From a450406f4ff98d14d15ae3a76241b67c984bc6a7 Mon Sep 17 00:00:00 2001
From: Brian Hanson <brian@brianhanson.net>
Date: Tue, 5 May 2026 09:51:20 -0500
Subject: [PATCH 1/4] Fix backup download

---
 .../components/utilities/DatabaseBackup.vue   | 42 +++++++++++++------
 resources/js/composables/useCraftData.ts      |  2 +
 .../Utilities/DbBackupController.php          | 12 +++---
 src/Http/Middleware/HandleInertiaRequests.php |  2 +
 4 files changed, 40 insertions(+), 18 deletions(-)

diff --git a/resources/js/components/utilities/DatabaseBackup.vue b/resources/js/components/utilities/DatabaseBackup.vue
index 53f22b01b22..e02483a17fe 100644
--- a/resources/js/components/utilities/DatabaseBackup.vue
+++ b/resources/js/components/utilities/DatabaseBackup.vue
@@ -2,17 +2,29 @@
   import {t} from '@craftcms/cp/utilities/translate.ts.mjs';
   import dbBackupController from '@actions/Utilities/DbBackupController';
   import {useForm} from '@inertiajs/vue3';
-  import type CraftCheckbox from '@craftcms/cp/src/components/checkbox/checkbox';
+  import CraftCheckbox from '@craftcms/cp/vue/CraftCheckbox.vue';
+  import {useTemplateRef} from 'vue';
+  import useCraftData from '@/composables/useCraftData';
 
   const form = useForm({
-    downloadBackup: false,
+    downloadBackup: true,
   });
 
+  const {csrfTokenValue, csrfTokenName} = useCraftData();
+  const formRef = useTemplateRef('formRef');
+
   function handleSubmit() {
     form.clearErrors();
-    form.submit(dbBackupController(), {
-      onError: (e) => {
-        console.log('uh oh');
+
+    // If downloading, submit form natively to handle file response
+    if (form.downloadBackup) {
+      formRef.value?.submit();
+      return;
+    }
+
+    form.post(dbBackupController().url, {
+      onSuccess: () => {
+        form.reset();
       },
     });
   }
@@ -20,16 +32,20 @@
 
 <template>
   <div class="p-4">
-    <form @submit.prevent="handleSubmit" id="db-backup" method="post">
-      <craft-checkbox
+    <form
+      :action="dbBackupController().url"
+      ref="formRef"
+      @submit.prevent="handleSubmit"
+      id="db-backup"
+      method="post"
+    >
+      <input type="hidden" :name="csrfTokenName" :value="csrfTokenValue" />
+      <CraftCheckbox
         :label="t('Download backup')"
         name="downloadBackup"
-        .checked="form.downloadBackup"
-        @model-value-changed="
-          form.downloadBackup =
-            ($event.target as CraftCheckbox)?.checked === true
-        "
-      ></craft-checkbox>
+        v-model="form.downloadBackup"
+        value="on"
+      />
 
       <div class="mt-4">
         <craft-button
diff --git a/resources/js/composables/useCraftData.ts b/resources/js/composables/useCraftData.ts
index 27bf8f8a3af..e6e310fd391 100644
--- a/resources/js/composables/useCraftData.ts
+++ b/resources/js/composables/useCraftData.ts
@@ -1,6 +1,8 @@
 import {usePage} from '@inertiajs/vue3';
 
 export interface CraftData {
+  csrfTokenValue: string;
+  csrfTokenName: string;
   system: {
     name: string;
     icon: string | null;
diff --git a/src/Http/Controllers/Utilities/DbBackupController.php b/src/Http/Controllers/Utilities/DbBackupController.php
index 517b0ba2c5a..8b627aec7e5 100644
--- a/src/Http/Controllers/Utilities/DbBackupController.php
+++ b/src/Http/Controllers/Utilities/DbBackupController.php
@@ -5,10 +5,10 @@
 namespace CraftCms\Cms\Http\Controllers\Utilities;
 
 use CraftCms\Cms\Database\Backups;
+use CraftCms\Cms\Http\RespondsWithFlash;
 use CraftCms\Cms\Support\File;
 use CraftCms\Cms\Utility\Utilities;
 use CraftCms\Cms\Utility\Utilities\DbBackup;
-use Exception;
 use Illuminate\Http\Request;
 use Throwable;
 
@@ -16,6 +16,8 @@
 
 readonly class DbBackupController
 {
+    use RespondsWithFlash;
+
     public function __construct(Utilities $utilitiesService)
     {
         if (! $utilitiesService->checkAuthorization(DbBackup::class)) {
@@ -28,11 +30,11 @@ public function __invoke(Request $request, Backups $backups)
         try {
             $backupPath = $backups->backup();
         } catch (Throwable $e) {
-            throw new Exception('Could not create backup: '.$e->getMessage());
+            return $this->asFailure(t('Could not create backup: '.$e->getMessage()));
         }
 
         if (! is_file($backupPath)) {
-            throw new Exception("Could not create backup: the backup file doesn't exist.");
+            return $this->asFailure(t('Could not create backup: the backup file doesn\'t exist.'));
         }
 
         // Zip it up and delete the SQL file
@@ -40,8 +42,8 @@ public function __invoke(Request $request, Backups $backups)
 
         File::delete($backupPath);
 
-        if (! $request->input('downloadBackup')) {
-            return back()->with('success', t('Backup created.'));
+        if (! $request->boolean('downloadBackup')) {
+            return $this->asSuccess(t('Backup created.'));
         }
 
         return response()->download($zipPath);
diff --git a/src/Http/Middleware/HandleInertiaRequests.php b/src/Http/Middleware/HandleInertiaRequests.php
index ab3911a9da4..2cc211e39f1 100644
--- a/src/Http/Middleware/HandleInertiaRequests.php
+++ b/src/Http/Middleware/HandleInertiaRequests.php
@@ -95,6 +95,8 @@ public function share(Request $request): array
                 'hasWaitingJobs' => false,
             ],
             'craft' => fn () => [
+                'csrfTokenValue' => csrf_token(),
+                'csrfTokenName' => Cms::config()->csrfTokenName,
                 'general' => [
                     'useEmailAsUsername' => $generalConfig->useEmailAsUsername,
                 ],

From 4fe36772cc8098f30cd101dd3c33bf0afc0a15d9 Mon Sep 17 00:00:00 2001
From: Brian Hanson <brian@brianhanson.net>
Date: Tue, 5 May 2026 10:20:26 -0500
Subject: [PATCH 2/4] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 src/Http/Controllers/Utilities/DbBackupController.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Http/Controllers/Utilities/DbBackupController.php b/src/Http/Controllers/Utilities/DbBackupController.php
index 8b627aec7e5..e3cfd82a7bb 100644
--- a/src/Http/Controllers/Utilities/DbBackupController.php
+++ b/src/Http/Controllers/Utilities/DbBackupController.php
@@ -30,7 +30,7 @@ public function __invoke(Request $request, Backups $backups)
         try {
             $backupPath = $backups->backup();
         } catch (Throwable $e) {
-            return $this->asFailure(t('Could not create backup: '.$e->getMessage()));
+            return $this->asFailure(t('Could not create backup: {error}', ['error' => $e->getMessage()]));
         }
 
         if (! is_file($backupPath)) {

From 75fe8fa0d9df8e1b49847d3ad458c64f151147f3 Mon Sep 17 00:00:00 2001
From: Brian Hanson <brian@brianhanson.net>
Date: Tue, 5 May 2026 10:25:07 -0500
Subject: [PATCH 3/4] Copilot suggestions

---
 resources/js/components/utilities/DatabaseBackup.vue  | 7 ++++++-
 resources/js/composables/useCraftData.ts              | 4 ++--
 src/Http/Controllers/Utilities/DbBackupController.php | 6 ++++--
 src/Http/Middleware/HandleInertiaRequests.php         | 4 ++--
 4 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/resources/js/components/utilities/DatabaseBackup.vue b/resources/js/components/utilities/DatabaseBackup.vue
index e02483a17fe..d4ca5a59d8b 100644
--- a/resources/js/components/utilities/DatabaseBackup.vue
+++ b/resources/js/components/utilities/DatabaseBackup.vue
@@ -39,7 +39,12 @@
       id="db-backup"
       method="post"
     >
-      <input type="hidden" :name="csrfTokenName" :value="csrfTokenValue" />
+      <input
+        v-if="csrfTokenName && csrfTokenValue"
+        type="hidden"
+        :name="csrfTokenName"
+        :value="csrfTokenValue"
+      />
       <CraftCheckbox
         :label="t('Download backup')"
         name="downloadBackup"
diff --git a/resources/js/composables/useCraftData.ts b/resources/js/composables/useCraftData.ts
index e6e310fd391..626a374053e 100644
--- a/resources/js/composables/useCraftData.ts
+++ b/resources/js/composables/useCraftData.ts
@@ -1,8 +1,8 @@
 import {usePage} from '@inertiajs/vue3';
 
 export interface CraftData {
-  csrfTokenValue: string;
-  csrfTokenName: string;
+  csrfTokenValue?: string | null;
+  csrfTokenName?: string | null;
   system: {
     name: string;
     icon: string | null;
diff --git a/src/Http/Controllers/Utilities/DbBackupController.php b/src/Http/Controllers/Utilities/DbBackupController.php
index 8b627aec7e5..904490b810c 100644
--- a/src/Http/Controllers/Utilities/DbBackupController.php
+++ b/src/Http/Controllers/Utilities/DbBackupController.php
@@ -30,11 +30,13 @@ public function __invoke(Request $request, Backups $backups)
         try {
             $backupPath = $backups->backup();
         } catch (Throwable $e) {
-            return $this->asFailure(t('Could not create backup: '.$e->getMessage()));
+            report($e);
+
+            return $this->asFailure(t('Could not create backup: {error}', ['error' => $e->getMessage()]));
         }
 
         if (! is_file($backupPath)) {
-            return $this->asFailure(t('Could not create backup: the backup file doesn\'t exist.'));
+            return $this->asFailure(t('Could not create backup: the backup file doesn’t exist.'));
         }
 
         // Zip it up and delete the SQL file
diff --git a/src/Http/Middleware/HandleInertiaRequests.php b/src/Http/Middleware/HandleInertiaRequests.php
index 2cc211e39f1..4f5101ef4fc 100644
--- a/src/Http/Middleware/HandleInertiaRequests.php
+++ b/src/Http/Middleware/HandleInertiaRequests.php
@@ -95,8 +95,8 @@ public function share(Request $request): array
                 'hasWaitingJobs' => false,
             ],
             'craft' => fn () => [
-                'csrfTokenValue' => csrf_token(),
-                'csrfTokenName' => Cms::config()->csrfTokenName,
+                'csrfTokenValue' => $generalConfig->enableCsrfProtection ? csrf_token() : null,
+                'csrfTokenName' => $generalConfig->enableCsrfProtection ? $generalConfig->csrfTokenName : null,
                 'general' => [
                     'useEmailAsUsername' => $generalConfig->useEmailAsUsername,
                 ],

From 94657dc4d4d5b7b2b353b7fd740fca209e6af421 Mon Sep 17 00:00:00 2001
From: Brian Hanson <brian@brianhanson.net>
Date: Tue, 5 May 2026 10:47:37 -0500
Subject: [PATCH 4/4] Update strings

---
 resources/translations/en/app.php                     | 2 ++
 src/Http/Controllers/Utilities/DbBackupController.php | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/resources/translations/en/app.php b/resources/translations/en/app.php
index b99ba88def3..e30eed94b2f 100644
--- a/resources/translations/en/app.php
+++ b/resources/translations/en/app.php
@@ -390,6 +390,8 @@
     'Copy “{name}” value' => 'Copy “{name}” value',
     'Copy' => 'Copy',
     'Could not create a preview token.' => 'Could not create a preview token.',
+    'Could not create backup: check the logs for details.' => 'Could not create backup: check the logs for details.',
+    'Could not create backup: the backup file doesn’t exist.' => 'Could not create backup: the backup file doesn’t exist.',
     'Could not create the group:' => 'Could not create the group:',
     'Could not duplicate all elements due to validation errors.' => 'Could not duplicate all elements due to validation errors.',
     'Could not duplicate elements due to validation errors.' => 'Could not duplicate elements due to validation errors.',
diff --git a/src/Http/Controllers/Utilities/DbBackupController.php b/src/Http/Controllers/Utilities/DbBackupController.php
index 904490b810c..9d19a516510 100644
--- a/src/Http/Controllers/Utilities/DbBackupController.php
+++ b/src/Http/Controllers/Utilities/DbBackupController.php
@@ -32,7 +32,7 @@ public function __invoke(Request $request, Backups $backups)
         } catch (Throwable $e) {
             report($e);
 
-            return $this->asFailure(t('Could not create backup: {error}', ['error' => $e->getMessage()]));
+            return $this->asFailure(t('Could not create backup: check the logs for details.'));
         }
 
         if (! is_file($backupPath)) {