
Member

Hi @qu1dam,

If I create a separate group and grant that group view permissions so that a user added to it can see it, and then I set it so that the user should only see their own content — the permission settings don’t seem to apply as expected.

"Own" permissions are only really relevant to single users (the assigned owner in the item permission view), not groups.

For your scenario, it sounds like you need to set role-specific permissions on the content (book, chapter,page,shelf), by setting just "View" permissions (and other permissions) for just the allows roles, then uncheck "Inherit defaults" on the "Everyone Else" option to prevent default view permissions allowing view access.

Alternatively, you can add specific permissions for the "Public" role (assuming this is still assigned to the guest user), providing no permissions. This method specifically prevents view to non-logged-in users, rather than limiting access to specific other roles.

Lastly: Shelf permissions don't auto-apply to child content, you'd have to copy the permissions to child books (which there is a button for on the permission pages). Book (and chapter) permissions auto-cascade unless overridden below.
It's generally easier to manage things at a book-level when it comes to scenarios where permissions are in play.

@qu1dam
Copy link
Author

qu1dam commented Apr 23, 2025

Thanks for the response.

For example, I would like to ask if the following scenario is possible, because I have set it up this way, but the privileges still aren't being restricted as expected.

Currently, view privileges are enabled for everyone who visits the site, and all users have access to books and shelves.

I created an additional Shelf and added a group called "Employees" to it, who have view-only access, while everyone else is denied access.

In the "Employees" group, I assigned privileges to view only their own content.

There are currently two users in that group, but when they log in, both can see each other's books, even though user1 should only see their own book, and user2 likewise should only see their own.

Right now, logged-in users who belong to the "Employees" group can see books created by each other.

@ssddanbrown
Copy link
Member

Again, it's hard to understand your scenario or your desire, since permissions can be complex.

Do the books have book-level permissions set upon them? (Permissions view when looking at the book). Maybe copied from the shelf?
If the Employees have a book-level permission there, then that will override any role-level "Own" permissions, since it's more specific, and I'd expect that anyone in the Employees role can see any book with book-level permissions which allow the Employees view permission.

The Own permissions don't really work well with item-level permissions, since any item-level permission will take precedence.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Development

No branches or pull requests

2 participants