Repository navigation
[Bug]: Users unable to delete their images (pictrs API) #4441
Description
Requirements
- Is this a bug report? For questions or discussions use https://lemmy.ml/c/lemmy_support
- Did you check to see if this issue already exists?
- Is this only a single bug? Do not put multiple bugs in one issue.
- Is this a backend issue? Use the lemmy-ui repo for UI / frontend issues.
Summary
Bug: Given a pictrs alias (fileaname) and a delete_token, users cannot delete image that they've uploaded to lemmy.
Problem
It has been mentioned that it's possible to do this via the API, but--due to this bug--that's actually not true.
Example
For example, let's consider the following image that I've uploaded to lemmy.ml (following the Steps to Reproduce below)
When my browser uploaded the file, I got the following JSON response
{
"msg":"ok",
"files":[
{
"file":"d99cf141-f03b-4c82-8c66-09db8eaba1fb.png",
"delete_token":"6030a3b8-5066-439c-8880-35438eda4403"
}
]
}
I attempt to delete it at the /image/delete endpoint per the pict-rs reference documentation, but I get a 404 error
user@disp9140:~/lemmy$ curl -iX DELETE "https://lemmy.ml/image/delete/6ac4d09b-e812-460e-8088-4a7c8410d7c8/5dc960cb-fb6b-4f2f-a756-8c651ded184b.png"
HTTP/2 404
server: nginx
date: Thu, 08 Feb 2024 23:54:50 GMT
content-length: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
cache-control: public, max-age=60
user@disp9140:~/lemmy$
Just in-case lemmy puts this at a subdir endpoint for proxying between multiple services (since this isn't documented anywhere), I also tried the pictrs/image/delete endpoint, but I get a 405 error
user@disp9140:~/lemmy$ curl -iX DELETE "https://lemmy.ml/pictrs/image/delete/6ac4d09b-e812-460e-8088-4a7c8410d7c8/5dc960cb-fb6b-4f2f-a756-8c651ded184b.png"
HTTP/2 405
server: nginx
date: Thu, 08 Feb 2024 23:56:12 GMT
content-length: 0
cache-control: public, max-age=60
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: allow
allow: GET
user@disp9140:~/lemmy$
Steps to Reproduce
- Log into your lemmy account in firefox
- Click
Create Postat the top (to visit/create_post) - Open the browsers (javascript) debug console (eg press
F12on linux) - Click the
Networktab of the debug console - Click the
Browsebutton on the webpage next to theImagelabel - Choose some image on your computer and click
Opento upload it to the lemmy server'spictrsservice - Wait a few seconds for the upload to complete
- In the browser's debug console, click on the
POSTrequest sent topictrs/image - In the browser's debug console, click the
Responsetab - Click the
Rawtoggle - Copy the raw JSON response
- Extract the
fileanddelete_tokenvalues from the JSON - Attempt to delete the image using curl and the
image/delete/<delete_token>/<file>endpoint, get 404 error from server - Attempt to delete the image using curl and the
pictrs/image/delete/<delete_token>/<file>endpoint, get 405 error from server
Technical Details
tested on lemmy.ml running v0.19.3
Version
0.19.3
Lemmy Instance URL
lemmy.ml
Activity
Nutomic commentedon Feb 9, 2024
The request should look like
GET https://lemmy.ml/pictrs/image/delete/3d47ffc0-8dc2-440d-aa28-0ac9047c035d/e9e9e35c-6a49-4016-bb6b-ae299ce0d784.png. Not sure why its get...https://github.com/LemmyNet/lemmy/blob/main/crates/routes/src/images.rs#L43
maltfield commentedon Feb 9, 2024
Thanks, I tried GET this but now I get a 401 error
Perhaps the reason for this bug is that your lemmy installs are blocking DELETE requests? The server's response includes a header
allow: GETthat makes me think this.Is nginx or some other component configured to restrict request types?
maltfield commentedon Feb 10, 2024
@Nutomic is there any way for a non-admin lemmy user to get the
delete_tokenfor a given image out of pict-rs after they've uploaded it? Or is it only possible if they monitored the initial upload POST to/pictrs/imageNutomic commentedon Feb 12, 2024
You can upload an image on lemmy-ui, then delete it and monitor via browser developer tools the exact request it makes. As this works without any issues I dont think there is any bug here. Though it might be worth changing the method to DELETE as part of #4428.
The delete token is only returned when you upload the image.
maltfield commentedon Feb 12, 2024
I don't think it's reasonable to say that users can currently delete their images, if they can't fetch the delete token. But I'll consider this new ticket to be a replacement that addresses this bug.
dessalines commentedon Feb 12, 2024
Just a note that it'll probably be a while till I can work on that, so if someone else could handle that'd be appreciated.
maltfield commentedon Mar 4, 2024
richardARPANET commentedon Apr 19, 2025
Workaround I used: