{"record":{"id":"f40b9feceda3e86e","repo":"BookStackApp/BookStack","slug":"user-does-not-have-permission-to-create-a-page-wit","errorCode":null,"errorMessage":"User does not have permission to create a page within the new parent","messagePattern":"User does not have permission to create a page within the new parent","errorType":"exception","errorClass":"PermissionsException","httpStatus":null,"severity":"error","filePath":"app/Entities/Repos/PageRepo.php","lineNumber":283,"sourceCode":"    }\n\n    /**\n     * Move the given page into a new parent book or chapter.\n     * The $parentIdentifier must be a string of the following format:\n     * 'book:<id>' (book:5).\n     *\n     * @throws MoveOperationException\n     * @throws PermissionsException\n     */\n    public function move(Page $page, string $parentIdentifier): Entity\n    {\n        $parent = $this->entityQueries->findVisibleByStringIdentifier($parentIdentifier);\n        if (!$parent instanceof Chapter && !$parent instanceof Book) {\n            throw new MoveOperationException('Book or chapter to move page into not found');\n        }\n\n        if (!userCan(Permission::PageCreate, $parent)) {\n            throw new PermissionsException('User does not have permission to create a page within the new parent');\n        }\n\n        return (new DatabaseTransaction(function () use ($page, $parent) {\n            $page->chapter_id = ($parent instanceof Chapter) ? $parent->id : null;\n            $newBookId = ($parent instanceof Chapter) ? $parent->book->id : $parent->id;\n            $this->parentChanger->changeBook($page, $newBookId);\n            $page->rebuildPermissions();\n\n            Activity::add(ActivityType::PAGE_MOVE, $page);\n\n            $this->baseRepo->sortParent($page);\n\n            return $parent;\n        }))->run();\n    }\n\n    /**\n     * Get a new priority for a page.","sourceCodeStart":265,"sourceCodeEnd":301,"githubUrl":"https://github.com/BookStackApp/BookStack/blob/18f8469a1c72f8cc8497e9372635e6dea5028071/app/Entities/Repos/PageRepo.php#L265-L301","documentation":"PageRepo::move checks userCan(Permission::PageCreate, $parent) after validating the destination Book/Chapter. If the current user cannot create pages within the new parent, it throws PermissionsException('User does not have permission to create a page within the new parent'). Destination create permission is required in addition to the parent existing.","triggerScenarios":"move($page, $parentIdentifier) executed by a user lacking 'page-create' via role permission or per-entity restrictions on the target Book/Chapter — even if they can view it.","commonSituations":"API tokens with read-only or limited scopes running import/move automation; roles where users can view but not create content in another's book; chapter-level restrictions; permission model changes after an upgrade.","solutions":["Grant 'Create page' permission to the user's role or add a restriction on the target book/chapter.","Run the move as a privileged account/token.","Pre-check userCan(Permission::PageCreate, $parent) and disable the move UI/abort early when false.","Catch PermissionsException and display an explanatory message."],"exampleFix":"// before\n$pageRepo->move($page, $parentId);\n// after\n$parent = $entityQueries->findVisibleByStringIdentifier($parentId);\nif (!userCan(\\BookStack\\Permissions\\Permission::PageCreate, $parent)) {\n    return back()->with('error', 'You cannot create pages in that location');\n}\n$pageRepo->move($page, $parentId);","handlingStrategy":"validation","validationCode":"$parent = $entityQueries->findVisibleByStringIdentifier($identifier);\nif ($parent && !userCan(\\BookStack\\Permissions\\Permission::PageCreate, $parent)) {\n    abort(403, 'Missing page-create permission on target parent');\n}","typeGuard":null,"tryCatchPattern":"try {\n    $pageRepo->move($page, $identifier);\n} catch (\\BookStack\\Exceptions\\PermissionsException $e) {\n    return back()->with('error', $e->getMessage());\n}","preventionTips":["Verify page-create rights (role or restriction) on the destination","Use privileged credentials for bulk/import operations","Disable move controls when userCan(PageCreate, target) is false"],"tags":["bookstack","permissions","authorization","laravel"],"backgroundTag":"insufficient-permissions","analyzedSha":"18f8469a1c72f8cc8497e9372635e6dea5028071","analyzedAt":"2026-09-02T19:49:33.068Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-10T02:17:09.455Z"}