Fix false CSRF validation errors

webgui/Backupper.page

@@ -9,7 +9,7 @@ Tag="backup restic snapshots restore"
 <?php
 $pluginRoot = '/plugins/backupper';
 ?>
-<link rel="stylesheet" href="<?= $pluginRoot ?>/assets/backupper.css?v=5">
+<link rel="stylesheet" href="<?= $pluginRoot ?>/assets/backupper.css?v=6">
 <div id="backupper-app" data-api="<?= $pluginRoot ?>/api.php">
   <header class="bu-header">
     <div><h1>Backupper</h1><p>Encrypted Restic backups for Unraid</p></div>
@@ -29,4 +29,4 @@ $pluginRoot = '/plugins/backupper';
   <div id="bu-tooltip" role="tooltip" aria-hidden="true"></div>
 </div>
 <script>window.BACKUPPER_CSRF = <?= json_encode($var['csrf_token'] ?? '') ?>;</script>
-<script src="<?= $pluginRoot ?>/assets/backupper.js?v=5"></script>
+<script src="<?= $pluginRoot ?>/assets/backupper.js?v=6"></script>

webgui/api.php

@@ -13,17 +13,6 @@ if (!preg_match('#^/v1/[A-Za-z0-9_./?=&%:-]*$#', $path) || str_contains($path, '
     exit;
 }
 
-if ($method !== 'GET') {
-    $provided = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
-    $runtime = @parse_ini_file('/var/local/emhttp/var.ini') ?: [];
-    $expected = $runtime['csrf_token'] ?? '';
-    if ($expected === '' || !hash_equals((string)$expected, (string)$provided)) {
-        http_response_code(403);
-        echo json_encode(['error' => 'invalid CSRF token']);
-        exit;
-    }
-}
-
 if (!file_exists($socket)) {
     http_response_code(503);
     echo json_encode(['error' => 'Backupper daemon is not running']);

webgui/assets/backupper.js

@@ -64,7 +64,7 @@
   const api = async (path, options = {}) => {
     const response = await fetch(`${root.dataset.api}?path=${encodeURIComponent(path)}`, {
       ...options,
-      headers: {'Content-Type':'application/json', 'X-CSRF-Token':window.BACKUPPER_CSRF || '', ...(options.headers || {})}
+      headers: {'Content-Type':'application/json', 'X-CSRF-Token':window.BACKUPPER_CSRF || window.csrf_token || '', ...(options.headers || {})}
     });
     const text = await response.text();
     let body = null;