michael/URBM
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix false CSRF validation errors

Browse Source
This commit is contained in:
Mikei386
2026-06-13 23:55:07 +02:00
parent 93e28030a0
commit d14dd51584
8 changed files with 13 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dist/backupper-0.1.5-x86_64-1.txz.sha256
Vendored
-1
View File
@@ -1 +0,0 @@
9f9f8be1af5c6fc9aca24eef9f3d9726ac041132eb64d05811b64ece4342d182 backupper-0.1.5-x86_64-1.txz
dist/backupper-0.1.5-x86_64-1.txz → dist/backupper-0.1.6-x86_64-1.txz
Vendored
BIN
View File
Binary file not shown.
dist/backupper-0.1.6-x86_64-1.txz.sha256
Vendored
+1
View File
@@ -0,0 +1 @@
22d71250e0e7336fa9cc6a1a09115c9b7740ab21275163694ca3986b76a81a21 backupper-0.1.6-x86_64-1.txz
dist/backupper.plg
Vendored
+5 -2
View File
@@ -2,13 +2,16 @@
<!DOCTYPE PLUGIN [
<!ENTITY name "backupper">
<!ENTITY author "Backupper Project">
<!ENTITY version "0.1.5">
<!ENTITY version "0.1.6">
<!ENTITY pluginURL "https://git.casaderoll.de/michael/BackUpper/raw/branch/main/dist/backupper.plg">
<!ENTITY packageURL "https://git.casaderoll.de/michael/BackUpper/raw/branch/main/dist/backupper-&version;-x86_64-1.txz">
<!ENTITY packageSHA256 "9f9f8be1af5c6fc9aca24eef9f3d9726ac041132eb64d05811b64ece4342d182">
<!ENTITY packageSHA256 "22d71250e0e7336fa9cc6a1a09115c9b7740ab21275163694ca3986b76a81a21">
]>
<PLUGIN name="&name;" author="&author;" version="&version;" pluginURL="&pluginURL;" min="7.0.0" support="https://git.casaderoll.de/michael/BackUpper/issues">
<CHANGES>
### 0.1.6
- Fix false CSRF errors by relying on Unraid's native request validation.
### 0.1.5
- Add delayed German tooltips with examples throughout the WebGUI.
plugin/backupper.plg
+4 -1
View File
@@ -2,13 +2,16 @@
<!DOCTYPE PLUGIN [
<!ENTITY name "backupper">
<!ENTITY author "Backupper Project">
<!ENTITY version "0.1.5">
<!ENTITY version "0.1.6">
<!ENTITY pluginURL "https://git.casaderoll.de/michael/BackUpper/raw/branch/main/dist/backupper.plg">
<!ENTITY packageURL "https://git.casaderoll.de/michael/BackUpper/raw/branch/main/dist/backupper-&version;-x86_64-1.txz">
<!ENTITY packageSHA256 "REPLACE_DURING_RELEASE">
]>
<PLUGIN name="&name;" author="&author;" version="&version;" pluginURL="&pluginURL;" min="7.0.0" support="https://git.casaderoll.de/michael/BackUpper/issues">
<CHANGES>
### 0.1.6
- Fix false CSRF errors by relying on Unraid's native request validation.
### 0.1.5
- Add delayed German tooltips with examples throughout the WebGUI.
webgui/Backupper.page
+2 -2
View File
@@ -9,7 +9,7 @@ Tag="backup restic snapshots restore"
<?php
$pluginRoot = '/plugins/backupper';
?>
<link rel="stylesheet" href="<?= $pluginRoot ?>/assets/backupper.css?v=5">
<link rel="stylesheet" href="<?= $pluginRoot ?>/assets/backupper.css?v=6">
<div id="backupper-app" data-api="<?= $pluginRoot ?>/api.php">
<header class="bu-header">
<div><h1>Backupper</h1><p>Encrypted Restic backups for Unraid</p></div>
@@ -29,4 +29,4 @@ $pluginRoot = '/plugins/backupper';
<div id="bu-tooltip" role="tooltip" aria-hidden="true"></div>
</div>
<script>window.BACKUPPER_CSRF = <?= json_encode($var['csrf_token'] ?? '') ?>;</script>
<script src="<?= $pluginRoot ?>/assets/backupper.js?v=5"></script>
<script src="<?= $pluginRoot ?>/assets/backupper.js?v=6"></script>
webgui/api.php
-11
View File
@@ -13,17 +13,6 @@ if (!preg_match('#^/v1/[A-Za-z0-9_./?=&%:-]*$#', $path) || str_contains($path, '
exit;
}
if ($method !== 'GET') {
$provided = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
$runtime = @parse_ini_file('/var/local/emhttp/var.ini') ?: [];
$expected = $runtime['csrf_token'] ?? '';
if ($expected === '' || !hash_equals((string)$expected, (string)$provided)) {
http_response_code(403);
echo json_encode(['error' => 'invalid CSRF token']);
exit;
}
}
if (!file_exists($socket)) {
http_response_code(503);
echo json_encode(['error' => 'Backupper daemon is not running']);
webgui/assets/backupper.js
+1 -1
View File
@@ -64,7 +64,7 @@
const api = async (path, options = {}) => {
const response = await fetch(`${root.dataset.api}?path=${encodeURIComponent(path)}`, {
...options,
headers: {'Content-Type':'application/json', 'X-CSRF-Token':window.BACKUPPER_CSRF || '', ...(options.headers || {})}
headers: {'Content-Type':'application/json', 'X-CSRF-Token':window.BACKUPPER_CSRF || window.csrf_token || '', ...(options.headers || {})}
});
const text = await response.text();
let body = null;