fix export

[wwi-rk]

⚠️ Please verify that this feature request has NOT been suggested before.

• I checked and didn't find similar feature request

🏷️ Feature Request Type

UI Feature

🔖 Feature description

fix export to avoid a manual data directory backup and restore (as easy as that is), it would help improve usability

✔️ Solution

fix export/backup to support the latest features of uptime kuma

❓ Alternatives

backup the /data directory and restore

📝 Additional Context

No response

[CommanderStorm]

Please see #2141 (comment)

In 1.18.3, the backup feature was deprecated due to [being left] unmaintained.

Backup & Restore with json has been deprecated and issues will not be fixed due to the amount of problems it has been causing for our users and us.
Please use SQL based backup instead.

New approaches to these features should use sqlite dump or mariadb dump respectively.
Here is our contribution guide: https://github.com/louislam/uptime-kuma/blob/master/CONTRIBUTING.md

[wwi-rk]

Why not add a direct db export and import through the UI, if json is not supported. it would be great to incorporate a settings / config export / import.

[chakflying]

Having it available in the UI is definitely the goal long term, but just importing a dump might expose a giant SQL injection vulnerability? I haven't really thought about this but it seems fairly complicated to get this right.

[CommanderStorm]

just importing a dump might expose a giant SQL injection vulnerability?

I think a "Please enter your username+password+2fa again so that we are sure you are authorized" mechanism should be enough to stop any attack vectors opened through this.

[wwi-rk]

well i agree that a full dump is probably more than necessary - likely need to identify the pertinent tables. I haven't looked in db, but probably need the config tables related to domains, frequency checks and all settings etc... any system tables may not need to be part of it. You may omit the user table too and require re-registration to the app - but that would be nice to have too or maybe a checkbox to make it optional to export users too. So yes, definitely requires more thought into best way to do this securely.
right, if in angular / node, i think you can make it so that endpoint requires authentication or 2fa to use or force 2fa each time to do that operation (on front-end and back-end), ... but i haven't looked into the code enough to know how it's currently setup.