Public image access denied

[RFrost619]

Describe the Bug

After upgrading to v25.11.2, public users who have access to a page do not receive access to images.

Steps to Reproduce

Upgrade docker image container from v25.11.1 to v25.11.2. Refresh web page when user is not authenticated. Unauthenticated users lose access to images.

Expected Behaviour

Users should retain access to images where they have been provided access to the web page.

Screenshots or Additional Context

Attempted to run the following commands which had no effect:

php artisan bookstack:regenerate-permissions
php artisan bookstack:regenerate-references

Permissions on the files appear to be correct, and downgrading the version resolves the problem.

Browser Details

Firefox and chrome were used to test

Exact BookStack Version

v25.11.2

[ssddanbrown]

Hi @RFrost619,
Thanks for reporting, I think I may have just not consider a config & user scenario when making recent image control changes.

Just to confirm, do you have any STORAGE_* options set within your BookStack env config? And if so, what settings/values do you have set? (where not containing credentials).

[RFrost619]

Hi @ssddanbrown,

Of course!

I do have STORAGE_TYPE=local_secure_restricted. Outside of the basic app, port, password options, I am using OIDC and mail variables.

Cleansed .env:

APP_URL=https://my.site.url
APP_PORT=443
DB_PASSWORD=strong_pass_1
DB_ROOT_PASSWORD=strong_pass_2
WEB_PORT=8080
STORAGE_TYPE=local_secure_restricted
AUTH_METHOD=oidc
AUTH_AUTO_INITIATE=false
OIDC_NAME=authentik
OIDC_DISPLAY_NAME_CLAIMS=name
OIDC_CLIENT_ID=client_id
OIDC_CLIENT_SECRET=client_secret
OIDC_ISSUER=https://authentik.io/application/o/bookstack/
OIDC_ISSUER_DISCOVER=true
OIDC_END_SESSION_ENDPOINT=true
OIDC_USER_TO_GROUPS=true
OIDC_GROUPS_CLAIM=groups
OIDC_ADDITIONAL_SCOPES=groups
OIDC_REMOVE_FROM_GROUPS=true
MAIL_DRIVER=smtp
MAIL_HOST=smtp.mail.com
MAIL_PORT=465
MAIL_ENCRYPTION=tls
MAIL_USERNAME=bookstack@site.url
MAIL_PASSWORD=strong_pass_3
MAIL_FROM=bookstack@site.url
MAIL_FROM_NAME=BookStack

[ssddanbrown]

@RFrost619 Thanks for providing those details.

This confirms the scenario I had thought I had missed, where local_secure_restricted is used with public/guest access.
Apologies, I'll prioritise this to a patch release.

[ssddanbrown]

This has now been addressed as part of #5909, and will be part of Bookstack v25.11.3 which will be released shortly.
Thanks again @RFrost619 for raising.