Fix false CSRF validation errors

dist/backupper-0.1.5-x86_64-1.txz.sha256

@@ -1 +0,0 @@
-9f9f8be1af5c6fc9aca24eef9f3d9726ac041132eb64d05811b64ece4342d182  backupper-0.1.5-x86_64-1.txz

dist/backupper-0.1.6-x86_64-1.txz.sha256

@@ -0,0 +1 @@
+22d71250e0e7336fa9cc6a1a09115c9b7740ab21275163694ca3986b76a81a21  backupper-0.1.6-x86_64-1.txz

dist/backupper.plg

@@ -2,13 +2,16 @@
 <!DOCTYPE PLUGIN [
 <!ENTITY name "backupper">
 <!ENTITY author "Backupper Project">
-<!ENTITY version "0.1.5">
+<!ENTITY version "0.1.6">
 <!ENTITY pluginURL "https://git.casaderoll.de/michael/BackUpper/raw/branch/main/dist/backupper.plg">
 <!ENTITY packageURL "https://git.casaderoll.de/michael/BackUpper/raw/branch/main/dist/backupper-&version;-x86_64-1.txz">
-<!ENTITY packageSHA256 "9f9f8be1af5c6fc9aca24eef9f3d9726ac041132eb64d05811b64ece4342d182">
+<!ENTITY packageSHA256 "22d71250e0e7336fa9cc6a1a09115c9b7740ab21275163694ca3986b76a81a21">
 ]>
 <PLUGIN name="&name;" author="&author;" version="&version;" pluginURL="&pluginURL;" min="7.0.0" support="https://git.casaderoll.de/michael/BackUpper/issues">
   <CHANGES>
+### 0.1.6
+- Fix false CSRF errors by relying on Unraid's native request validation.
+
 ### 0.1.5
 - Add delayed German tooltips with examples throughout the WebGUI.
 

plugin/backupper.plg

@@ -2,13 +2,16 @@
 <!DOCTYPE PLUGIN [
 <!ENTITY name "backupper">
 <!ENTITY author "Backupper Project">
-<!ENTITY version "0.1.5">
+<!ENTITY version "0.1.6">
 <!ENTITY pluginURL "https://git.casaderoll.de/michael/BackUpper/raw/branch/main/dist/backupper.plg">
 <!ENTITY packageURL "https://git.casaderoll.de/michael/BackUpper/raw/branch/main/dist/backupper-&version;-x86_64-1.txz">
 <!ENTITY packageSHA256 "REPLACE_DURING_RELEASE">
 ]>
 <PLUGIN name="&name;" author="&author;" version="&version;" pluginURL="&pluginURL;" min="7.0.0" support="https://git.casaderoll.de/michael/BackUpper/issues">
   <CHANGES>
+### 0.1.6
+- Fix false CSRF errors by relying on Unraid's native request validation.
+
 ### 0.1.5
 - Add delayed German tooltips with examples throughout the WebGUI.
 

webgui/Backupper.page

@@ -9,7 +9,7 @@ Tag="backup restic snapshots restore"
 <?php
 $pluginRoot = '/plugins/backupper';
 ?>
-<link rel="stylesheet" href="<?= $pluginRoot ?>/assets/backupper.css?v=5">
+<link rel="stylesheet" href="<?= $pluginRoot ?>/assets/backupper.css?v=6">
 <div id="backupper-app" data-api="<?= $pluginRoot ?>/api.php">
   <header class="bu-header">
     <div><h1>Backupper</h1><p>Encrypted Restic backups for Unraid</p></div>
@@ -29,4 +29,4 @@ $pluginRoot = '/plugins/backupper';
   <div id="bu-tooltip" role="tooltip" aria-hidden="true"></div>
 </div>
 <script>window.BACKUPPER_CSRF = <?= json_encode($var['csrf_token'] ?? '') ?>;</script>
-<script src="<?= $pluginRoot ?>/assets/backupper.js?v=5"></script>
+<script src="<?= $pluginRoot ?>/assets/backupper.js?v=6"></script>

webgui/api.php

@@ -13,17 +13,6 @@ if (!preg_match('#^/v1/[A-Za-z0-9_./?=&%:-]*$#', $path) || str_contains($path, '
     exit;
 }
 
-if ($method !== 'GET') {
-    $provided = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
-    $runtime = @parse_ini_file('/var/local/emhttp/var.ini') ?: [];
-    $expected = $runtime['csrf_token'] ?? '';
-    if ($expected === '' || !hash_equals((string)$expected, (string)$provided)) {
-        http_response_code(403);
-        echo json_encode(['error' => 'invalid CSRF token']);
-        exit;
-    }
-}
-
 if (!file_exists($socket)) {
     http_response_code(503);
     echo json_encode(['error' => 'Backupper daemon is not running']);

webgui/assets/backupper.js

@@ -64,7 +64,7 @@
   const api = async (path, options = {}) => {
     const response = await fetch(`${root.dataset.api}?path=${encodeURIComponent(path)}`, {
       ...options,
-      headers: {'Content-Type':'application/json', 'X-CSRF-Token':window.BACKUPPER_CSRF || '', ...(options.headers || {})}
+      headers: {'Content-Type':'application/json', 'X-CSRF-Token':window.BACKUPPER_CSRF || window.csrf_token || '', ...(options.headers || {})}
     });
     const text = await response.text();
     let body = null;