marcpope/borgbackupserver v2.96.5

on GitHub

🔒 Shell hooks can no longer run a shell

The Shell Script Hook plugin's script field names a script on the client with optional arguments. It never went through a shell, but nothing stopped the first word from being /bin/sh -c, python3 or rm, which made the field "run any command as root" for anyone who could edit a plan or who had taken over the server. Agent 2.96.5 refuses a hook whose program is a shell, an interpreter, a system utility, or anything under a system binary directory such as /bin, /usr/bin or /usr/lib (after resolving symlinks), when the hook runs and when it is tested. The server applies the same rules when a configuration is saved, on the web and over the API. Put your commands inside a script of your own in /usr/local/bin, /etc/bbs-agent/hooks or a folder you choose, and point the hook at that. A client can confine hooks to one directory with hooks_dir under [agent] in its config.ini; that setting lives on the client and cannot be changed from the server.

Existing hooks that already point at a script of your own keep working. A hook that pointed at /bin/sh or a similar program stops with a message saying why.

New

• Sync now for offsite destinations (#501). Each destination on the repository page has a Sync now button, and POST /api/v1/repositories/{id}/s3-sync/run does the same. A sync requested while a backup runs waits for it, and the confirmation says so. The add form's button now says Save, and the confirmation names what was saved (#499).
• Offsite sync progress (#490). Offsite jobs show bytes and files transferred, the rate and the ETA on the queue page and in the API every five seconds, where they showed nothing before. By @Glob0x17.
• Certificate managed elsewhere (#488). Settings → SSL Certificate has a switch, "This certificate is not the one clients see", for a server behind a reverse proxy whose local certificate only covers the hop from the proxy. With it on, BBS stops warning when that certificate expires and clears any warning it raised. Also on the API as external on GET /api/v1/ssl.
• Storage names on the clients list (#474). The storage locations and Remote SSH hosts behind each client's repositories, under the repository count, and as storage_names on GET /api/v1/clients.

Fixes

• Backups that finish with warnings notify on every run, not only the first. A warning is a fresh event each night now; failures keep one alert per state change with the periodic reminder (#496).
• pg_dump version mismatch (#495). The agent asks the server its version and uses the matching pg_dump when one is installed, and says which client package to install when none matches. The agent Docker image ships PostgreSQL clients 16, 17 and 18.
• LVM snapshots failed with "Size is not a multiple of 512" because the copy-on-write size was passed unrounded (#498).
• Server Health shows "unavailable" instead of 0 B / 0 B when the server cannot read its memory figures, and memory.percent, used_bytes and total_bytes on /api/v1/server-stats are null in that case, the same rule network already followed. By @Glob0x17 (#485).
• Windows uninstaller failed to parse on Windows PowerShell 5.1: one em dash in a quoted string, read as a closing quote in ANSI. Both Windows scripts are plain ASCII now (#491).
• Custom branding icons were served as the bundled default in Docker and on bare metal because the GD extension was missing. By @k-wlosek (#494).
• Job types show as words on every page: "Offsite sync" rather than S3_sync, "Agent update" rather than update_agent. The API still returns the raw type (#497).
• Size-over-time chart: clicking a series in the legend shows only that series; clicking again shows both (#500).

API

• POST /api/v1/repositories/{id}/s3-sync/run with plugin_config_id.
• storage_names on GET /api/v1/clients.
• external on GET /api/v1/ssl and PUT /api/v1/ssl/external.
• Shell hook configs answer 422 when the script names a shell, interpreter or system utility.
• Offsite jobs carry bytes_processed, bytes_total, files_processed, files_total and status_message on /api/v1/queue.
• /api/v1/server-stats memory fields can be null.

Agent 2.96.5. Agents update themselves once the server is on this release; the update is signed and verified, as every update since 2.96.1.

BBS Manager for iOS is on the App Store; connect it under Settings → Push Service.