someone made PR: https://github.com/LimeSurvey/LimeSurvey/pull/3599

regression caused by commit 70b09896e023d919791b0b5bb8bc345eee1b98ac (@gabrieljenik)

the suggestion in the PR to change the route in the skip csrf validation route list from "remotecontrol" to "admin/remotecontrol" only fixes routing by get, routing by path would need "/admin/remotecontrol" to be added also. Alternatively, the preg_match could be adjusted to handle both types of routing (leading slash is present on path, but not get) or somehow normalize the leading slash between the two routing methods before the check.

the added unit tests didn't catch this because they don't use the actual path for remotecontrol, they reused the rule from the skip csrf validation route list (also noted in the PR) the previous behavior just matched the skip rule anywhere in the route (which I think was the security issue the offending commit was trying to mitigate)

i change to block and put high priority

I hope this is can be reverted/fixed before the next release in a couple days as it prevents remotecontrol rpc from working at all (rest/plugin might also be affected but I'm not sure)

ok rest does work with new preg_match using path routing (rest doesn't seem to work with get routing at all anyways... 500 errors, and it's experimental so shrug)

for some reason /admin/remotecontrol comes through as /admin/remotecontrol but /rest/v1/session comes back as rest/v1/session (leading slash is not consistent)

I don't know about the plugin/unsecure route, not sure how to test that

I would just reopen #19139.
Revert the PRs.
Review the whole situation with out having to worry about tomorrows release.

Closed in favor of #19139.