From a8fd2d815c2da7089e740bd35caf7739f8e59fa8 Mon Sep 17 00:00:00 2001 From: aquananu Date: Thu, 5 Nov 2026 21:02:49 +0530 Subject: [PATCH] fix(api): fix HTTP 405 Method Not Allowed when deleting card attachments via OCS API In appinfo/routes.php, attachment_ocs#update was registered before attachment_ocs#delete without regex restrictions on {attachmentId}. Because {attachmentId} defaults to [^/]+, it greedily matched {type}:{attachmentId} (such as 'file:92921') and rejected DELETE requests with HTTP 405 Method Not Allowed before attachment_ocs#delete could be evaluated. This moves attachment_ocs#delete before update and adds strict regex requirements for {type} and {attachmentId}. Signed-off-by: aquananu --- appinfo/routes.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/appinfo/routes.php b/appinfo/routes.php index 8a2b9be5fe..581572c1b4 100644 --- a/appinfo/routes.php +++ b/appinfo/routes.php @@ -161,8 +161,8 @@ ['name' => 'attachment_ocs#getAll', 'url' => '/api/v{apiVersion}/cards/{cardId}/attachments', 'verb' => 'GET'], ['name' => 'attachment_ocs#create', 'url' => '/api/v{apiVersion}/cards/{cardId}/attachment', 'verb' => 'POST'], - ['name' => 'attachment_ocs#update', 'url' => '/api/v{apiVersion}/cards/{cardId}/attachments/{attachmentId}', 'verb' => 'PUT'], - ['name' => 'attachment_ocs#delete', 'url' => '/api/v{apiVersion}/cards/{cardId}/attachments/{type}:{attachmentId}', 'verb' => 'DELETE'], + ['name' => 'attachment_ocs#delete', 'url' => '/api/v{apiVersion}/cards/{cardId}/attachments/{type}:{attachmentId}', 'verb' => 'DELETE', 'requirements' => ['type' => '[a-z_]+', 'attachmentId' => '[0-9]+']], + ['name' => 'attachment_ocs#update', 'url' => '/api/v{apiVersion}/cards/{cardId}/attachments/{attachmentId}', 'verb' => 'PUT', 'requirements' => ['attachmentId' => '[0-9]+']], ['name' => 'attachment_ocs#restore', 'url' => '/api/v{apiVersion}/cards/{cardId}/attachments/{attachmentId}/restore', 'verb' => 'PUT'], ['name' => 'Config#get', 'url' => '/api/v{apiVersion}/config', 'verb' => 'GET'],