mirror of
https://github.com/Part-DB/Part-DB-server.git
synced 2026-06-04 01:31:41 +00:00
Add manual backup creation and delete buttons to Update Manager (#1255)
* Add manual backup creation and delete buttons to Update Manager - Add "Create Backup" button in the backups tab for on-demand backups - Add delete buttons (trash icons) for update logs and backups - New controller routes with CSRF protection and permission checks - Use data-turbo-confirm for CSP-safe confirmation dialogs - Add deleteLog() method to UpdateExecutor with filename validation * Add Docker backup support: download button, SQLite restore fix, decouple from auto-update - Decouple backup creation/restore UI from can_auto_update so Docker and other non-git installations can use backup features - Add backup download endpoint for saving backups externally - Fix SQLite restore to use configured DATABASE_URL path instead of hardcoded var/app.db (affects Docker and custom SQLite paths) - Show Docker-specific warning about var/backups/ not being persisted - Pass is_docker flag to template via InstallationTypeDetector * Add tests for backup/update manager improvements - Controller tests: auth, CSRF validation, 404 for missing backups, restore disabled check - UpdateExecutor: deleteLog validation, non-existent file, successful deletion - BackupManager: deleteBackup validation for missing/non-zip files * Fix test failures: add locale prefix to URLs, correct log directory path * Fix auth test: expect 401 instead of redirect for HTTP Basic auth * Improve test coverage for update manager controller Add happy-path tests for backup creation, deletion, download, and log deletion with valid CSRF tokens. Also test the locked state blocking backup creation. * Fix CSRF tests: initialize session before getting tokens * Fix CSRF tests: extract tokens from rendered page HTML * Harden backup security: password confirmation, CSRF, env toggle Address security review feedback from jbtronics: - Add IS_AUTHENTICATED_FULLY to all sensitive endpoints (create/delete backup, delete log, download backup, start update, restore) - Change backup download from GET to POST with CSRF token - Require password confirmation before downloading backups (backups contain sensitive data like password hashes and secrets) - Add DISABLE_BACKUP_DOWNLOAD env var (default: disabled) to control whether backup downloads are allowed - Add password confirmation modal with security warning in template - Add comprehensive tests: auth checks, env var blocking, POST-only enforcement, status/progress endpoint auth * Fix download modal: use per-backup modals for CSP/Turbo compatibility - Replace shared modal + inline JS with per-backup modals that have filename pre-set in hidden fields (no JavaScript needed) - Add data-turbo="false" to download forms for native browser handling - Add data-bs-dismiss="modal" to submit button to auto-close modal - Add hidden username field for Chrome accessibility best practice - Fix test: GET on POST-only route returns 404 not 405 * Fixed translation keys * Fixed text justification in download modal * Hardenened security of deleteLogEndpoint * Show whether backup, restores and updates are allowed or disabled by sysadmin on update manager * Added documentation for update manager related env variables --------- Co-authored-by: Jan Böhmer <mail@jan-boehmer.de>
This commit is contained in:
Sebastian Almberg
GitHub
parent
db8881621c
commit
0d58262e19
11 changed files with 1077 additions and 246 deletions
|
|
@ -12491,6 +12491,102 @@ Buerklin-API Authentication server:
|
|||
<target>Backup restore is disabled by server configuration.</target>
|
||||
</segment>
|
||||
</unit>
|
||||
<unit id="oAb35wU" name="update_manager.backup.create">
|
||||
<segment state="translated">
|
||||
<source>update_manager.backup.create</source>
|
||||
<target>Create Backup</target>
|
||||
</segment>
|
||||
</unit>
|
||||
<unit id="ms26oI0" name="update_manager.backup.create.confirm">
|
||||
<segment state="translated">
|
||||
<source>update_manager.backup.create.confirm</source>
|
||||
<target>Create a full backup now? This may take a moment.</target>
|
||||
</segment>
|
||||
</unit>
|
||||
<unit id="H9y0eLa" name="update_manager.backup.created">
|
||||
<segment state="translated">
|
||||
<source>update_manager.backup.created</source>
|
||||
<target>Backup created successfully.</target>
|
||||
</segment>
|
||||
</unit>
|
||||
<unit id="bMhXPVB" name="update_manager.backup.delete.confirm">
|
||||
<segment state="translated">
|
||||
<source>update_manager.backup.delete.confirm</source>
|
||||
<target>Are you sure you want to delete this backup?</target>
|
||||
</segment>
|
||||
</unit>
|
||||
<unit id="8tw67c_" name="update_manager.backup.deleted">
|
||||
<segment state="translated">
|
||||
<source>update_manager.backup.deleted</source>
|
||||
<target>Backup deleted successfully.</target>
|
||||
</segment>
|
||||
</unit>
|
||||
<unit id="BzBBuqk" name="update_manager.backup.delete_error">
|
||||
<segment state="translated">
|
||||
<source>update_manager.backup.delete_error</source>
|
||||
<target>Failed to delete backup.</target>
|
||||
</segment>
|
||||
</unit>
|
||||
<unit id="2olmcSs" name="update_manager.log.delete.confirm">
|
||||
<segment state="translated">
|
||||
<source>update_manager.log.delete.confirm</source>
|
||||
<target>Are you sure you want to delete this log?</target>
|
||||
</segment>
|
||||
</unit>
|
||||
<unit id=".ZrVHpp" name="update_manager.log.deleted">
|
||||
<segment state="translated">
|
||||
<source>update_manager.log.deleted</source>
|
||||
<target>Log deleted successfully.</target>
|
||||
</segment>
|
||||
</unit>
|
||||
<unit id="P2JI5Yw" name="update_manager.log.delete_error">
|
||||
<segment state="translated">
|
||||
<source>update_manager.log.delete_error</source>
|
||||
<target>Failed to delete log.</target>
|
||||
</segment>
|
||||
</unit>
|
||||
<unit id="Yos9FWk" name="update_manager.view_log">
|
||||
<segment state="translated">
|
||||
<source>update_manager.view_log</source>
|
||||
<target>View log</target>
|
||||
</segment>
|
||||
</unit>
|
||||
<unit id="B9uA2va" name="update_manager.delete">
|
||||
<segment state="translated">
|
||||
<source>update_manager.delete</source>
|
||||
<target>Delete</target>
|
||||
</segment>
|
||||
</unit>
|
||||
<unit id="ZtgvnXB" name="update_manager.backup.download">
|
||||
<segment state="translated">
|
||||
<source>update_manager.backup.download</source>
|
||||
<target>Download backup</target>
|
||||
</segment>
|
||||
</unit>
|
||||
<unit id="wxtmrnP" name="update_manager.backup.download.password_label">
|
||||
<segment state="translated">
|
||||
<source>update_manager.backup.download.password_label</source>
|
||||
<target>Confirm your password to download</target>
|
||||
</segment>
|
||||
</unit>
|
||||
<unit id="MIlTTgL" name="update_manager.backup.download.security_warning">
|
||||
<segment state="translated">
|
||||
<source>update_manager.backup.download.security_warning</source>
|
||||
<target>Backups contain sensitive data including password hashes and secrets. Please confirm your password to proceed with the download.</target>
|
||||
</segment>
|
||||
</unit>
|
||||
<unit id="kZPHBRt" name="update_manager.backup.download.invalid_password">
|
||||
<segment state="translated">
|
||||
<source>update_manager.backup.download.invalid_password</source>
|
||||
<target>Invalid password. Backup download denied.</target>
|
||||
</segment>
|
||||
</unit>
|
||||
<unit id="AZOjnE0" name="update_manager.backup.docker_warning">
|
||||
<segment state="translated">
|
||||
<source>update_manager.backup.docker_warning</source>
|
||||
<target>Docker installation detected. Backups are stored in var/backups/ which is not a persistent volume. Use the download button to save backups externally, or mount var/backups/ as a volume in your docker-compose.yml.</target>
|
||||
</segment>
|
||||
</unit>
|
||||
<unit id="kHKChQB" name="settings.ips.conrad">
|
||||
<segment state="translated">
|
||||
<source>settings.ips.conrad</source>
|
||||
|
|
@ -12821,5 +12917,29 @@ Buerklin-API Authentication server:
|
|||
<target>View as plain text</target>
|
||||
</segment>
|
||||
</unit>
|
||||
<unit id="Ehsj93c" name="modal.cancel">
|
||||
<segment>
|
||||
<source>modal.cancel</source>
|
||||
<target>Cancel</target>
|
||||
</segment>
|
||||
</unit>
|
||||
<unit id="jdpoFf2" name="update_manager.web_updates_allowed">
|
||||
<segment>
|
||||
<source>update_manager.web_updates_allowed</source>
|
||||
<target>Web updates allowed</target>
|
||||
</segment>
|
||||
</unit>
|
||||
<unit id="bdWa7is" name="update_manager.backup_restore_allowed">
|
||||
<segment>
|
||||
<source>update_manager.backup_restore_allowed</source>
|
||||
<target>Backup restore allowed</target>
|
||||
</segment>
|
||||
</unit>
|
||||
<unit id="kllGQEN" name="update_manager.backup_download_allowed">
|
||||
<segment>
|
||||
<source>update_manager.backup_download_allowed</source>
|
||||
<target>Backup download allowed</target>
|
||||
</segment>
|
||||
</unit>
|
||||
</file>
|
||||
</xliff>
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue