View Issue Details

WikiRelated ChangesetsJump to Notes
IDProjectCategoryView StatusDate SubmittedLast Update
0037370mantisbtattachmentspublic2026-09-05 13:232026-09-09 19:20
Reporterdregad Assigned Todregad  
PrioritynormalSeverityminorReproducibilityalways
Status resolvedResolutionfixed 
Product Version2.29.0 
Target Version2.29.0Fixed in Version2.29.0 
Summary0037370: Misleading error message when trying to delete non-existing attachment via SOAP API
Description

Unlike the REST API's `DELETE /issues/{id}/files/{file_id}' which includes the Issue Id, the SOAP API's mc_issue_attachment_delete endpoint only expects the attachment's id and does not allow specifying the issue id.

The newly added IssueFileDeleteCommand (0034425) requires both issue_id and file_id; to accomodate this, mc_issue_attachment_delete calls file_get_field() to retrieve the issue id, but does check the return value to ensure that the file actually exists. The Web UI (bug_file_delete.php) does the same thing.

So when the attachment does not exist, false is simply passed on to the Command's issue_id query parameter, and validate() returns a misleading error message: "'issue_id' missing". While this is technically true, it does not help the user figure out what is wrong with their request.

A more meaningful error message should be returned.
l

Additional Information

Checking for the attachment's existence in the caller is one way to fix this, but it would introduce code duplication. It makes more sense to put this check in IssuefileDeleteCommand::validate().

TagsNo tags attached.

Relationships

Relationship GraphDependency Graph
related to 0034425 resolvedvboctor Delete attachment via REST 

Activities

dregad

dregad

2026-09-06 18:08

developer   ~0071415

PR https://github.com/mantisbt/mantisbt/pull/2277

Related Changesets

MantisBT: master b444fefc

2026-09-05 10:28

dregad


Details Diff		 IssuefileDeleteCommand: accept empty issue id

Requiring it makes no sense from SOAP API (mc_issue_attachment_delete()
function) or the Web UI (bug_file_delete.php) contexts, because the
issue id is unknown to the caller, forcing them to retrieve it using
file_get_field().

Problem, file_get_field() returns false when the given id does not
exist, so error handling would be required but that is currently not
implemented, and the command's validate() returns a misleading error
message: "'issue_id' missing".

Refactor validate() method to retrieve issue_id from the file record
when it is not provided or blank, and return a meaningful error message
if not found. If issue_id is given (i.e. from REST API), behavior is u
nchanged.

Adapt mc_issue_attachment_delete() and bug_file_delete.php: remove
unnecessary file_get_field() call and do not pass issue_id to Command.

Fixes 0037370		 Affected Issues
0037370
mod - api/soap/mc_issue_attachment_api.php Diff File
mod - bug_file_delete.php Diff File
mod - core/commands/IssueFileDeleteCommand.php Diff File