From 24c93c7cd206ccc597d04225348fac7081f45438 Mon Sep 17 00:00:00 2001
From: Samy <perumalsamy.s@gmail.com>
Date: Sun, 13 Sep 2026 14:36:42 +0400
Subject: [PATCH] Hide image upload options in Image Manager when user lacks
 permission

Fixes #6148
---
 lang/en/components.php                        |  1 +
 .../views/pages/parts/image-manager.blade.php | 32 ++++++++++++-------
 tests/Uploads/ImageTest.php                   | 25 +++++++++++++++
 3 files changed, 47 insertions(+), 11 deletions(-)

diff --git a/lang/en/components.php b/lang/en/components.php
index c33b1d0b7..184aefef7 100644
--- a/lang/en/components.php
+++ b/lang/en/components.php
@@ -11,6 +11,7 @@ return [
     'image_upload' => 'Upload Image',
     'image_intro' => 'Here you can select and manage images that have been previously uploaded to the system.',
     'image_intro_upload' => 'Upload a new image by dragging an image file into this window, or by using the "Upload Image" button above.',
+    'image_no_upload_permission' => 'You do not have permission to upload new images.',
     'image_all' => 'All',
     'image_all_title' => 'View all images',
     'image_book_title' => 'View images uploaded to this book',
diff --git a/resources/views/pages/parts/image-manager.blade.php b/resources/views/pages/parts/image-manager.blade.php
index 3050f5c5b..d4fbbc168 100644
--- a/resources/views/pages/parts/image-manager.blade.php
+++ b/resources/views/pages/parts/image-manager.blade.php
@@ -1,3 +1,8 @@
+@php
+    $canUploadImages = isset($page)
+        && userCan(\BookStack\Permissions\Permission::ImageCreateAll)
+        && userCan(\BookStack\Permissions\Permission::PageUpdate, $page);
+@endphp
 <div components="image-manager dropzone"
      option:dropzone:url="{{ url('/images/gallery?' . http_build_query(['uploaded_to' => $uploaded_to ?? 0])) }}"
      option:dropzone:success-message="{{ trans('components.image_upload_success') }}"
@@ -14,18 +19,20 @@
          refs="image-manager@popup"
          class="popup-background">
         <div class="popup-body" tabindex="-1">
-
             <div class="popup-header primary-background">
                 <div class="popup-title">{{ trans('components.image_select') }}</div>
-                <button refs="dropzone@selectButton image-manager@uploadButton" type="button">
-                    <span>@icon('upload')</span>
-                    <span>{{ trans('components.image_upload') }}</span>
-                </button>
-                <button refs="popup@hide"
-                        type="button"
-                        title="{{ trans('common.close') }}"
-                        class="popup-header-close">@icon('close')</button>
+                    <button refs="dropzone@selectButton image-manager@uploadButton" type="button"
+                      @if(!$canUploadImages) style="display: none;" @endif>
+                      <span>@icon('upload')</span>
+                      <span>{{ trans('components.image_upload') }}</span>
+                    </button>
+                    <button refs="popup@hide"
+                       type="button"
+                       title="{{ trans('common.close') }}"
+                       class="popup-header-close">@icon('close')
+                    </button>
             </div>
+  
 
             <div component="tabs"
                  option:tabs:active-under="880"
@@ -105,8 +112,11 @@
                         </div>
 
                         <div refs="image-manager@form-container-placeholder" class="p-m text-small text-muted">
-                            <p>{{ trans('components.image_intro') }}</p>
-                            <p refs="image-manager@upload-hint">{{ trans('components.image_intro_upload') }}</p>
+                           <p @if(!$canUploadImages) style="display: none;" @endif>{{ trans('components.image_intro') }}</p>
+                           <p refs="image-manager@upload-hint" @if(!$canUploadImages) style="display: none;" @endif>{{ trans('components.image_intro_upload') }}</p>
+                             @unless($canUploadImages)
+                           <p>{{ trans('components.image_no_upload_permission') }}</p>
+                            @endunless
                         </div>
 
                         <div refs="image-manager@formContainer" class="inner flex">
diff --git a/tests/Uploads/ImageTest.php b/tests/Uploads/ImageTest.php
index e7d435db5..343f2197d 100644
--- a/tests/Uploads/ImageTest.php
+++ b/tests/Uploads/ImageTest.php
@@ -689,6 +689,31 @@ class ImageTest extends TestCase
         $this->files->deleteAtRelativePath($relPath);
     }
 
+    public function test_image_manager_upload_options_only_shown_with_permission()
+    {
+        $page = $this->entities->page();
+        $editor = $this->users->editor();
+
+        $resp = $this->actingAs($editor)->get($page->getUrl('/edit'));
+        $this->withHtml($resp)->assertElementNotExists('[refs~="image-manager@uploadButton"]', ['style' => 'display: none;']);
+        $resp->assertDontSee('You do not have permission to upload new images.');
+
+        // Viewer with page-update permission but no image-create-all permission
+        $viewer = $this->users->viewer();
+        $this->permissions->setEntityPermissionsForRole($page, ['view', 'update'], $viewer->roles()->first());
+
+        $resp = $this->actingAs($viewer)->get($page->getUrl('/edit'));
+        $this->withHtml($resp)->assertElementExists('[refs~="image-manager@uploadButton"]', ['style' => 'display: none;']);
+        $resp->assertSee('You do not have permission to upload new images.');
+
+        // Grant image-create-all, upload options should now be enabled
+        $this->permissions->grantUserRolePermissions($viewer, ['image-create-all']);
+
+        $resp = $this->actingAs($viewer)->get($page->getUrl('/edit'));
+        $this->withHtml($resp)->assertElementNotExists('[refs~="image-manager@uploadButton"]', ['style' => 'display: none;']);
+        $resp->assertDontSee('You do not have permission to upload new images.');
+    }
+
     public function test_image_manager_regen_thumbnails()
     {
         $this->asEditor();