BookStack Code Mirror - website/blob - content/blog/2020/beta-security-release-v0-30-6.md

2 categories = ["Releases"]

3 tags = ["Releases"]

4 title = "Beta Security Release v0.30.6"

5 date = 2020-12-17T21:30:00Z

6 author = "Dan Brown"

7 image = "/images/blog-cover-images/unsplash/lock-door-waldemar-brandt.jpg"

8 description = "BookStack v0.30.6 has been released to address an issue that could lead to restricted page content being visible in certain circumstances."

9 slug = "beta-release-v0-30-6"

10 draft = false

11 +++

12

13

14 BookStack v0.30.6 has been released to address an issue that could lead to restricted page content being visible in certain circumstances.

15 You should upgrade to this released as soon as possible if you make use of page-level permissions at all.

16

17 * [Update instructions](https://www.bookstackapp.com/docs/admin/updates)

18 * [GitHub release page](https://github.com/BookStackApp/BookStack/releases/tag/v0.30.6)

19

20

21 ### Impact

22

23 If a chapter was visible to a user, but all of its pages were made not visible, then the details of these pages could be visible. Within the BookStack interface, the names of the pages and preview content could be seen. If the parent book was exported then this would include the content of the pages that had been restricted.

24

25 ### Patches

26

27 This has been patched in v0.30.6.

28

29 ### Workarounds

30

31 Please update. As a temporary workaround you could ensure that there is at least one other page within a chapter that's visible to users.

32

33 ### References

34

35 * [BookStack Beta v0.30.6](https://github.com/BookStackApp/BookStack/releases/tag/v0.30.6)

36 * [GitHub Issue #2414](https://github.com/BookStackApp/BookStack/issues/2414)

37

38 ### Attribution

39

40 A big thanks to [@cdrfun](https://github.com/cdrfun) for [discovering and reporting](https://github.com/BookStackApp/BookStack/issues/2414) this issue.

41

42 ### For more information

43

44 If you have any questions or comments about this advisory:

45 * Open an issue in [the BookStack GitHub repository](https://github.com/BookStackApp/BookStack/issues).

46 * Ask on the [BookStack Discord chat](https://discord.gg/ztkBqR2).

47 * Follow the [BookStack Security Advice](https://github.com/BookStackApp/BookStack#-security) to contact someone privately.

48

49 ----

50

51 <span style="font-size: 0.8em;opacity:0.9;">Header Image Credits: <span>Photo by <a href="https://unsplash.com/@waldemarbrandt67w?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText">Waldemar Brandt</a> on <a href="https://unsplash.com/s/photos/lock?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText">Unsplash</a></span></span>