Fix false CSRF validation errors

2026-06-13 23:55:07 +02:00
parent 93e28030a0
commit d14dd51584
8 changed files with 13 additions and 18 deletions
@@ -13,17 +13,6 @@ if (!preg_match('#^/v1/[A-Za-z0-9_./?=&%:-]*$#', $path) || str_contains($path, '
    exit;
 }

-if ($method !== 'GET') {
-    $provided = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
-    $runtime = @parse_ini_file('/var/local/emhttp/var.ini') ?: [];
-    $expected = $runtime['csrf_token'] ?? '';
-    if ($expected === '' || !hash_equals((string)$expected, (string)$provided)) {
-        http_response_code(403);
-        echo json_encode(['error' => 'invalid CSRF token']);
-        exit;
-    }
-}
-
 if (!file_exists($socket)) {
    http_response_code(503);
    echo json_encode(['error' => 'Backupper daemon is not running']);