PWA: Prevent passing credentials to avoid redirection issues

[bookstack] / app / App / PwaManifestBuilder.php

diff --git a/app/App/PwaManifestBuilder.php b/app/App/PwaManifestBuilder.php
index 4902d354d28af01100312fa1b1b7f765bc6b3e38..ba4331a0f14522ab80f2bd2e93016941106409f4 100644 (file)
--- a/app/App/PwaManifestBuilder.php
+++ b/app/App/PwaManifestBuilder.php
@@ -6,6 +6,11 @@ class PwaManifestBuilder
 {
     public function build(): array
     {
+        // Note, while we attempt to use the user's preference here, the request to the manifest
+        // does not start a session, so we won't have current user context.
+        // This was attempted but removed since manifest calls could affect user session
+        // history tracking and back redirection.
+        // Context: https://github.com/BookStackApp/BookStack/issues/4649
         $darkMode = (bool) setting()->getForCurrentUser('dark-mode-enabled');
         $appName = setting('app-name');