This issue has been created
 
 
XWiki Platform / cid:jira-generated-image-avatar-f89c6bc2-1df7-4498-9ec4-df1a0e4537b3 XWIKI-25240 Open

Uploading a file in the attachment picker can select another attachment when both have the same upload second

 
View issue   ยท   Add comment
 

Issue created

 
cid:jira-generated-image-avatar-3056c383-72bc-43b5-b1d9-662e9e0272f2 Vincent Massol created this issue on 10/Oct/26 15:14
 
Summary: Uploading a file in the attachment picker can select another attachment when both have the same upload second
Issue Type: cid:jira-generated-image-avatar-f89c6bc2-1df7-4498-9ec4-df1a0e4537b3 Bug
Affects Versions: 17.10.13, 18.4.6, 18.8.0
Assignee: Unassigned
Components: Attachments, User - User Profile
Created: 10/Oct/26 15:14
Priority: cid:jira-generated-image-static-major-427290b1-f10e-4ffc-8a8d-40278a1d01c2 Major
Reporter: Vincent Massol
Description:

When a file is uploaded through the attachment picker (XWiki.AttachmentSelector, e.g. the avatar picker of the user profile), the field can end up set to another attachment of the page instead of the file that was just uploaded. This happens when the uploaded file and another attachment of the same page have the same upload date at the second level (e.g. two uploads within one second).

Steps to reproduce

  1. Edit your user profile and click the avatar to open the attachment picker.
  2. Upload avatar.png: it becomes the avatar.
  3. Within the same second (easiest with an automated test, e.g. UserProfileIT#changeAvatarImage), open the picker again and upload avatar2.png.

Actual result

The avatar is still avatar.png: the second upload is stored as an attachment but not selected.

Expected result

The avatar is avatar2.png, the file that was just uploaded.

Technical cause

  • The picker submits the upload form with an xredirect to AttachmentSelector?xaction=postUpload. postUpload does not know which file was uploaded: it sorts the target document's attachments by date:desc and saves the first one's name in the field.
  • XWikiAttachment#setDate drops the milliseconds ("for consistency with the database"), so attachments uploaded in the same second have equal dates.
  • The sort is stable and getAttachmentList() is ordered by file name, so on a tie the alphabetically first attachment wins (avatar.png before avatar2.png).

postUpload should select the attachment that was actually uploaded (e.g. pass its file name through the xredirect URL from the picker), and fall back to the newest attachment only when that name is absent.