[PHPBB3-15928] Remove support for downloading backups

[v3d]

https://tracker.phpbb.com/browse/PHPBB3-15928

https://github.com/phpbb/phpbb/pull/5502
https://github.com/phpbb/phpbb/pull/5501

As per the ticket, database backups could no longer be downloaded via the ACP, starting with phpBB 3.2.6.

Could you please elaborate on why is this functionality being removed?

[warmweer]

Could you please elaborate on why is this functionality being removed?

Ow, this is a surprise.
It doesn't cause any problem for me but I can't think of a reason for this move (not that I have time to think about it). (perhaps too many broken downloads because of backupsize?)

[david63]

I would guess that it is being removed as a security/privacy measure, possibly connected with GDPR. There have been instances where "rogue" Admins/Founders have had access to the backup facility.

[Marc]

Correct, this is being done as further hardening of the ACP. While backups can still be created and restored, the downloading functionality will be removed to prevent the potential of unauthorized downloads of backups by admins. You will still be able to download the backups via FTP or other means of accessing the file systems as administrator.

[v3d]

Thank you all for clarifying this.

If it is done for prevententing unauthorized access, it sounds to me more like an access rights problematic. Why not create an admin permission "can download backups" or more commonly "can use the backup functionality (create, restore, delete, download)"?

In general, such soluton seems more adapted to "rogue" admins who could always find a workaround. For example, in the phphBB 3.0 days there was a mod which granted full access to the private messages table via the ACP. I guess, the same could be done with extensions, while the ability to send mass emails could be exploited to extract email addresses. And of course, a rogue admin could also create and restore a corrupted backup or simply delete the entire forum along with all backups in the /store folder.

In this case, should we also disable these functionalities or allow, and most importantly, advise on stricter access control?

[3Di]

Why not create an admin permission "can download backups" or more commonly "can use the backup functionality (create, restore, delete, download)"?

It might be an idea for phpBB 3.3/4, I don't see it as something to implement in 3.2 anyway.

[Ger]

Why not create an admin permission "can download backups" or more commonly "can use the backup functionality (create, restore, delete, download)"?

It might be an idea for phpBB 3.3/4, I don't see it as something to implement in 3.2 anyway.

Why would an extra permission need to wait for a new major version, while removal of functionality can be done in a minor upgrade?

Not that I really care, I never use that phpBB function anyway (MySQL Workbench ftw).

[david63]

There already is a "Can backup/restore database" Admin permission but that no affect if the user is a Founder - and that is what this change is aimed at preventing.

I would prefer a change where there can only be one Founder as that would get around all of these types of problems.

[Ger]

I would prefer a change where there can only be one Founder as that would get around all of these types of problems.

I wouldn't.
That would result in a single point of failure. What is that founder is needed for an urgent task and he or she is unavailable because of vacation, illness or -worse- some accident or perhaps even death?

Yeah of course you can always gain access through the database but that assumes much deeper knowledge of both phpBB and MySQL.

[v3d]

What if the founder (site admin) is unreachable and has also stopped paying the bills, while other founders do not have FTP access? This exact scenario happened to several long-running forums I use to visit (2 SMF-based & 3 phpBB-based, one of which I'm currently hosting). The only thing that saved these forums was the ability to download backups via the ACP.

As for the backups permission, David has a point, it already exists

Given all this, a simple, yet relatively effective solution could be a notification to promote stricter control over founder/admin rights. e.g. On update, after login to the ACP: "Please review and remove all unwanted Founder and Admin permissions as it could result in unauthorized access to the ACP, stolen data (GDPR) etc; Here is the current list of such users with their respective permissions..."