Unable to download backups

[Richie (Richie Rich)]

I am unable to download any backups of my Discourse.

My backups are automatically stored in a AWS S3 bucket. The file does exist and I can download it manually by browsing to the S3 bucket via AWS console.

I am running v3.1.0.beta2 (e64d1c4105)

Steps to repro (my browser is Safari 16.3 on macOS Ventura 13.2):

1. Go to Admin > Backups
2. Click the Download button
3. Click the link in the email when it arrives

What should happen?

• The backup should download

What actually happens?

• An error appears on the browser window:

Oops

The software powering this discussion forum encountered an unexpected problem. We apologize for the inconvenience.

Detailed information about the error was logged, and an automatic notification generated. We’ll take a look at it.

No further action is necessary. However, if the error condition persists, you can provide additional detail, including steps to reproduce the error, by posting a discussion topic in the site’s feedback category.

The Discourse error logs show a fatal error:

ActionController::Redirecting::UnsafeRedirectError (Unsafe redirect to “https://[REDACTED].s3.eu-west-2.amazonaws.com/default/[REDACTED]-2023-02-04…”, pass allow_other_host: true to redirect anyway.

And:

ActionController::Redirecting::UnsafeRedirectError (Unsafe redirect to "https://[REDACTED].s3.eu-west-2.amazonaws.com/default/[REDACTED]-2023-02-04...", pass allow_other_host: true to redirect anyway.)
app/controllers/admin/backups_controller.rb:87:in `show'
app/controllers/application_controller.rb:414:in `block in with_resolved_locale'
app/controllers/application_controller.rb:414:in `with_resolved_locale'
lib/middleware/omniauth_bypass_middleware.rb:74:in `call'
lib/content_security_policy/middleware.rb:12:in `call'
lib/middleware/anonymous_cache.rb:369:in `call'
config/initializers/100-quiet_logger.rb:20:in `call'
config/initializers/100-silence_logger.rb:29:in `call'
lib/middleware/enforce_hostname.rb:24:in `call'
lib/middleware/request_tracker.rb:228:in `call'

Backtrace

actionpack (7.0.4.1) lib/action_controller/metal/redirecting.rb:193:in `_enforce_open_redirect_protection'
actionpack (7.0.4.1) lib/action_controller/metal/redirecting.rb:89:in `redirect_to'
actionpack (7.0.4.1) lib/action_controller/metal/flash.rb:62:in `redirect_to'
actionpack (7.0.4.1) lib/action_controller/metal/instrumentation.rb:42:in `block in redirect_to'
activesupport (7.0.4.1) lib/active_support/notifications.rb:206:in `block in instrument'
activesupport (7.0.4.1) lib/active_support/notifications/instrumenter.rb:24:in `instrument'
activesupport (7.0.4.1) lib/active_support/notifications.rb:206:in `instrument'
actionpack (7.0.4.1) lib/action_controller/metal/instrumentation.rb:41:in `redirect_to'
app/controllers/admin/backups_controller.rb:87:in `show'
actionpack (7.0.4.1) lib/action_controller/metal/basic_implicit_render.rb:6:in `send_action'

Env

HTTP HOSTS: greyarro.ws

[gerhard (Gerhard Schlager)]

Here’s a fix:

FIX: Redirecting to download backup from S3 could fail

[Richie (Richie Rich)]

Brilliant! Thanks for the fix (and the speed of the fix!)