Uploading an image with api v. 4 not working


#1

Summary

Uploading an image with API v. 4 not working.
There is no preview and no perms for other users in the channel other than admins.

Steps to reproduce

Version: 4.6.0
Snipit of Code: https://pastebin.com/p0nmizb3
1: Upload image via api
2: Bind a post to the image via api
3: Look at it

Expected behavior

It should let me download on any account that is in the channel I put it in and have a preview as normal.

Observed behavior

{"id":"api.context.permissions.app_error","message":"You do not have the appropriate permissions","detailed_error":"","request_id":"mrdmgqk6ejbc5dhjra9c7icy9e","status_code":403}

This line is in the log: [2018/02/09 00:01:32 CST] [EROR] /api/v4/files/nbur81htzbnedqak3wfqjfqueh:Permissions code=403 rid=mrdmgqk6ejbc5dhjra9c7icy9e uid=pfc5hne4pfdnudz97bpnz1f31r ip=::1 You do not have the appropriate permissions [details: userId=pfc5hne4pfdnudz97bpnz1f31r, permission=read_channel]

  • There is no preview no matter what accout
  • You can download it on an admin accout
  • You can download it on the account it was uploaded though
  • You can’t download it on any other account
  • The image is in the right channel folder in the file system(got channel id from api while uploading also checked database)

No preview

Stuff I have tried

  • Clearing the cache
  • Restarting mattermost
  • Setting the post id in the database(and clearing the cache afterward)

The row for the file in FileInfo: https://pastebin.com/KkdQzrRK


#2

Linking to the conversation on our nightly build server so we don’t duplicate responses…


#3

Hi @ParkerMc,

I have a couple questions:

  1. Is the post being created before you upload the file? The steps that the web app uses are to
    1. Upload the file
    2. Create the post, including the uploaded file as part of the file_ids field of the post
  2. Are you sure that the file is being uploaded for the same team and channel as the post appears in? I see that the file has a channel ID of wtmhorhhfjyppespk6qidexjzh and no team ID, so does that match the post?

#4

@hmhealey,

  1. Yes, the post is being created before I upload the file. We are looking to switch from rocket.chat to mattermost so a make a program that reads the data from mongo, and imports everything but the files via the bulk loading command.

  2. This error happens in all channels I have tried. In this case it was in a dm, same channel id. Here is the row if that helps at all. https://pastebin.com/3cKycYVB

Thanks!


#5

I don’t think we’ve ever tested uploading files after a post is made, but it should work in theory, and everything looks write with the Post and FileInfo objects. Maybe check to see if there’s a row in the ChannelMembers table with the user_id of the user you’re trying to view the file with and channel_id = 'wtmhorhhfjyppespk6qidexjzh', and see what the roles field for that row is?

The error message would indicate that the user doesn’t even have the ability to read the channel (code here) which would only reasonably happen if they weren’t in the channel to begin with


#7

While getting the post id again, I noticed that all of a sudden the file works, I did some tests to see what worked to fix it here is what I found out.

In the fileinfo part of the database doesn’t have PostId after the post is updated.
So the workaround is to set the PostId manually(of course this would be a bad idea in a production server).

After that I can download the file from the api.
To fix the preview I do have to log out clear my browser cache then log back in but that is partly expected.
This work around I have tested on 3 files/posts. I assume there is a missing query to set the PostId when the file is updated.


#8

Yep, I think this code https://github.com/mattermost/mattermost-server/blob/master/app/post.go#L182-L195
Should also be here https://github.com/mattermost/mattermost-server/blob/07fd7aeeb8eb2b198b01b713a4ab57f6352faef2/app/post.go#L404

I haven’t worked much with go so that may not be the real fix.


#9

I think similar logic should work there, but I don’t know how well the UI and caching code would handle files being added to a post after it’s created since we’ve never tried that ourselves. If you’ve got the environment set up to build Mattermost, you could give it a shot though. We’d definitely be open to a PR that added this since I imagine you’re not the first to try migrating to Mattermost this way


#10

I’ll have to test it soon. My computer hard drive got corrupted on Wednesday so I’ll have to reinstall everything before I can test it.