Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Removing a card attachment silently fails: frontend calls a non-existent OCS route (Deck 1.18.3)

Abierto
  • ¿Algo no está bien?
#8,278 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
75/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
javascript, php
Área
api, backend, frontend

Línea de trabajo

Empieza por src/services/AttachmentApi.js, appinfo/routes.php y lib/Controller/AttachmentOcsController.php; después reproduce la solicitud DELETE de un adjunto de tarjeta. Comprueba las rutas y los parámetros de delete, restore y update frente a los endpoints registrados, y verifica que la ruta de fallo sea visible para el usuario. Se considera terminado cuando la eliminación de adjuntos funciona y los fallos de las solicitudes ya no desaparecen silenciosamente.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Describe the bug
Removing an attachment from a card does nothing. The action menu stays open, the attachment stays in the list, and no error is shown to the user.
The reason is a mismatch between the OCS route the frontend calls and the route the backend registers.

What the frontend sends (Chrome DevTools, Network tab):

DELETE /ocs/v2.php/apps/deck/api/v1.0/cards/138/attachment/file:1117?boardId=15
Result: 404 Not Found

What the backend registers (appinfo/routes.php, v1.18.3, line 165):
['name' => 'attachment_ocs#delete', 'url' => '/api/v{apiVersion}/cards/{cardId}/attachments/{attachmentId}', 'verb' => 'DELETE'],

Two separate problems:
1. Path: the frontend uses /attachment/ (singular), the route is /attachments/ (plural).
2. Parameters: AttachmentOcsController::delete() expects a numeric attachmentId and a separate type query parameter, but the frontend passes the composite value file:1117 in the path segment.

// lib/Controller/AttachmentOcsController.php, v1.18.3
public function delete(int $cardId, int $attachmentId, string $type = 'file', ?int $boardId = null): DataResponse

The offending frontend code (src/services/AttachmentApi.js, v1.18.3):

async deleteAttachment(attachment, boardId) {
    await axios({
        method: 'DELETE',
        url: this.ocsUrl(`/cards/${attachment.cardId}/attachment/${attachment.type}:${attachment.id}`),
        params: {
            boardId: boardId ?? null,
        },
    })
}

I verified both problems on a live instance by patching the shipped bundle:
• DELETE .../cards/165/attachment/file:1126?boardId=17 -- 404, as shipped.
• DELETE .../cards/165/attachments/file:1126?boardId=17 -- 403. The route matches, but (int) "file:1126" becomes 0, so the permission check runs against a non-existent attachment.
• DELETE .../cards/165/attachments/1126?type=file&boardId=17 -- 200, works.

Steps to reproduce
1. Open any card and switch to the Attachments tab.
2. Upload a file, or attach an existing one from Files.
3. Open the ... menu next to the attachment and click "Remove attachment".

Expected behaviour
The attachment is removed from the card. If the request fails, the user sees an error message.

Actual behaviour
Nothing happens. The menu stays open, the attachment remains, and no error is shown. The failure is only visible in the browser's network tab as a 404.

Additional notes
• restoreAttachment() looks affected as well. It sends GET .../cards/{cardId}/attachment/{type}:{id}/restore, while the route is PUT .../cards/{cardId}/attachments/{attachmentId}/restore -- wrong path and wrong verb. I did not test this.
• updateAttachment() builds the same singular path and may have the same problem.
• main looks only partly fixed. AttachmentApi.js on main now uses /attachments/ (plural), but still passes the composite ${type}:${id} in the path segment rather than a numeric id plus a type parameter. Worth checking whether that path actually resolves.
• No error handling. Even once the route is fixed, a failing request should surface a message instead of failing silently. That is what made this hard to diagnose.
• There is also a console error when opening a card with an attachment, which may or may not be connected:

TypeError: Cannot read properties of undefined (reading 'id')
    at o.currentCard (deck-main.js)

Suggested fix

async deleteAttachment(attachment, boardId) {
    await axios({
        method: 'DELETE',
        url: this.ocsUrl(`/cards/${attachment.cardId}/attachments/${attachment.id}`),
        params: {
            type: attachment.type,
            boardId: boardId ?? null,
        },
    })
}

Server configuration
• Nextcloud version: 34.0.3
• Deck version: 1.18.3
• Operating system: Ubuntu 24.04.4 LTS
• Web server: Apache behind Plesk, PHP-FPM
• PHP version: 8.3
• Database: MariaDB 10.11.14

Client configuration
• Browser: Google Chrome
• Operating system: Windows

Reproduced on three independent instances, all running Nextcloud 34 with Deck 1.18.3.

Lenguaje dominante
JavaScript
Estrellas
1.4k
Forks
358
Merge medio
2 d 18 h
PR fusionados (30 d)
83

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de nextcloud/deck

Todos los issues de nextcloud/deck

Issues similares

Más issues de JavaScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.