starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[Bug]: Websocket does not respect permissions #2715

New Issue
Closed
opened 2026-04-25 00:09:49 +02:00 by adam · 1 comment
adam commented 2026-04-25 00:09:49 +02:00
Owner
Copy Link
Copy Source

Originally created by @hacookbook on GitHub (Apr 12, 2025).

What happened?

I have a user setup with permissions to only allow access to a specific tag.

When accessing the regular API (using this user's auth token) this correctly filters out media. However, when subscribed to websocket events (using this user's auth token), the permissions are ignored and all events are sent, including library item events for media this user does not have permission to access.

What did you expect to happen?

I expect the websocket to respect permissions and not send library item events for a media that the user does not have permission to access.

Steps to reproduce the issue

  1. Create user
  2. Add podcast 1 with no tags
  3. Add podcast 2 with a tag "example_tag"
  4. Update user permissions; disable "can access all tags", add "example_tag" to "tags accessible to user"
  5. Verify the user can only see podcast 2 (either via frontend ot regular api)
  6. Connect to websocket using the api token for this user
  7. subscribe to "items_updated" and/or "item_updated" library item events
  8. make a change to podcast 1 (as someone with access, like root)
  9. verify bug, an event will be sent to the websocket subscription

Audiobookshelf version

2.20.0

How are you running audiobookshelf?

Docker

What OS is your Audiobookshelf server hosted from?

Linux

If the issue is being seen in the UI, what browsers are you seeing the problem on?

None

Logs

Additional Notes

No response

Originally created by @hacookbook on GitHub (Apr 12, 2025). ### What happened? I have a user setup with permissions to only allow access to a specific tag. When accessing the regular API (using this user's auth token) this correctly filters out media. However, when subscribed to websocket events (using this user's auth token), the permissions are ignored and all events are sent, including library item events for media this user does not have permission to access. ### What did you expect to happen? I expect the websocket to respect permissions and not send library item events for a media that the user does not have permission to access. ### Steps to reproduce the issue 1. Create user 2. Add podcast 1 with no tags 3. Add podcast 2 with a tag "example_tag" 4. Update user permissions; disable "can access all tags", add "example_tag" to "tags accessible to user" 5. Verify the user can only see podcast 2 (either via frontend ot regular api) 6. Connect to websocket using the api token for this user 7. subscribe to "items_updated" and/or "item_updated" library item events 8. make a change to podcast 1 (as someone with access, like root) 9. verify bug, an event will be sent to the websocket subscription ### Audiobookshelf version 2.20.0 ### How are you running audiobookshelf? Docker ### What OS is your Audiobookshelf server hosted from? Linux ### If the issue is being seen in the UI, what browsers are you seeing the problem on? None ### Logs ```shell ``` ### Additional Notes _No response_
adam added the bug label 2026-04-25 00:09:49 +02:00
adam closed this issue 2026-04-25 00:09:49 +02:00
adam commented 2026-04-25 00:09:50 +02:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Apr 27, 2025):

Fixed in v2.21.0.

@github-actions[bot] commented on GitHub (Apr 27, 2025): Fixed in [v2.21.0](https://github.com/advplyr/audiobookshelf/releases/tag/v2.21.0).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#2715
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?