starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[Bug]: Users are able to see items they do not have access to in filter list #2337

New Issue
Open
opened 2026-04-25 00:06:15 +02:00 by adam · 1 comment
adam commented 2026-04-25 00:06:15 +02:00
Owner
Copy Link
Copy Source

Originally created by @nichwall on GitHub (Oct 29, 2024).

What happened?

Users are able to see items in the filter list even if they don't have access to the list, such as "Authors", "Series", "Tag", etc. The function getFilterData creates the filter based on the library without taking user access into account.

I limited this user to only view the "Science Fiction" tag, which for example should not show "Fantasy" or "Brandon Sanderson".
image
image

What did you expect to happen?

Filter information by user similar to other parts of the API.

A potential solution is to add a user parameter to filter the data and have user specific caches for the filter data for each library.

Steps to reproduce the issue

  1. Create a user
  2. Limit user access by tags
  3. Use the "filter" dropdown to see tags they shouldn't be able to see, along with other fields

Audiobookshelf version

v2.16.1

How are you running audiobookshelf?

Built from source

What OS is your Audiobookshelf server hosted from?

Linux

If the issue is being seen in the UI, what browsers are you seeing the problem on?

None

Logs

[2024-10-28 18:40:29.782] DEBUG: Filter data: {
  authors: [
    {
      id: 'b059d5e3-02a6-457e-be40-bb12a908fddd',
      name: 'Brandon Sanderson'
    },
    { id: '60841878-f8c7-4bd1-a69b-b4ad8c596d60', name: 'Comics' },
    {
      id: '4c5deaa4-5a16-46cd-8727-2cca67b9b764',
      name: 'Isaac Asimov'
    },
    {
      id: '87943f2e-dae8-40d3-abcd-540e0516c6f2',
      name: 'Isaac Asimov/Kevin T. Collins'
    },
    {
      id: 'cb568b56-004e-41c0-bd8b-bcaa81620934',
      name: 'Isaac Asimov/Larry McKeever'
    },
    {
      id: 'c08f18b7-5eb2-41af-b09e-89aad87e84e3',
      name: 'Isaac Asimov/Robert Fass'
    },
    {
      id: 'd031f7c3-775b-45da-9d4e-a8387a2deaae',
      name: 'Isaac Asimov/Scott Brick'
    }
  ],
  genres: [ 'Audiobook', 'Fiction', 'Science Fiction' ],
  tags: [ 'Fantasy', 'Science Fiction' ],
  series: [
    {
      id: 'bf580a5a-faf7-4fb8-8d25-5b6257911686',
      name: 'Foundation Universe'
    },
    {
      id: '84ee0215-37dd-40b8-bcf5-e20a8d832e80',
      name: 'Stormlight Archive'
    }
  ],
  narrators: [],
  languages: [ 'English', 'XXX' ],
  publishers: [
    'BBC Audiobooks America',
    'Blackstone Audio, Inc.',
    'Books On Tape',
    'Books on Tape'
  ],
  publishedDecades: [ '2010' ],
  numIssues: 0,
  loadedAt: 1730166029782
}

Additional Notes

The above log is an additional debug printout Logger.debug('Filter data:', data) to getFilterData https://github.com/advplyr/audiobookshelf/blob/50fd659749128a321ecc3284e128d014433145a9/server/utils/queries/libraryFilters.js#L435C1-L548C4

Originally created by @nichwall on GitHub (Oct 29, 2024). ### What happened? Users are able to see items in the filter list even if they don't have access to the list, such as "Authors", "Series", "Tag", etc. The function `getFilterData` creates the filter based on the library without taking user access into account. I limited this user to only view the "Science Fiction" tag, which for example should not show "Fantasy" or "Brandon Sanderson". ![image](https://github.com/user-attachments/assets/b58200ed-c122-4a63-b0c7-7f3af1f74724) ![image](https://github.com/user-attachments/assets/e1a6596a-3e11-4b0e-92f2-0ca78e0ef484) ### What did you expect to happen? Filter information by user similar to other parts of the API. A potential solution is to add a user parameter to filter the data and have user specific caches for the filter data for each library. ### Steps to reproduce the issue 1. Create a user 2. Limit user access by tags 3. Use the "filter" dropdown to see tags they shouldn't be able to see, along with other fields ### Audiobookshelf version v2.16.1 ### How are you running audiobookshelf? Built from source ### What OS is your Audiobookshelf server hosted from? Linux ### If the issue is being seen in the UI, what browsers are you seeing the problem on? None ### Logs ```shell [2024-10-28 18:40:29.782] DEBUG: Filter data: { authors: [ { id: 'b059d5e3-02a6-457e-be40-bb12a908fddd', name: 'Brandon Sanderson' }, { id: '60841878-f8c7-4bd1-a69b-b4ad8c596d60', name: 'Comics' }, { id: '4c5deaa4-5a16-46cd-8727-2cca67b9b764', name: 'Isaac Asimov' }, { id: '87943f2e-dae8-40d3-abcd-540e0516c6f2', name: 'Isaac Asimov/Kevin T. Collins' }, { id: 'cb568b56-004e-41c0-bd8b-bcaa81620934', name: 'Isaac Asimov/Larry McKeever' }, { id: 'c08f18b7-5eb2-41af-b09e-89aad87e84e3', name: 'Isaac Asimov/Robert Fass' }, { id: 'd031f7c3-775b-45da-9d4e-a8387a2deaae', name: 'Isaac Asimov/Scott Brick' } ], genres: [ 'Audiobook', 'Fiction', 'Science Fiction' ], tags: [ 'Fantasy', 'Science Fiction' ], series: [ { id: 'bf580a5a-faf7-4fb8-8d25-5b6257911686', name: 'Foundation Universe' }, { id: '84ee0215-37dd-40b8-bcf5-e20a8d832e80', name: 'Stormlight Archive' } ], narrators: [], languages: [ 'English', 'XXX' ], publishers: [ 'BBC Audiobooks America', 'Blackstone Audio, Inc.', 'Books On Tape', 'Books on Tape' ], publishedDecades: [ '2010' ], numIssues: 0, loadedAt: 1730166029782 } ``` ### Additional Notes The above log is an additional debug printout `Logger.debug('Filter data:', data)` to `getFilterData` https://github.com/advplyr/audiobookshelf/blob/50fd659749128a321ecc3284e128d014433145a9/server/utils/queries/libraryFilters.js#L435C1-L548C4
adam added the bugusers & permissions labels 2026-04-25 00:06:15 +02:00
adam commented 2026-04-25 00:06:15 +02:00
Author
Owner
Copy Link
Copy Source

@davidlfox commented on GitHub (Jan 6, 2025):

i didnt dig too deep into getFilterData referenced above, but i can debug this locally and the search will turn up narrators, series, authors, genres (possibly tags too) in this area of code too https://github.com/advplyr/audiobookshelf/blob/master/server/utils/queries/libraryItemsBookFilters.js#L1091

@davidlfox commented on GitHub (Jan 6, 2025): i didnt dig too deep into `getFilterData` referenced above, but i can debug this locally and the search will turn up narrators, series, authors, genres (possibly tags too) in this area of code too https://github.com/advplyr/audiobookshelf/blob/master/server/utils/queries/libraryItemsBookFilters.js#L1091
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label bug users & permissions
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#2337
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?