BookStackApp/BookStack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2026-10-12 02:01:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

Hide image upload options in Image Manager when user lacks permission

Browse Source 
Fixes #6148
This commit is contained in:
Samy
2026-09-14 15:40:54 +04:00
parent 2c22c3bcb8
commit 24c93c7cd2
3 changed files with 47 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lang/en/components.php
+1
View File
@@ -11,6 +11,7 @@ return [
'image_upload' => 'Upload Image',
'image_intro' => 'Here you can select and manage images that have been previously uploaded to the system.',
'image_intro_upload' => 'Upload a new image by dragging an image file into this window, or by using the "Upload Image" button above.',
'image_no_upload_permission' => 'You do not have permission to upload new images.',
'image_all' => 'All',
'image_all_title' => 'View all images',
'image_book_title' => 'View images uploaded to this book',
resources/views/pages/parts/image-manager.blade.php
+21 -11
View File
@@ -1,3 +1,8 @@
@php
$canUploadImages = isset($page)
&& userCan(\BookStack\Permissions\Permission::ImageCreateAll)
&& userCan(\BookStack\Permissions\Permission::PageUpdate, $page);
@endphp
<div components="image-manager dropzone"
option:dropzone:url="{{ url('/images/gallery?' . http_build_query(['uploaded_to' => $uploaded_to ?? 0])) }}"
option:dropzone:success-message="{{ trans('components.image_upload_success') }}"
@@ -14,18 +19,20 @@
refs="image-manager@popup"
class="popup-background">
<div class="popup-body" tabindex="-1">
<div class="popup-header primary-background">
<div class="popup-title">{{ trans('components.image_select') }}</div>
<button refs="dropzone@selectButton image-manager@uploadButton" type="button">
<span>@icon('upload')</span>
<span>{{ trans('components.image_upload') }}</span>
</button>
<button refs="popup@hide"
type="button"
title="{{ trans('common.close') }}"
class="popup-header-close">@icon('close')</button>
<button refs="dropzone@selectButton image-manager@uploadButton" type="button"
@if(!$canUploadImages) style="display: none;" @endif>
<span>@icon('upload')</span>
<span>{{ trans('components.image_upload') }}</span>
</button>
<button refs="popup@hide"
type="button"
title="{{ trans('common.close') }}"
class="popup-header-close">@icon('close')
</button>
</div>
<div component="tabs"
option:tabs:active-under="880"
@@ -105,8 +112,11 @@
</div>
<div refs="image-manager@form-container-placeholder" class="p-m text-small text-muted">
<p>{{ trans('components.image_intro') }}</p>
<p refs="image-manager@upload-hint">{{ trans('components.image_intro_upload') }}</p>
<p @if(!$canUploadImages) style="display: none;" @endif>{{ trans('components.image_intro') }}</p>
<p refs="image-manager@upload-hint" @if(!$canUploadImages) style="display: none;" @endif>{{ trans('components.image_intro_upload') }}</p>
@unless($canUploadImages)
<p>{{ trans('components.image_no_upload_permission') }}</p>
@endunless
</div>
<div refs="image-manager@formContainer" class="inner flex">
tests/Uploads/ImageTest.php
+25
View File
@@ -689,6 +689,31 @@ class ImageTest extends TestCase
$this->files->deleteAtRelativePath($relPath);
}
public function test_image_manager_upload_options_only_shown_with_permission()
{
$page = $this->entities->page();
$editor = $this->users->editor();
$resp = $this->actingAs($editor)->get($page->getUrl('/edit'));
$this->withHtml($resp)->assertElementNotExists('[refs~="image-manager@uploadButton"]', ['style' => 'display: none;']);
$resp->assertDontSee('You do not have permission to upload new images.');
// Viewer with page-update permission but no image-create-all permission
$viewer = $this->users->viewer();
$this->permissions->setEntityPermissionsForRole($page, ['view', 'update'], $viewer->roles()->first());
$resp = $this->actingAs($viewer)->get($page->getUrl('/edit'));
$this->withHtml($resp)->assertElementExists('[refs~="image-manager@uploadButton"]', ['style' => 'display: none;']);
$resp->assertSee('You do not have permission to upload new images.');
// Grant image-create-all, upload options should now be enabled
$this->permissions->grantUserRolePermissions($viewer, ['image-create-all']);
$resp = $this->actingAs($viewer)->get($page->getUrl('/edit'));
$this->withHtml($resp)->assertElementNotExists('[refs~="image-manager@uploadButton"]', ['style' => 'display: none;']);
$resp->assertDontSee('You do not have permission to upload new images.');
}
public function test_image_manager_regen_thumbnails()
{
$this->asEditor();