The bug
As mentioned in the title, non-op players can run op commands from signs (using "run_command" "clickEvent", MC-59653), but not from written books (also using the "run_command" "clickEvent" mechanic). If that's not a bug, it's definitely inconsistent.
How to reproduce
Create a new world with cheats disabled
Open the world to LAN with cheats enabled
Give yourself a written book with a "run_command" clickEvent:
/give @s written_book[written_book_content={title:"MC-201807",author:"Author",pages:['{"text":"Test","clickEvent":{"action":"run_command","value":"/give @s stone"}}']}] 1Close and reopen the world
Open the book and click on the word "Test"
→ ❌ The command fails (you are not given a block of stone)Open the world to LAN again with cheats enabled
Open the book and click on the word "Test"
→ ✔ The command runs successfully (you are given a block of stone)
Linked issues
relates to 2
Comments 4
I'm not sure if this should be fixed.
Hackers might exploit it.
Using "/trigger" as a click event will work better since it doesn't need operator permission and you can control what it will run by executing the command for the player who ran it and then resetting it back to 0.
A bit more work but it's way more secure.
It could be a security issue if the hacker can change the book or something like this. Anyways, that's a whole other topic and I'm not sure how secure or not this is. Nevertheless, it is definitely inconsistent with what the signs do and I think they should all work the same way, whatever this way is.
No, that's not a duplicate of those bugs. As a matter of fact, I checked them before reporting and could not reproduce them in 1.16.3. Also, they use different JSON tags ("selector" and "score").