Removed logging comments as its implied in asset post also if returning 1 field for logging use getFieldById Function flipped it so it validate CSRF before role permission check, replaced header redirect with new redirect function and elimnasted the extra exit() afer redirect as its done in the function, also used the flash_alert function

admin/post/backup.php

@@ -9,6 +9,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
 require_once "../includes/app_version.php";
 
 if (isset($_GET['download_backup'])) {
+    
     validateCSRFToken($_GET['csrf_token']);
     
     $timestamp = date('YmdHis');