Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

Pages are incorrectly displayed inside a chapter at the book overview #2414

Closed
cdrfun opened this issue Dec 16, 2020 · 5 comments
Closed

Pages are incorrectly displayed inside a chapter at the book overview #2414

cdrfun opened this issue Dec 16, 2020 · 5 comments
Labels
🏭 Back-End 🔒 Security 🚀 Priority
Milestone
v0.30.6

Comments

@cdrfun
Copy link

cdrfun commented Dec 16, 2020

Describe the bug
A chapter is readable for Role1 and Role2, but all pages of this chapter are only readable for Role1. When you open the chapter for Role2, no pages are displayed. But when you open the book for Role2, the pages are displayed under the chapter and the first line of content is shown.

Steps To Reproduce
Steps to reproduce the behavior:

  1. Create a chapter with individual Read rights for Role1 and Role2
  2. Create two pages under this chapter with individual Read rights for Role1
  3. Open book overview with a user who is in Role2 only
  4. The pages are displayed under the chapter and the first line of content is shown.

Expected behavior
When you open the book for Role2, the chapter should be empty.

Screenshots
Role2 book view:
grafik

Role2 chapter view:
grafik

Your Configuration (please complete the following information):

  • BookStack v0.30.4
  • latest Linuxserver Docker image
@ssddanbrown
Copy link
Member

Thanks for reporting @cdrfun.

Have marked this to be tested and patched as a priority.

@ssddanbrown ssddanbrown added this to the v0.30.6 milestone Dec 17, 2020
ssddanbrown added a commit that referenced this issue Dec 17, 2020
@ssddanbrown
Fixed book-tree-gen page visibility issue
3f3fad7 
When book trees were generated, pages in chapters where ALL pages within
were not supposed to be visibile, would be visible due to the code
falling back on the raw relation which would not account for
permissions.

This has now been changed so that a custom 'visible_pages' attribute is set and used by any book tree structures, to ensure it does not fall back to the raw relation.

Added an extra test to cover.

For #2414
@ssddanbrown
Copy link
Member

Thanks again for reporting @cdrfun, This has now been addressed in v0.30.6: https://github.com/BookStackApp/BookStack/releases/tag/v0.30.6

Some notes from my testing and fixing:

  • If the restricted page sat alongside other non-restricted pages within the chapter then this issue would not be apparent. This only occurred when none of the pages within a chapter were visible.
  • This applied to a few different areas of BookStack including the sidebar tree views. The biggest concern was book exports since this would include the entire page content in the export.

Apologies if this issue caused you, or any others, problems.

@cdrfun
Copy link
Author

cdrfun commented Dec 18, 2020

I'm glad I was able to help, as I really love bookstack. I've tested the update and the reported behavior is correct now. Furthermore, I tested the export and the plaintext export still is shaky. This is the chapter export result from my test setup:
grafik

But the same error happens when exporting the book.
Shall I create a new issue @ssddanbrown or will the export issue also be handeled here?

ssddanbrown added a commit that referenced this issue Dec 18, 2020
@ssddanbrown
Fixed issue where restricted page content in plaintext export
2acef3c 
The content of pages made non-viewable to a user via permissions, within a visible parent, could be seen via the plaintext export option. Before v0.30.6 this would have applied only to scenarios where all pages within the chapter were made non-visible. In v0.30.6 this would make all pages within the chapter visible.

As per #2414
@ssddanbrown
Copy link
Member

Thanks so much once again for reporting that @cdrfun, Was part of the same thing but made worse with the changes in v0.30.6.

Have now deployed a new release to cover this: https://github.com/BookStackApp/BookStack/releases/tag/v0.30.7
Have added these cases along with some additional ones in our automated test to cover for future releases.

@cdrfun
Copy link
Author

cdrfun commented Dec 21, 2020

I did a retest and everything seems fine now. Thanks for your fast response, your way of managing Bookstack is great!

# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees
No one assigned
Labels
🏭 Back-End 🔒 Security 🚀 Priority
Milestone
v0.30.6
Development

No branches or pull requests
2 participants
@cdrfun @ssddanbrown