From 8c2e2cc9ba4fcfe8c1fd524dec861fe98cb955e9 Mon Sep 17 00:00:00 2001
From: Elian Doran <contact@eliandoran.me>
Date: Sun, 12 Apr 2026 23:35:50 +0300
Subject: [PATCH] chore(standalone): address requested changes

---
 .../src/lightweight/crypto_provider.ts        |  5 -----
 .../trilium-core/src/routes/api/backup.ts     | 19 +++++--------------
 2 files changed, 5 insertions(+), 19 deletions(-)

diff --git a/apps/client-standalone/src/lightweight/crypto_provider.ts b/apps/client-standalone/src/lightweight/crypto_provider.ts
index 6aa46ba525..128031bba2 100644
--- a/apps/client-standalone/src/lightweight/crypto_provider.ts
+++ b/apps/client-standalone/src/lightweight/crypto_provider.ts
@@ -85,11 +85,6 @@ export default class BrowserCryptoProvider implements CryptoProvider {
 
     constantTimeCompare(a: Uint8Array, b: Uint8Array): boolean {
         if (a.length !== b.length) {
-            // Maintain constant time by comparing a to itself
-            let dummy = 0;
-            for (let i = 0; i < a.length; i++) {
-                dummy |= a[i] ^ a[i];
-            }
             return false;
         }
 
diff --git a/packages/trilium-core/src/routes/api/backup.ts b/packages/trilium-core/src/routes/api/backup.ts
index 21a5b37738..b9839c380a 100644
--- a/packages/trilium-core/src/routes/api/backup.ts
+++ b/packages/trilium-core/src/routes/api/backup.ts
@@ -1,5 +1,6 @@
 import type { BackupDatabaseNowResponse, DatabaseBackup } from "@triliumnext/commons";
 import { getBackup } from "../../services/backup.js";
+import { Request, Response } from "express";
 
 async function getExistingBackups(): Promise<DatabaseBackup[]> {
     return getBackup().getExistingBackups();
@@ -11,20 +12,10 @@ async function backupDatabase(): Promise<BackupDatabaseNowResponse> {
     };
 }
 
-interface DownloadRequest {
-    query: { filePath?: string };
-}
-
-interface DownloadResponse {
-    status(code: number): DownloadResponse;
-    send(body: string): void;
-    set(name: string, value: string): DownloadResponse;
-}
-
-async function downloadBackup(req: DownloadRequest, res: DownloadResponse): Promise<void> {
+async function downloadBackup(req: Request, res: Response): Promise<void> {
     const filePath = req.query.filePath;
-    if (!filePath) {
-        res.status(400).send("Missing filePath");
+    if (!filePath || typeof filePath !== "string") {
+        res.status(400).send("Missing or invalid filePath");
         return;
     }
 
@@ -37,7 +28,7 @@ async function downloadBackup(req: DownloadRequest, res: DownloadResponse): Prom
     const fileName = filePath.split("/").pop() || "backup.db";
     res.set("Content-Type", "application/x-sqlite3");
     res.set("Content-Disposition", `attachment; filename="${fileName}"`);
-    res.send(content as unknown as string);
+    res.send(content);
 }
 
 export default {