Uploading an image with API v. 4 not working.
There is no preview and no perms for other users in the channel other than admins.
Steps to reproduce
Version: 4.6.0
Snipit of Code: https://pastebin.com/p0nmizb3
1: Upload image via api
2: Bind a post to the image via api
3: Look at it
Expected behavior
It should let me download on any account that is in the channel I put it in and have a preview as normal.
Observed behavior
{"id":"api.context.permissions.app_error","message":"You do not have the appropriate permissions","detailed_error":"","request_id":"mrdmgqk6ejbc5dhjra9c7icy9e","status_code":403}
This line is in the log: [2018/02/09 00:01:32 CST] [EROR] /api/v4/files/nbur81htzbnedqak3wfqjfqueh:Permissions code=403 rid=mrdmgqk6ejbc5dhjra9c7icy9e uid=pfc5hne4pfdnudz97bpnz1f31r ip=::1 You do not have the appropriate permissions [details: userId=pfc5hne4pfdnudz97bpnz1f31r, permission=read_channel]
There is no preview no matter what accout
You can download it on an admin accout
You can download it on the account it was uploaded though
You can’t download it on any other account
The image is in the right channel folder in the file system(got channel id from api while uploading also checked database)
No preview
Stuff I have tried
Clearing the cache
Restarting mattermost
Setting the post id in the database(and clearing the cache afterward)
Is the post being created before you upload the file? The steps that the web app uses are to
Upload the file
Create the post, including the uploaded file as part of the file_ids field of the post
Are you sure that the file is being uploaded for the same team and channel as the post appears in? I see that the file has a channel ID of wtmhorhhfjyppespk6qidexjzh and no team ID, so does that match the post?
Yes, the post is being created before I upload the file. We are looking to switch from rocket.chat to mattermost so a make a program that reads the data from mongo, and imports everything but the files via the bulk loading command.
This error happens in all channels I have tried. In this case it was in a dm, same channel id. Here is the row if that helps at all. https://pastebin.com/3cKycYVB
I don’t think we’ve ever tested uploading files after a post is made, but it should work in theory, and everything looks write with the Post and FileInfo objects. Maybe check to see if there’s a row in the ChannelMembers table with the user_id of the user you’re trying to view the file with and channel_id = 'wtmhorhhfjyppespk6qidexjzh', and see what the roles field for that row is?
The error message would indicate that the user doesn’t even have the ability to read the channel (code here) which would only reasonably happen if they weren’t in the channel to begin with
While getting the post id again, I noticed that all of a sudden the file works, I did some tests to see what worked to fix it here is what I found out.
In the fileinfo part of the database doesn’t have PostId after the post is updated.
So the workaround is to set the PostId manually(of course this would be a bad idea in a production server).
After that I can download the file from the api.
To fix the preview I do have to log out clear my browser cache then log back in but that is partly expected.
This work around I have tested on 3 files/posts. I assume there is a missing query to set the PostId when the file is updated.
I think similar logic should work there, but I don’t know how well the UI and caching code would handle files being added to a post after it’s created since we’ve never tried that ourselves. If you’ve got the environment set up to build Mattermost, you could give it a shot though. We’d definitely be open to a PR that added this since I imagine you’re not the first to try migrating to Mattermost this way
Due to some other reasons with mattermost my group has decided against using mattermost. Here is the patched I ended up making. If anyone wants to use it feel free. From the testing I’ve done it works fine. https://pastebin.com/CTByjTeS
We’re always open to hearing why people make the decisions they do regarding use of Mattermost and we’d really appreciate hearing from you about why your team decided against our product.
Would you be open to joining our nightly build server to share the feedback in the ~product-management channel?
