Merge pull request #17967 from marcusmoore/fixes/17963-delete-file-via-api-fix

Fixed #17963 - over eager deletion of asset files via api

Author: snipe

app/Http/Controllers/Api/UploadedFilesController.php

@@ -193,8 +193,12 @@ public function destroy($object_type, $id, $file_id) : JsonResponse
 
 
         // Check for the file
-        $log = Actionlog::find($file_id)->where('item_type', self::$map_object_type[$object_type])
-            ->where('item_id', $object->id)->first();
+        $log = Actionlog::query()
+            ->where('id', $file_id)
+            ->where('action_type', 'uploaded')
+            ->where('item_type', self::$map_object_type[$object_type])
+            ->where('item_id', $object->id)
+            ->first();
 
         if ($log) {
             // Check the file actually exists, and delete it
@@ -213,4 +217,4 @@ public function destroy($object_type, $id, $file_id) : JsonResponse
         return response()->json(Helper::formatStandardApiResponse('error', null, trans_choice('general.file_upload_status.delete.error', 1)), 500);
 
     }
-}
+}