FailedProxy/Varaverk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accept the global RSYNC_ENABLED flag, not only prefixed tiers

Browse Source 
The pattern required a tier prefix, so the master gate the rsync page renders
alongside the tier toggles was rejected as an invalid flag name and sprang
back to off. There was no way to enable syncing from the UI. Masked until now
because every POST to this endpoint was being swallowed as multipart.
This commit is contained in:
Gmer4Lfe
2026-08-02 18:49:00 -04:00
parent 76ad744581
commit 7625e923e5
1 changed files with 13 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Plugin/unraid/api/flag_toggle.php
+13 -5
View File
@@ -34,10 +34,14 @@
// OPERATIONAL SAFEGUARDS // OPERATIONAL SAFEGUARDS
// POST only, checked before any parameter is read. // POST only, checked before any parameter is read.
// //
// The flag name is constrained to the rsync namespace. // The flag name is constrained to the rsync namespace, with the tier prefix optional.
// ^[A-Z_]+_RSYNC_ENABLED$ — this endpoint cannot be used to flip an unrelated boolean // ^([A-Z][A-Z_]*_)?RSYNC_ENABLED$ — this endpoint cannot be used to flip an unrelated
// in master.conf. Every other conf edit goes through confform.php or config.php, which // boolean in master.conf. Every other conf edit goes through confform.php or config.php,
// have their own rules; a general-purpose flag setter would bypass all of them. // which have their own rules; a general-purpose flag setter would bypass all of them.
//
// The prefix must be optional because RSYNC_ENABLED is itself the global gate, and the
// page renders it alongside the tier flags. Requiring a prefix rejected it as an invalid
// flag name, so the master switch could not be turned on from the UI at all.
// //
// Anything other than the literal "1" is treated as false. // Anything other than the literal "1" is treated as false.
// ($_POST['enabled'] ?? '0') === '1' — strict comparison against one value, so a // ($_POST['enabled'] ?? '0') === '1' — strict comparison against one value, so a
@@ -79,7 +83,11 @@ if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
$name = trim($_POST['name'] ?? ''); $name = trim($_POST['name'] ?? '');
$enabled = ($_POST['enabled'] ?? '0') === '1'; $enabled = ($_POST['enabled'] ?? '0') === '1';
if (!$name || !preg_match('/^[A-Z_]+_RSYNC_ENABLED$/', $name)) { // The tier prefix is optional. RSYNC_ENABLED itself is the global gate the page also renders,
// and requiring a prefix silently rejected it — the toggle reverted to off with no way to turn
// syncing on from the UI at all. Masked until now because every POST to this endpoint was
// being swallowed by the multipart bug.
if (!$name || !preg_match('/^([A-Z][A-Z_]*_)?RSYNC_ENABLED$/', $name)) {
echo json_encode(['ok' => false, 'error' => 'Invalid flag name']); echo json_encode(['ok' => false, 'error' => 'Invalid flag name']);
exit; exit;
} }