Document how to delete images (pict-rs) #293
Description
We should document how user-uploaded images can be deleted from lemmy (by instance admins)
Problem
It has been mentioned that it's possible to do this via the API, but [a] there's a bug in lemmy that prevents DELETE queries from being sent to pict-rs and [b] a user would first need to get the image's delete_token, which doesn't appear to be possible unless they were logging the server's responses to the background ajax upload POST to /pictrs/image.
As users cannot delete images that they've uploaded, admins will need to do it on user's behalf.
Unfortunately, I recently uploaded a very sensitive image to lemmy and--when I reached out to the lemmy admin--they didn't know how to delete the image. And, of course, it's not documented anywhere how they can do it.
This lack-of-documentation is a legal risk to lemmy instane admins.
Legally, instance admins must respond to "GDPR Erasure Requests" from their users. That is, if a user sends them a request to delete some content (eg a photo), then they must delete it from their website within a reasonable timeframe. This law applies to any website operating anywhere in the world (not just to websites or businesses located in the EU) that has users who are residents of the EU (so it likely affects >90% of public lemmy instances with >100 active users).
The fines for this violation are commonly millions of euros or a percent of of revenue, whichever is higher.
Solution
A new section should be added to the documentation's moderation section that clearly explains to admins how they can delete an image
The documentation should:
- provide the commands to query the postgres DB (to fetch the image's
delete_tokenfor a given image URL) - provide the command to execute the image deletion API call