CODEWITHSUNDEEP
gitlab
moorepants
moorepants

Reputation: 1869

How can I completely delete a file that was uploaded to Gitlab in an issue comment?

Someone uploaded (attached) a file in a Gitlab issue comment. They did not mean to share that file publicly. I can delete the comment, but the file is still available via the original direct url. The file is at:

https://gitlab.com/<username>/<repo>/uploads/<hash>/<filename>

Is there any way to completely remove files from this uploads directory?

Upvotes: 13

Views: 7211

Answers (2)

Tatjana Heuser
Tatjana Heuser

Reputation: 1019

Short version: There's server-side Uploads administration | GitLab, but little to nothing else. Update: Please refer to GitJiggyWithIt's answer if you're comfortable using the API and GraphQL - it's a working solution if you still hold the URL to the file you want deleted. (If you removed the reference, the editing history may help).

TLDR:

For the owner of a repository, there seems to be no way to get hold of these uploads directly, there even doesn't seem to be a way to list all uploads pertaning to a specific repository (or user/owner), let alone modify them.

use-cases where this would be desirable:

  • deletion of data that should not be exposed but has been erroneously.
  • down-scaling of oversized files (images, pdfs, etc)
  • replacing files with updated versions
  • deleting space-hogs that are no longer needed.
  • deleting files that got uploaded accidentally by trigger-happy mice or when the result of a previous upload didn't show in time for the impatient user.

Making these files changeable would cause several issues rooted in their current/previous immutable status: Users aware of this status will frequently re-use the url to an already uploaded file for perusal in other issues, or the associated wiki (even across projects) to avoid duplication. Afaik, there is no such thing as a link-count for upload items, so deleting an item might result in orphaned references, and changing an uploaded file might render other references out-of-context.

It would solve the serious issue of leaked information, though. The only way I have found so far to remove a file would be to send a prayer to the administrator of the gitlab server, and ask him/her to take care of the uploads directory on the server, as described in Uploads administration | GitLab

Upvotes: 4

GitJiggyWithIt
GitJiggyWithIt

Reputation: 86

I raised a case with GitLab support and they were able to provide a solution for this. Using GraphQL, you can delete any uploaded files you have access to.

Navigate to GitLab's GraphQL explorer: https://gitlab.com/-/graphql-explorer
Use this query to delete your file:

mutation{
  uploadDelete(input: { projectPath: "YOUR_PROJECT_PATH", secret: "YOUR_SECRET_HASH_KEY" , filename: "FILE_NAME" }) { 
    upload {
      id
      size
      path 
    }
    errors
  }
}

Example:
If your uploaded file path is https://gitlab.com/s_shaik/ci256986/uploads/abefe4f256e91ffc212c40605ae91ab3/ci.yml
Then
projectPath: "s_shaik/ci256986"
secret: "abefe4f256e91ffc212c40605ae91ab3"
filename: "ci.yml"

On success you will receive a response like this:

{
  "data": {
    "uploadDelete": {
      "upload": {
        "id": "gid://gitlab/Upload/<id>",
        "size": <file_size>,
        "path": "@hashed/some/path/to/file"
      },
      "errors": []
    }
  }
}

Upvotes: 7

Related Questions