Question

I have been looking for a way to remove an attachment from Jira using the SOAP Api, but it seems that this is not possible natively, and I would prefer not having to implement a new plugin for Jira, as suggested in the accepted answer to this question, or recompiling the existing plugin to support this as mentioned here.

This answer to the abovementioned question seems to do exactly what I want, but alas, I can’t get i to work. The response i get is an error stating that:

XSRF Security Token Missing

JIRA could not complete this action due to a missing form token.

You may have cleared your browser cookies, which could have resulted in the expiry of your current form token. A new form token has been reissued.

As I am using Asp.Net MVC C#, I have used the code from the answer, as is, with only the server url adjusted, as well as with different credentials (a Jira user) and the username/password passed through as request parameters using:

os_username=jirausername&os_password=xxxxxxx

The code I am currently using is as follows:

public void RemoveAttachment(string issueid, string attachmentid)
        {
            using (System.Net.WebClient client = new System.Net.WebClient())
            {
                //Compute jira server base url from WS url
                string baseUrl = _service.Url.Substring(0, _service.Url.IndexOf("/rpc/"));

                //Compute complete attachment url
                string attachmenturl = baseUrl + "/secure/DeleteAttachment.jspa?id=" +
                                       issueid + "&deleteAttachmentId=" + attachmentid;

                client.Credentials = new System.Net.NetworkCredential("jirausername", "xxxxxxx");
                string response = client.DownloadString(attachmenturl);
            }
    }

Answer 1

I ended up using a method that first requests the deletion confirmation form, then extracts a required token from the form, and finally posts something equivalent to the form content in order to delete the attachment. Code below.

public void RemoveAttachment(string issueid, string attachmentid)
{
    //Compute jira server base url from WS url
    string baseUrl = _service.Url.Substring(0, _service.Url.IndexOf("/rpc/"));

    //Compute complete attachment deletion confirm url
    string confirmurl = baseUrl + "/secure/DeleteAttachment!default.jspa?id=" +
                 issueid + "&deleteAttachmentId=" + attachmentid + "&os_username=jirauser&os_password=xxxxxx";

    //Create a cookie container to maintain the xsrf security token cookie.
    CookieContainer jiracontainer = new CookieContainer();

    //Create a get request for the page containing the delete confirmation.
    HttpWebRequest confirmrequest = (HttpWebRequest)WebRequest.Create(confirmurl);
    confirmrequest.Credentials = System.Net.CredentialCache.DefaultCredentials;
    confirmrequest.CookieContainer = jiracontainer;

    //Get the response and the responsestream.
    WebResponse confirmdeleteresponse = confirmrequest.GetResponse();
    Stream ReceiveStream = confirmdeleteresponse.GetResponseStream();

    // Open the stream using a StreamReader for easy access.
    StreamReader confirmreader = new StreamReader(ReceiveStream);
    // Read the content.
    string confirmresponse = confirmreader.ReadToEnd();

    //Create a regex to extract the atl/xsrf token from a hidden field. (Might be nicer to read it from a cookie, which should also be possible).
    Regex atl_token_matcher = new Regex("<input[^>]*id=\"atl_token\"[^>]*value=\"(?<token>\\S+)\"[^>]*>", RegexOptions.Singleline);
    Match token_match = atl_token_matcher.Match(confirmresponse);

    if (token_match.Success)
    {
        //If we found the token get the value.
        string token = token_match.Groups["token"].Value;

        //Compute attachment delete url.
        string deleteurl = baseUrl + "/secure/DeleteAttachment.jspa";

        //Construct form data.
        string postdata = "atl_token=" + HttpContext.Current.Server.UrlEncode(token) + "&id=" + issueid + "&deleteAttachmentId=" + attachmentid + "&Delete=Delete&os_username=jirauser&os_password=xxxxxx";

        //Create a post request for the deletion page.
        HttpWebRequest request = (HttpWebRequest)WebRequest.Create(deleteurl);
        request.KeepAlive = false;
        request.CookieContainer = jiracontainer; // Remember to set the cookiecontainer.
        request.ProtocolVersion = HttpVersion.Version10;
        request.Method = "POST";

        //Turn our request string into a byte stream
        byte[] postBytes = Encoding.ASCII.GetBytes(postdata);

        //Make sure you specify the proper type.
        request.ContentType = "application/x-www-form-urlencoded";
        request.ContentLength = postBytes.Length;
        Stream requestStream = request.GetRequestStream();

        //Send the post.
        requestStream.Write(postBytes, 0, postBytes.Length);
        requestStream.Close();

        //Get the response.
        WebResponse deleteresponse = request.GetResponse();

        // Open the responsestream using a StreamReader for easy access.
        StreamReader deleteresponsereader = new StreamReader(deleteresponse.GetResponseStream());

        // Read the content.
        string deleteresponsecontent = deleteresponsereader.ReadToEnd();

        // do whatever validation/reporting with the response...
    }
    else
    {
        //We couldn't find the atl_token. Throw an error or something...
    }

}

Edit:
Same thing works for removing comments. Replace ‘attachment’ with ‘comment’ and ‘deleteAttachmentId’ with ‘commentId’ and you should be good to go.