Move can be used to delete items

[Bolthier]

Describe the bug
Move is essentially a delete option in combination with custom permissions. Right now the permission Edit gives the option to update, copy or move a page or chapter.

Steps To Reproduce
Steps to reproduce the behavior:

1. Create two books (Book 1 & Book 2), Role A, a user in Role A and a page in Book 1
2. Set custom permissions for Book 1 for Role A to Create, View & Edit
3. Set custom permissions for Book 2 for Group A to Create, View, Edit & Delete
4. Move Page 1 from Book 1 to Book 2
5. Click Delete and the page is permanently deleted as the custom permissions of Book 1 don't matter for Book 2

Expected behavior
No option to move pages without the permission Delete from the source location as it deletes the item from the original location. Likewise as it needs the Create and not Edit permission on target location.

Copy doesnt't remove the original file from the original location so that's no problem.

Could be less of an issue with the recycle bin, but is still an isolated issue of its own.
#1017

Your Configuration:

• Exact BookStack Version (Found in settings): BookStack v0.24.2
• PHP Version: 7.2
• Hosting Method (Nginx/Apache/Docker): Apache2

[ssddanbrown]

@Bolthier Interesting, good find, Thanks for raising.
Based on the above, I agree, The user should require delete permissions on the page when it's at it's original locations. So the required permissions will be as follows:

• Update permission in origin location.
• Delete permission in origin location.
• Create permission in target location.

Have marked to be in the next release.

[sexy-trousers]

Although I agree with what's said here (in particular about the recycle bin negating some of this), you should be able to Move elements within a Book.

@Bolthier was pointing out how you can potentially circumvent security to delete elements, but if the move was contained within the book the user had access to, the Delete permission shouldn't be required.

TJ

[Bolthier]

@sexy-trousers As it's possible to assign Delete permissions on a chapter by chapter base I think it would still be a potential security issue.

I think the same issue exists for the Sort Book function.