Lost ALL comments after deleting one comment

[PiHead567]

Describe the Bug

We are in the late setup phase (luckily !!), just 2 users for the moment. We had a bunch of comments existing, because we pushed our tasks between us using comments.
My coleague (having admin rights) deleted one of my comments, with the result that ALL comments are deleted, over all pages. We played around in various scenarios and also with editor rights and found out:

• having admin rights or editor rights does not matter
• bug is reproduceable between two users as well with one user (see below)
• it's not sporadic, 100% bug "success"
• I described 2 comments as scenarios below, but always all existing comments are lost
• it looks like always the same error is logged in laravel.log (see attachment)

Steps to Reproduce

1. create two comments on different pages
2. delete one of the comments, it doesn't matter which one
3. both comments are deleted

Expected Behaviour

the not deleted comment shall be still available

Screenshots or Additional Context

[2023-03-10 20:06:29] production.ERROR: Du hast keine Berechtigung, auf diese Seite zuzugreifen. {"userId":4,"exception":"[object] (BookStack\\Exceptions\\NotifyException(code: 0): Du hast keine Berechtigung, auf diese Seite zuzugreifen. at /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/app/Http/Controllers/Controller.php:57)
[stacktrace]
#0 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/app/Http/Controllers/Controller.php(76): BookStack\\Http\\Controllers\\Controller->showPermissionError()
#1 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/app/Http/Controllers/CommentController.php(74): BookStack\\Http\\Controllers\\Controller->checkOwnablePermission('comment-delete', Object(BookStack\\Actions\\Comment))
#2 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Routing/Controller.php(54): BookStack\\Http\\Controllers\\CommentController->destroy(0)
#3 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Routing/ControllerDispatcher.php(45): Illuminate\\Routing\\Controller->callAction('destroy', Array)
#4 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Routing/Route.php(262): Illuminate\\Routing\\ControllerDispatcher->dispatch(Object(Illuminate\\Routing\\Route), Object(BookStack\\Http\\Controllers\\CommentController), 'destroy')
#5 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Routing/Route.php(205): Illuminate\\Routing\\Route->runController()
#6 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Routing/Router.php(721): Illuminate\\Routing\\Route->run()
#7 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(128): Illuminate\\Routing\\Router->Illuminate\\Routing\\{closure}(Object(BookStack\\Http\\Request))
#8 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/app/Http/Middleware/Authenticate.php(23): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(BookStack\\Http\\Request))
#9 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): BookStack\\Http\\Middleware\\Authenticate->handle(Object(BookStack\\Http\\Request), Object(Closure))
#10 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/app/Http/Middleware/Localization.php(45): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(BookStack\\Http\\Request))
#11 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): BookStack\\Http\\Middleware\\Localization->handle(Object(BookStack\\Http\\Request), Object(Closure))
#12 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/app/Http/Middleware/RunThemeActions.php(26): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(BookStack\\Http\\Request))
#13 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): BookStack\\Http\\Middleware\\RunThemeActions->handle(Object(BookStack\\Http\\Request), Object(Closure))
#14 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/app/Http/Middleware/CheckEmailConfirmed.php(47): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(BookStack\\Http\\Request))
#15 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): BookStack\\Http\\Middleware\\CheckEmailConfirmed->handle(Object(BookStack\\Http\\Request), Object(Closure))
#16 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/app/Http/Middleware/PreventAuthenticatedResponseCaching.php(21): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(BookStack\\Http\\Request))
#17 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): BookStack\\Http\\Middleware\\PreventAuthenticatedResponseCaching->handle(Object(BookStack\\Http\\Request), Object(Closure))
#18 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php(78): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(BookStack\\Http\\Request))
#19 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): Illuminate\\Foundation\\Http\\Middleware\\VerifyCsrfToken->handle(Object(BookStack\\Http\\Request), Object(Closure))
#20 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/View/Middleware/ShareErrorsFromSession.php(49): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(BookStack\\Http\\Request))
#21 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): Illuminate\\View\\Middleware\\ShareErrorsFromSession->handle(Object(BookStack\\Http\\Request), Object(Closure))
#22 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php(121): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(BookStack\\Http\\Request))
#23 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php(64): Illuminate\\Session\\Middleware\\StartSession->handleStatefulRequest(Object(BookStack\\Http\\Request), Object(Illuminate\\Session\\Store), Object(Closure))
#24 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): Illuminate\\Session\\Middleware\\StartSession->handle(Object(BookStack\\Http\\Request), Object(Closure))
#25 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/AddQueuedCookiesToResponse.php(37): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(BookStack\\Http\\Request))
#26 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): Illuminate\\Cookie\\Middleware\\AddQueuedCookiesToResponse->handle(Object(BookStack\\Http\\Request), Object(Closure))
#27 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/EncryptCookies.php(67): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(BookStack\\Http\\Request))
#28 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): Illuminate\\Cookie\\Middleware\\EncryptCookies->handle(Object(BookStack\\Http\\Request), Object(Closure))
#29 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/app/Http/Middleware/ApplyCspRules.php(33): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(BookStack\\Http\\Request))
#30 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): BookStack\\Http\\Middleware\\ApplyCspRules->handle(Object(BookStack\\Http\\Request), Object(Closure))
#31 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(103): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(BookStack\\Http\\Request))
#32 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Routing/Router.php(723): Illuminate\\Pipeline\\Pipeline->then(Object(Closure))
#33 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Routing/Router.php(698): Illuminate\\Routing\\Router->runRouteWithinStack(Object(Illuminate\\Routing\\Route), Object(BookStack\\Http\\Request))
#34 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Routing/Router.php(662): Illuminate\\Routing\\Router->runRoute(Object(BookStack\\Http\\Request), Object(Illuminate\\Routing\\Route))
#35 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Routing/Router.php(651): Illuminate\\Routing\\Router->dispatchToRoute(Object(BookStack\\Http\\Request))
#36 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(167): Illuminate\\Routing\\Router->dispatch(Object(BookStack\\Http\\Request))
#37 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(128): Illuminate\\Foundation\\Http\\Kernel->Illuminate\\Foundation\\Http\\{closure}(Object(BookStack\\Http\\Request))
#38 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Http/Middleware/TrustProxies.php(39): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(BookStack\\Http\\Request))
#39 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/app/Http/Middleware/TrustProxies.php(41): Illuminate\\Http\\Middleware\\TrustProxies->handle(Object(BookStack\\Http\\Request), Object(Closure))
#40 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): BookStack\\Http\\Middleware\\TrustProxies->handle(Object(BookStack\\Http\\Request), Object(Closure))
#41 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php(21): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(BookStack\\Http\\Request))
#42 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TrimStrings.php(40): Illuminate\\Foundation\\Http\\Middleware\\TransformsRequest->handle(Object(BookStack\\Http\\Request), Object(Closure))
#43 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): Illuminate\\Foundation\\Http\\Middleware\\TrimStrings->handle(Object(BookStack\\Http\\Request), Object(Closure))
#44 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/ValidatePostSize.php(27): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(BookStack\\Http\\Request))
#45 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): Illuminate\\Foundation\\Http\\Middleware\\ValidatePostSize->handle(Object(BookStack\\Http\\Request), Object(Closure))
#46 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php(86): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(BookStack\\Http\\Request))
#47 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): Illuminate\\Foundation\\Http\\Middleware\\PreventRequestsDuringMaintenance->handle(Object(BookStack\\Http\\Request), Object(Closure))
#48 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(103): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(BookStack\\Http\\Request))
#49 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(142): Illuminate\\Pipeline\\Pipeline->then(Object(Closure))
#50 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(111): Illuminate\\Foundation\\Http\\Kernel->sendRequestThroughRouter(Object(BookStack\\Http\\Request))
#51 /is/htdocs/wp10625254_0DSY7T8EGK/www/perm-alto/public/index.php(53): Illuminate\\Foundation\\Http\\Kernel->handle(Object(BookStack\\Http\\Request))
#52 {main}
"} 

Browser Details

Firefox Extended Support Release 102.8.0esr (64bit)

Exact BookStack Version

V23.01.1

PHP Version

8.1.14-he.0

Hosting Environment

I have a WebPack at hoster HostEurope. i have SCP access to my document root and SSH console with very limited functionality (no GIT, but PHP available).

• mounted remote Web-Server over SCP as local drive
• git clone executed locally PC, files stored on remote location
• run composer locally, files stored on remote location (I have PHP 8.0.28)
• run php artisan key:generate over SSH on remote
• run php artisan migrate over SSH on remote

Remark: it was not so easy to figure out for me (I'm not a web server expert), but after success in installation I was 2 weeks amazed of BookStack working 100% stable.

[ssddanbrown]

Hi @PiHead567,
I have tested this on my dev environment for both v23.01.1 and v23.02.1, and on our demo instance for v23.02, and I have been unable to reproduce this issue. Nor by looking at the code can I see a way for all the comments to become deleted.
Upon that, the error seen would be thrown before any delete action occurs.

I can only think there are maybe permission scenarios at play, which may be hiding comments from being visible (which would be closer to the error log seen).

Are you able to reproduce this, following your provided steps, on our demo instance?

[PiHead567]

Thank you for your fast reply and taking your time.

1. I tried to reproduce on your demo instance (as you asked): works fine, no bug

2. I tried also to reproduce on my "demo instance". It's a RaspberryPi in my local network, on which I did the first installation to try out. It has the same BookStack version compared to the web server: works fine, no bug

3. you wrote "Upon that, the error seen would be thrown before any delete action occurs.". Maybe helpful additional information. I did:

• create two comments in 1st page
• create one comment in 2nd page
• delete one of the comments in the first page
• after deletion is done and page is refreshed, the page shows the remaining comment
• refresh the page (browser F5): remaining comment disappears, same for 2nd page

4. When the bug happens the first time, and we play around to confirm, it looks like the ERRORs shown in the logfile are related to the bug. In the meanwhile I disagree or have high doubts. I reproduced the bug again and again and did not get any new error in the logfile.

Shall I check database when reproducing the bug (before, in between, after)?
The permissions on the Web server are very restrictive (as they should be), for instance not any permission for all. I checked permissions before reporting yesterday and did not see any issue. Shall I have a try, to open permission for all, just to see if it impacts the bug?

[PiHead567]

I have a new interesting insight.

Background:
Because first of our users shall come into our platform, I decided following counter measure: I disabled the permission for deleting comments for both roles we use (Admin and Editor). I tested being save from unintended comment deletion and found following.

Scenario:

1. remark: not any comment is left over
2. create a new comment in 1st page
3. create another new comment in 2nd page (looks fine, both comments are there with different content)
4. edit comment on 1st page
5. refresh 2nd page: updated comment of 1st page has been moved to 2nd page
6. from now on I can edit each comment and it will always impact the other one. It is like one comment now, which is shown on both pages

Add - On:
8. create another comment on third page (looks fine on this page, the first two comments are still linked)
9. edit the comment on the first page: updated content is now shown in all three comments

I checked the data base. Here a screen shot after step 9:

What I think is highly suspicuos: why is the value of id zero for all three comments?
Isn't id a unique identifier?

[ssddanbrown]

Shall I have a try, to open permission for all, just to see if it impacts the bug?

When I previously mentioned permissions, I was referring only to role/access permissions within BookStack itself. There's been nothing to indicate issues with file/system/web-server permissions so no need to alter those I think.

Isn't id a unique identifier?

Yes, the ID column on the comments table should be a unique primary key column.

I sometimes hear about strange database scenarios when the non-native mysql PHP extension is in use. That's rare (and I thought the alternative is no longer used) but shared host providers like this can often do strange things.
Do you have some control over PHP extensions in the environment?
Check if the mysql_nd extension is active. If you see a nd_pdo_mysql extension and it's inactive, activate that and de-activate pd_mysql. Then give things a test.

[PiHead567]

With phpinfo(INFO_MODULES) over HTML, seeked for pdo in the browser leads to this screenshot:

With SSH console:

Looks good, or not?

[ssddanbrown]

@PiHead567 Yeah, that looks good. Looks like they might have custom-built packages though, makes reproduction a little trickier.

Within the database, if you expand the comments table are you able to see indexes, to see a list of indexes on columns within that table?

[PiHead567]

I hope this helps you:

[PiHead567]

I have now my 3rd installation on my Web server: a fresh clean setup with current version of BookStack (v23.02.1).
After the installation process it works fine. I cannot reproduce the bug.

The mess starts, when I import a backup of my productive data in the data base. Can it be, that I import something which mangles my data base? At the end of our evaluation phase I did a data base transfer from my local box to the productive environment on the web server. My local box is a RaspberryPi with MariaDB, my hoster provides MySQL ....

If it helps, take a look to the data base of my playground. My productive data was imported and I deleted afterwards to a minimum (2 pages, 2 comments). Bug is still reproduceable. I'll send you a BookStack invitation and credentials of the data base account by mail. Feel free to do what you want, it's a playground.

[PiHead567]

I'm having good progress today:
it's now 90% clear, that my data base migration 2 weeks ago from the local system to the web server was buggy and the cause of the reported bug. It took me the whole Sunday to repair it. I disagreed to abandon the data stored over 2 weeks on web server's data base. Looks good now .. for the first view :-)
We will work tomorrow on the repaired system, I'll give a final confirmation afterwards.

[PiHead567]

Here is the final confirmation that our platform works fine and the reported problem is solved.
It was NOT a bookstack bug. I messed-up the structure of the data base tables during data migration.
I like to say thank you to Dan for support and the whole BookStack team for a very well job. BookStack really convinced me the last weeks.

[PiHead567]

If someone has similar troubles and stumbles in this bug report, i like to give some technical details.
My problems had been:

• deleting one comment deletes all comment
• editing one comment transports the updated content to all comments
• deleting one attachment deletes all attachment

I messed this up by using the phpMyAdmin web interface to export my data base:

It exports incomplete table structures, where all key/index definitions are missing (right one, left is good):

Please consider: if you backup like this, then you are lost at a restore !!!!
I really wonder that BookStack works robust on the corrupted table structures and it took us 2 weeks to find the first problem.

[ssddanbrown]

Thanks for reporting back @PiHead567, good to hear you found the core issue.

It is surprising that the default quick export does not include index detail, that's pretty crucial. From a quick search, I see comments mentioning that PHPmyAdmin adds indexes to the end of the export file, which could mean they were at the end but maybe the import was interrupted before it got to them? I'm just guessing though.

I really wonder that BookStack works robust on the corrupted table structures and it took us 2 weeks to find the first problem.

I am surprised you didn't come across more issues across other data types/models. I'd imagine other issues would start to appear.

Since you managed to find and solve the problem, I'll go ahead and close this off.

[PiHead567]

From a quick search, I see comments mentioning that PHPmyAdmin adds indexes to the end of the export file,

You made me curious and I checked:

• yes: tables are altered and keys/indexes are added in the end of the export (I didn't saw this in my comparisons during seeking the root cause)
• BUT: key definitions for some tables are missing (e.g. 'activities' and 'attachments') or not complete (e.g. 'comments')

I din't know why. I rely on mysqldump for the moment ..