new-usemame/Calibre-Web-NextGen v4.0.140

v4.0.140 — per-user hide is recoverable + safer (icon swap + off-by-default + placement)

on GitHub

What's new

docker pull ghcr.io/new-usemame/calibre-web-nextgen:v4.0.140

(or :latest)

Per-user hide: recoverable, distinct from Read/Unread, off by default

Two halves shipped together for fork issue #319:

If you'd already hidden a book by accident:

• The metadata-edit icon and reading icon on a hidden book's detail page no longer bounce with "Selected book is unavailable" — every action (read, edit, cover, download, Send-to-eReader) now works on your own hidden book.
• Covers render in /hidden/stored and on the hidden book's detail page (were blank before).
• The Hidden Books listing is discoverable: a "Hidden Books (N)" button appears on your /me profile page when you have hidden books.

Less likely to accidentally hide a book in the first place:

• The Read-status toggle's icon switched to a checkmark (was an eye that looked identical to the hide icon).
• The hide button moved to the END of the action row, well away from the frequently-clicked Read Status toggle.
• The hide feature is now off by default. Admins can enable it in Admin → Basic Configuration under "Allow users to hide books from their personal library." If you upgrade and don't see the hide button anywhere, that's why — your admin can flip it on.

Recovery defense-in-depth: if an admin disables the feature after users have hidden books, those users can still see their Hidden Books link on /me and still unhide books from the detail page. The admin opt-out only suppresses NEW hides.

Thanks @SethMilliken for the original report (with the explicit fix asks) and @droM4X for the post-v4.0.136 verification testing that surfaced the bug list.

Verification

38 source-pin regression tests pin the eight action-route callsites, the config column + migration, the admin form, the template gate, the JS handler, the route-level gate, and the recovery defense-in-depth. Live verified end-to-end with Playwright in a cwn-local container — flag on/off, hide click, /me + /hidden/stored, action icons, defense-in-depth recovery, direct-POST bypass returns 403. Hungarian + German translations for the new admin strings.

Greptile P2 catch on change_profile() (validation-error re-render lost the recovery link) addressed in the same shipment.

Diff: v4.0.139...v4.0.140