{"record":{"id":"76413d723aa1b9ad","repo":"odysseus-dev/odysseus","slug":"not-your-image","errorCode":null,"errorMessage":"Not your image","messagePattern":"Not your image","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"routes/gallery/gallery_routes.py","lineNumber":444,"sourceCode":"            resp = {\"ok\": True, \"filename\": filename, \"id\": img_id}\n            if exif.get(\"exif_error\"):\n                resp[\"exif_warning\"] = exif[\"exif_error\"]\n            return resp\n        finally:\n            db.close()\n\n    # ---- POST /api/gallery/{id}/replace ----\n    @router.post(\"/api/gallery/{image_id}/replace\")\n    async def gallery_replace(request: Request, image_id: str):\n        \"\"\"Replace an existing gallery image file with a new one.\"\"\"\n        user = get_current_user(request)\n        db = SessionLocal()\n        try:\n            img = db.query(GalleryImage).filter(GalleryImage.id == image_id).first()\n            if not img:\n                raise HTTPException(404, \"Image not found\")\n            if not user or img.owner != user:\n                raise HTTPException(403, \"Not your image\")\n\n            form = await request.form()\n            file = form.get(\"image\")\n            if not file or not hasattr(file, 'read'):\n                raise HTTPException(400, \"No image provided\")\n\n            content = await read_upload_limited(file, GALLERY_UPLOAD_MAX_BYTES, \"Gallery replacement\")\n            GALLERY_IMAGE_DIR.mkdir(parents=True, exist_ok=True)\n            img_path = _gallery_image_path(img.filename)\n            img_path.write_bytes(content)\n\n            # Refresh dimensions in case the editor resized the canvas.\n            # updated_at auto-bumps via TimestampMixin's onupdate hook.\n            try:\n                from PIL import Image\n                from io import BytesIO\n                with Image.open(BytesIO(content)) as new_im:\n                    img.width = new_im.width","sourceCodeStart":426,"sourceCodeEnd":462,"githubUrl":"https://github.com/odysseus-dev/odysseus/blob/f9235ebbf13f693a6fd29ce70b097f6ec83705bf/routes/gallery/gallery_routes.py#L426-L462","documentation":"HTTP 403 raised by POST /api/gallery/{image_id}/replace when the authenticated user does not own the target GalleryImage row. The handler compares img.owner (the DB owner column) against the username resolved by get_current_user(request); a missing session user or a mismatched owner both trigger it. It is an authorization guard, not a library error.","triggerScenarios":"POST /api/gallery/{id}/replace where the image id belongs to another user, or where get_current_user returns None/falsy because the session cookie is absent, expired, or the token is invalid.","commonSituations":"Shared or multi-user deployments where image ids are enumerable; logged-out browser tabs with stale cookies; frontend sending the upload to the wrong image id after a gallery refresh; impersonating/renamed user accounts so img.owner no longer matches.","solutions":["Verify the session cookie/token is valid and the user is logged in before initiating the replace.","Confirm the image_id being replaced was returned by a gallery list call for the same user (frontend id drift after refresh).","If the owner column is wrong after an account rename/migration, fix the owner values in the DB.","Treat 403 as terminal for that id: do not retry, prompt the user or reload the gallery."],"exampleFix":"// before\nawait fetch(`/api/gallery/${imageId}/replace`, {method:'POST', body}); // 403 surprises user\n// after\nif (!image.ownerIsCurrentUser) { alert('You can only replace your own uploads'); return; }\nawait fetch(`/api/gallery/${imageId}/replace`, {method:'POST', body});","handlingStrategy":"validation","validationCode":"const canReplace = image && image.owner === currentUser;\nif (!canReplace) throw new Error('Not your image');","typeGuard":"const isOwnedBy = (img, user) => Boolean(img && user && img.owner === user);","tryCatchPattern":"try { await replaceImage(id, fd); } catch (e) { if (e.status === 403) { await refreshSession(); showError('You can only replace your own images'); return; } throw e; }","preventionTips":["Check ownership from the gallery list payload before showing destructive actions","Refresh sessions on long-lived tabs","Never retry a 403 automatically"],"tags":["http","authorization","gallery","upload"],"backgroundTag":null,"analyzedSha":"f9235ebbf13f693a6fd29ce70b097f6ec83705bf","analyzedAt":"2026-08-14T21:47:48.359Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}