[Bug]: Inconsistent / Unexpected behaviour when adding attachments to cards via REST API #821

New Issue

OVERLORD · 2026-02-04T21:25:03+03:00

OVERLORD commented

2026-02-04 21:25:03 +03:00

Originally created by @tomaslieffering on GitHub (Sep 24, 2025).

Where is the problem occurring?

I encountered the problem while interacting with the server (Backend)

What browsers are you seeing the problem on?

No response

Current behavior

Certain orderings of the multipart form parameters in the request body of a POST request to the /api/cards/{cardId}/attachments endpoint results in inconsistent and unexpected behaviour.

When trying to attach a file greater than 64kb, if the name parameter comes after the file parameter eg. in Bruno:

The following validation error is returned:

{
  "code": "E_MISSING_OR_INVALID_PARAMS",
  "problems": [
    "\"name\" is required, but it was not defined."
  ],
  "message": "The server could not fulfill this request (`POST /api/cards/1605938424743724421/attachments`) due to 1 missing or invalid parameter."
}

even though the request is valid.

Swapping the file parameter to be after the name parameter fixes the issue eg. in Bruno:

the request is successful

I initially came across this issue from PHP using Guzzle and have also replicated the error using cURL from the CLI so isn't an issue unique to Bruno

Desired behavior

The request is successful no matter the order of the multipart form request.

If this is not possible, that the significance of the order of the multipart form request is documented somewhere, such as the Swagger docs.

Steps to reproduce

The following cURL request reproduced the error:

curl --request POST \
  --url {plankaBaseUrl}/api/cards/{cardId}/attachments \
  --header 'authorization: Bearer {token}' \
  --header 'content-type: multipart/form-data' \
  --form type=file \
  --form 'file=@{path\to\local\file}\test.csv' \
  --form name=test.csv

where plankaBaseUrl, token, cardId and path\to\local\file are their respective values and test.csv is a file which is > 64kB

Other information

No response

Originally created by @tomaslieffering on GitHub (Sep 24, 2025). ### Where is the problem occurring? I encountered the problem while interacting with the server (Backend) ### What browsers are you seeing the problem on? _No response_ ### Current behavior Certain orderings of the multipart form parameters in the request body of a POST request to the `/api/cards/{cardId}/attachments` endpoint results in inconsistent and unexpected behaviour. When trying to attach a file _greater_ than **64kb**, if the `name` parameter comes _after_ the `file` parameter eg. in Bruno: <img width="743" height="238" alt="Image" src="https://github.com/user-attachments/assets/8f6852fd-220e-4f96-a664-42d8bdca43da" /> The following validation error is returned: ``` json { "code": "E_MISSING_OR_INVALID_PARAMS", "problems": [ "\"name\" is required, but it was not defined." ], "message": "The server could not fulfill this request (`POST /api/cards/1605938424743724421/attachments`) due to 1 missing or invalid parameter." } ``` even though the request is valid. Swapping the `file` parameter to be after the `name` parameter fixes the issue eg. in Bruno: <img width="743" height="237" alt="Image" src="https://github.com/user-attachments/assets/9c1c96cf-d296-4189-9c75-70521b7968fb" /> the request is successful I initially came across this issue from PHP using Guzzle and have also replicated the error using cURL from the CLI so isn't an issue unique to Bruno ### Desired behavior The request is successful no matter the order of the multipart form request. If this is not possible, that the significance of the order of the multipart form request is documented somewhere, such as the Swagger docs. ### Steps to reproduce The following cURL request reproduced the error: ``` bash curl --request POST \ --url {plankaBaseUrl}/api/cards/{cardId}/attachments \ --header 'authorization: Bearer {token}' \ --header 'content-type: multipart/form-data' \ --form type=file \ --form 'file=@{path\to\local\file}\test.csv' \ --form name=test.csv ``` where `plankaBaseUrl`, `token`, `cardId` and `path\to\local\file` are their respective values and `test.csv` is a file which is > 64kB ### Other information _No response_

OVERLORD commented

2026-02-04 21:25:09 +03:00

@meltyshev commented on GitHub (Sep 24, 2025):

Hey! Thanks for reporting this. This happens because file uploads are handled by sailshq/skipper, and that's just the way it processes text parameters: https://github.com/sailshq/skipper?tab=readme-ov-file#text-parameters. We probably need to make this clearer in our docs...

@meltyshev commented on GitHub (Sep 24, 2025): Hey! Thanks for reporting this. This happens because file uploads are handled by `sailshq/skipper`, and that's just the way it processes text parameters: https://github.com/sailshq/skipper?tab=readme-ov-file#text-parameters. We probably need to make this clearer in our docs...

OVERLORD referenced this issue

2026-02-04 21:50:47 +03:00

[PR #821] [MERGED] style: :memo: added german translation for duplicate card #1108

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/planka#821