Project

General

Profile

Actions

Bug #9390

closed

diag_backup.php: Backup output generation failure with CSRF script tag inserted into XML

Added by Sam Likins about 5 years ago. Updated almost 5 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Category:
Backup / Restore
Target version:
Start date:
03/10/2019
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
2.4.4_2
Affected Architecture:
All

Description

Since the last update (ie: 2.4.4_2), backups fail to restore; previously generated backups will restore, but new backups will fail restoration with the following message:

The following input errors were detected:

 - The configuration could not be restored.

When creating a backup XML file, regardless of the options (Backup area, Skip packages, Skip RRD data, Encryption) the generated file has an erroneous line at the end, outside the pfSense closing tag. you erroneous line is the following:

<script type="text/javascript">CsrfMagic.end();</script>

This CSRF line is added by the output buffer function csrf_ob_handler in the file /usr/local/www/csrf/csrf-magic.php. The generation of the backup file occurs in file /usr/local/www/diag_backup.php on line 228. Due to the CSRF output buffer flag js-rewrite being enabled when the backup is output, the erroneous line is added.

$GLOBALS['csrf']['rewrite-js']

This global value needs to be set to false prior to outputting the backup.

BUG FIX to be submitted shortly.


Files

backup-buffer-fix.diff (471 Bytes) backup-buffer-fix.diff Jim Pingle, 03/10/2019 05:46 PM
Actions

Also available in: Atom PDF