Lost access to all my images

[JanZeman]

Hello,

I have ran 2 wiki.js instances hosting (maybe unfortunately) on the same server without any problems for the last 2 years.

After the summer break I realized both of the wikis stopped to render all the uploaded images. I basically use those wikis as a single user who is the admin and belongs to the Administrators group. I do not remember playing around with the permissions recently and surely not on both wikis.

I have already spent few hours on it but without any success. I installed brand new wiki to have a comparison. There I upload an image, go to the page source, copy its URL (sits in the root), paste it to new browser tab and it displays. If I do the same with an image on the broken wiki I will get back "Forbidden". The same if I put that URL into Postman.

It happens even with newly uploaded images! The system let's me to upload a new image, inject it to the page but then it always renders broken image symbol instead of the image itself.

I do not understand the root cause. One of my theories is that my server provider changed the (virtual) machine and something happened with the permissions. But that is only a theory.

Where are the images actually uploaded? I did not find them on the disk. Are they in the database? I did checked the wiki.js permissions but that is probably useless as my user is admin who should have access to everything by default.

In the worse case I manually migrate to the new instance but without understanding the root cause I am worried this happens again in the future.

Out of the ideas by now...

Best regards
Jan

[JanZeman]

As so many times before it seems I (partially) solved the problem 15 minutes after posting the question here :)

Short summary of what helped to solve the problem if somebody experience anything similar:

1. Understanding that assets folder structure has its own implementation that can differ from pages structure. Permissions though apply for both of them.
2. I enabled read:assets on / - i.e. on all my assets. That makes completely sense, however what I still find illogical or mystery is that I enabled it on the Guests group whereas my user is an Admin.
3. After I upgraded to 2.5.287 and reverted the point 2 it still worked. Based on the info below the upgrade should not play any role. I however restarted the server application several times and disabled caches already during the point 2. I cannot explain completely what made the problem not to be reproducible.

Longer 'investigation' text:
Actually... on one of the instances I finally see the images! I enabled read:assets which sounds very logical BUT I enabled it on Guests group! And as said before the only user I normally login and browse the wiki is the admin user. I do not understand... How could it be that rules set up for the Guests can have any influence on Administrators group???

The other wiki has bit more advanced permissions setup so page rules had to be changed but again... I had and have page rules only for Guests.

If anybody can explain the above please do!

Note: I found elsewhere the confirmation that the images (assets) are stored in the database, not directly on the disk (with the exception of their cached form).

Update: After I upgraded wiki to 2.5.287 version this problem does not reproduce anymore. Can it be this has been fixed relatively recently, @NGPixel ? I do not remember the exact previous version but it was from January 2022, now we have September 2022.

By now I also understand that assets follow their own naming. For the sake of simplicity I will sync my pages and assets structure, i.e. images for /internal/xyz page I will upload into newly created /internal asset folder. Would not it make sense that these are synced by default? I do not find the current state very intuitive, it took me a while to discover this...

[NGPixel]

Your token could have expired when loading the page? Did you try to logout and log back in to see if the problem was still happening? Nothing was changed in 2.5.287 that would affect this.

[JanZeman]

No, I haven't. Now I did based on your tip but I still can see all my images. Despite the fact I disabled ALL permissions for Guests and also ALL page rules for Guests. With my admin account I logged out and in and now I can see it all. I am 100% sure this was not possible couple of hours ago when I wrote the first comment.

[NGPixel]

Do you have a reverse-proxy in front of your wiki? (nginx, cloudflare, etc.) that could cache the response?

[JanZeman]

I am afraid you talk to web amateur... I had to read a short article to understand the difference between forward and reverse proxy. When testing via Postman I noticed nginx header entry so nginx is quite probably there. Also 5 hours ago one of the first things I did I disabled Varnish as I noticed when installing completely new test instance of wiki.js that the server still returned me the standard php "How to host" page.

All in all I think I am good now. After I understood that the PAGE rules can be applied not only to pages structure but also to assets structure I did number of experiments. In each of them build my theory and expectation how the wiki will behave before testing it. And so far all my guesses were correct. So I will move to my production instances and apply these rules there.

I still cannot explain though what caused the Guests vs Admins confusion. The experiments described above I do with Guests = not logged in users. On my other browser I have the same pages opened being logged in as Admin and there I can see all the images by now. I am however absolutely sure that my break-through was that I did changes for the Guests and those made the images visible for the Admins. This behavior I cannot (for me luckily) reproduce anymore.