search

BookStackApp / BookStack

A platform to create documentation/wiki content built with PHP & Laravel
https://www.bookstackapp.com/
MIT License
15.43k stars 1.94k forks source link

No message when user has no right to delete attachment #5323

Open JtheBAB opened 1 week ago

JtheBAB commented 1 week ago

Describe the Bug

A user complained that he edited a page and wanted to delete an attachment. He clicked on the delete button for the attachment, confirm it but nothing happen. It turned out that the permission setting in the group was "own". Changing to "all" and he could delete the attachment in question. I guess the attachment was uploaded by another person.

Steps to Reproduce

Check that the group setting for attachment is "onw". Edit a page as user A and upload an attachment Save it Edit the page as user B and try to delete the attachment. You can confirm the deletion but the attachment is still there.

Expected Behaviour

Bookstack should provide a message why that attachment can't be deleted.

Screenshots or Additional Context

No response

Browser Details

No response

Exact BookStack Version

v24.10.2

ssddanbrown commented 1 week ago

Thanks @JtheBAB for reporting. Ultimately, the user shouldn't be provided the option in the first place if they don't have the permissions to perform the action.

I've assigned to be addressed for the next feature release.