We were setting PersistChange at the wrong time in the update handler…

… for detections. We'd set the value, update the detection, overwrite the detection with the result returned from the update that doesn't have the transient value set, then sync with PersistChange = false. Fixed.

When walking back the MarkChangedByUser context changes, the migration was updated to use context.Background. Instead we should use the server context, just don't call MarkChangedByUser on it.

server/detectionhandler.go

@@ -337,7 +337,6 @@ func (h *DetectionHandler) updateDetection(w http.ResponseWriter, r *http.Reques
 	}
 
 	statusModifiedByFilter := detect.IsEnabled != specifiedStatus
-	detect.PersistChange = true
 
 	err = h.PrepareForSave(ctx, detect, engine)
 	if err != nil {
@@ -367,6 +366,8 @@ func (h *DetectionHandler) updateDetection(w http.ResponseWriter, r *http.Reques
 		return
 	}
 
+	detect.PersistChange = true
+
 	errMap, err := SyncLocalDetections(ctx, h.server, []*model.Detection{detect})
 	if err != nil {
 		fixed := false

server/modules/suricata/migration-2.4.70.go

@@ -6,7 +6,6 @@
 package suricata
 
 import (
-	"context"
 	"fmt"
 	"os"
 	"regexp"
@@ -37,7 +36,7 @@ func (e *SuricataEngine) Migration2470(statePath string) error {
 
 	log.Info("suricata is now migrating to 2.4.70") // for support
 
-	ctx := context.Background()
+	ctx := e.srv.Context
 
 	// read in idstools.yaml
 	enabled, disabled, err := e.m2470LoadEnabledDisabled()