Bookstack: Overview of assigned rights/roles for books, chapters, pages needed for security

Created on 22 Oct 2019 · 3Comments · Source: BookStackApp/BookStack

Describe the feature you'd like
If I see it correctly, the way to make some content only available to some users, is to
Step 1) Create a role where only _own_ content can be viewed, updated, deleted
Step 2) Assign that role (only) to the particular user
Step 3) Manage the rights of the book/chapter/page in mind on an individual level and assigning view rights etc. for the role created in step 1.

The big problem I see here, is that there is currently ZERO oversight in which content can be seen/updated/deleted by which user.

Imagine having a lot of content and many users ... with not all content meant to be seen by all users. Currently one has to check the rights/permissions book by book, chapter by chapter, page by page (if one assumes that one is actively using permissions and there’s perhaps more than one admin).

This is a security nightmare! So what’s badly needed is some sort of permissions overview or filter, showing which user can see/create/update/delete which content where. This should be of course visible to the Admins only.

The difficulty here is to come up with a handy design, as a simple table with books/chapters/page in X and users/rights in Y would/could end up in an insanely huge table.

A simplistic design would be to have a page which shows all book titles, whereas each book has a list of all user names which have any right to either the particular book itself in whole, a chapter or page within it. The admin then can click onto the book title to inspect the permissions in detail.

Describe the benefits this feature would bring to BookStack users
Security. Avoidance of the wrong people seeing content not meant for their eyes.

Source

Wookbert

👍1

Most helpful comment

Here’s an actually working Table of Content page my partner has created, to which we've added a user-filter, so we as admins can see who has access to what. Unaccessible content is ghosted and stroke through.

Usually we are also showing the headlines of each page as part of the Table of Contents (see the screenshot in my comment to issue# 616), but we've added a checkbox to hide those for the permissions view.

Although it's working, it is still in work in progress.

Bildschirmfoto 2019-10-22 um 23 39 16