Separate “Restore revision” from “Update page” permission

[John-9000]

Describe the feature you'd like

Hello,

A user that can edit a page, can restore an old version. He can then edit that and restore another, and so on, until every restore could become unusable - by mistake or by evil intention.

Please add a separate "Restore" permission, that can be toggled for a role.
Only Admins should have that power in case a regular user messes up a page.

I have now seen another issue that asks for a permission just to view the restore.
#4526
I think that's similar, and a good idea also, but not quite. For how I want to setup things editors should be able to see old versions even if they can't restore them

Describe the benefits this would bring to existing BookStack users

Old page versions are safe, without using an external backup.

Users are allowed to make mistakes, this allows the Admin to not be overburdened with "who to give what role".
All users are allowed to edit or create pages in a certain book. It's a team book, for internal use in a company. We trust them not to edit in bad faith, still security of older versions would be great. Admin will repair mistakes by using the Restore option.

Can the goal of this request already be achieved via other means?

I don't know.

Have you searched for an existing open/closed issue?

• I have searched for existing issues and none cover my fundamental request

How long have you been using BookStack?

Under 3 months

Additional context

No response

[ssddanbrown]

Hi @John-9000,
Thanks for the request, but I'm unclear on how this would achieve the main security (of old versions) benefits stated.
A restore operation should generally act the same as an edit in regards to how it changes content.
Maybe I'm missing something though or misremembering the exact functionality at play.

[John-9000]

Hi @ssddanbrown

Thank you,
I realize it's my error: if an user intentionally deletes text on a page that has only version (1) and saves it, a new revision is created let's say (2). If he restores the previous revision (1) and wants to delete all text again and save it, a new revision is created again (3). So the user can never destroy the content of all the revisions as long as new ones are created each time he deletes the contents of a file.

[ssddanbrown]

@John-9000 Yeah, it'll always create new revision entries rather than altering or removing existing ones.
A user could lead to old versions being lost, if they create enough for revisions to start being deleted once the per-page revision limit is reached, but this is the same for both edit and restore operations.

If that's a concern for you, you can increase the revision limit, or make it infinite as per:
https://www.bookstackapp.com/docs/admin/other-config/#revision-limit