Missing merge from 1.9.7

jasonwch · July 17, 2026, 9:49am

why this is still not being merged to 1.9.7?

github.com/hestiacp/hestiacp

fix(filemanager): avoid blocked sudo chmod and grant .ssh traversal for hestiaweb (#5242)

main ← amongiardo:fix/filemanager-sftp-key-traversal

opened 10:48PM - 06 Mar 26 UTC

amongiardo

+10 -3

## Summary This PR fixes a File Manager SFTP failure that can surface as `U…nknown error` in the UI (`/fm/?r=/getdir` returning 500). ## Problem In File Manager config, when key is missing, it runs: - `sudo /usr/local/hestia/bin/v-add-user-sftp-key ...` - `sudo chmod o+x /home/<user>/.ssh` But default Hestia sudoers for `hestiaweb` allows only `/usr/local/hestia/bin/*`, so `sudo chmod ...` is denied (`command not allowed`), and SFTP login may fail. ## Changes 1. Removed blocked sudo call from: - `install/deb/filemanager/filegator/configuration.php` - removed `shell_exec("sudo chmod o+x ...")` 2. Moved traversal permission handling into Hestia script: - `bin/v-add-user-sftp-key` - after key creation/ownership: - use `setfacl -m u:hestiaweb:--x "$HOMEDIR/$user/.ssh"` when available - fallback to `chmod o+x "$HOMEDIR/$user/.ssh"` when ACL tool is unavailable ## Why this is safer - Keeps privilege changes inside Hestia-managed scripts (already allowed by sudoers). - Grants minimum traverse permission for `hestiaweb` to reach the FM key path. - Avoids runtime sudo failures from File Manager PHP code. ## Validation - Bash syntax check passed for `v-add-user-sftp-key`. - Runtime verification: SFTP login succeeds with FM key; directory listing works where it previously failed with 500.

sahsanu · July 17, 2026, 9:52am

This is basically a security release so a lot of merges are not included.

jasonwch · July 17, 2026, 9:54am

so i need to patch it manually at this verison? actually is this exposing security issue as SSH folder from user are not 700

sahsanu · July 17, 2026, 9:54am

The risk is minimal.