A simple Action with Remove file generates error
If I replace the actual values it works, therefore the path is the correct one
As the error says you are trying to remove the whole directory instead of a file.
This is probably because the $_POST variables you use are empty.
But in another project the same setting does not problems
Diversity between two projects:
That working -> PHP / Bootstrap 4
That with error -> docker / nodejs / bootstrap5
Marzio, please check this:
In this other project most probably your POST vars send values on form submit … and not here.
OK Teodor
I Check the situation better by hoping to solve
I would advice to use some extra validation of in the POST data, you have no security provider on the action so everyone could call it and use ../../.. as imagegalleryid and index.js as imagefile and then you whole server will be offline. A simple check if the id and file have a value and check if id is numeric and filename doesn’t contain illegal characters like / in it would prevent users deleting unwanted files. Also with these api’s you also want to protect them with the security provider.
1 Like
Ok Patrick
This is the Delete Files action that works with site in PHP and bootstrap4
`<?php
require(’…/…/…/…/dmxConnectLib/dmxConnect.php’);
$app = new \lib\App();
$app->define(<<<‘JSON’
{
“meta”: {
“options”: {},
“$_POST”: [
{
“type”: “text”,
“name”: “imageID”
},
{
“type”: “text”,
“name”: “imageGallaryID”
},
{
“type”: “text”,
“name”: “imageFile”
}
]
},
“exec”: {
“steps”: [
“Connections/xxx_db”,
{
“name”: “remLargeImage”,
“module”: “fs”,
“action”: “remove”,
“options”: {
“path”: “/galleries/{{$_POST.imageGalleryID}}/{{$_POST.imageFile}}”
},
“outputType”: “boolean”
},
{
“name”: “remThumbs”,
“module”: “fs”,
“action”: “remove”,
“options”: {
“path”: “/galleries/{{$_POST.imageGalleryID}}/thumbs/{{$_POST.imageFile}}”
},
“outputType”: “boolean”
},
{
“name”: “delImage”,
“module”: “dbupdater”,
“action”: “delete”,
“options”: {
“connection”: “xxx_db”,
“sql”: {
“type”: “delete”,
“table”: “images”,
“wheres”: {
“condition”: “AND”,
“rules”: [
{
“id”: “imageID”,
“type”: “double”,
“operator”: “equal”,
“value”: “{{$_POST.imageID}}”,
“data”: {
“column”: “imageID”
},
“operation”: “=”
}
]
},
“query”: “DELETE\nFROM images\nWHERE imageID = :P1 /* {{$_POST.imageID}} */”,
“params”: [
{
“operator”: “equal”,
“type”: “expression”,
“name”: “:P1”,
“value”: “{{$_POST.imageID}}”
}
]
}
},
“meta”: [
{
“name”: “affected”,
“type”: “number”
}
]
}
]
}
}
JSON
);
?>`
This is the delete files action that does not work with site in docker / nodejs / bootstrap5
This error has always been
{ "meta": { "$_POST": [ { "type": "text", "name": "imageID" }, { "type": "text", "name": "imageGalleryID" }, { "type": "text", "name": "imageFile" } ] }, "exec": { "steps": [ { "name": "remLargeImage", "module": "fs", "action": "remove", "options": { "path": "/public/upload/galleries/{{$_POST.imageGalleryID}}/{{$_POST.imageFile}}" }, "outputType": "boolean" }, { "name": "fileRemoveThumbs", "module": "fs", "action": "remove", "options": { "path": "/public/upload/galleries/{{$_POST.imageGalleryID}}/thumbs/{{$_POST.imageFile}}" }, "outputType": "boolean" }, { "name": "delImage", "module": "dbupdater", "action": "delete", "options": { "connection": "db_conn", "sql": { "type": "delete", "table": "images", "query": "DELETE\nFROM images\nWHERE imageID = :P1 /* {{$_POST.imageID}} */", "params": [ { "operator": "equal", "type": "expression", "name": ":P1", "value": "{{$_POST.imageID}}" } ], "wheres": { "condition": "AND", "rules": [ { "id": "imageID", "type": "double", "operator": "equal", "value": "{{$_POST.imageID}}", "data": { "column": "imageID" }, "operation": "=" } ] } } }, "meta": [ { "name": "affected", "type": "number" } ], "output": true } ] } }
Marzio, bothe above scripts you are showing are fully reliant upon what is being sent into $_POST.imageGalleryID and $_POST.imageFile
Your error says /opt/node_app/public/upload/galleries and then just stops, which in my thinking means it has no clue what the value of $_POST.imageGalleryID and $_POST.imageFile are, otherwise, even if it knew one of them it would have it written in its error path.
My question is, how are you passing values into those $_POST variables.
Do you have a form on your client side page with a submit button attached to a server action, do you have a client side button with an onclick, i mean it just makes no sense to me.
Uploading a new image with $_POST and a form set to POST, and a File Input, and a submit button sending the form data makes perfect sense for a file upload.
For file deleting, I cant think why its $_POST, I would imagine more commonly a $_GET where an onclick event sends the 2 $_GET parameters to the server action.
I know I ask to see you client side code all the time, but honestly, you server side action seems alright, as you say you can manually enter an absolute URL and it works, so we know its fine, but those variables are clearly not sending the values you think they are.
Once again with something like this Open In Browser is not going to work, it has to get those variable values from somewhere.
Finally I solved all the problems with creating a database user with different name from “root”