fix(file-manager): backport symlink-safe rsync targets to 7.3

[SimonFair]

Summary

This backport brings the File Manager rsync symlink hardening from OS-871 to the 7.3 release branch. It rejects arbitrary symlink components and translates only verified Unraid exclusive-share mappings.

Why This Exists

Rsync 3.5.0 rejects untrusted symlink components in operator-supplied paths. The previous implementation used recursive realpath() resolution, which could hide an attacker-controlled symlink from rsync before its security checks ran. This backport is tracked by OS-872, with the original behavior tracked by OS-871.

Resolution

Walk the destination path component by component with lstat(). Translate only the OS-managed /mnt/user/<share> or /mnt/user0/<share> exclusive-share link after verifying the share state, exact backing target, system.LOCATION, and configured storage. Reject every other symlink component and preserve missing descendants and trailing slashes.

Reviewer Considerations

• This branch contains the same security change as PR fix(file-manager): resolve symlink-backed rsync targets #2745, applied to 7.3.
• The compatibility exception is limited to the known exclusive-share root; arbitrary user-created links are rejected before rsync receives a pre-resolved path.
• Copy and move operations use the same target adapter; source handling and copy/delete behavior are unchanged.
• --insecure-links is not used.
• A live Unraid test is still needed to confirm the exact exclusive-share metadata on the target release.

Behavior Changes

File Manager operations into arbitrary symlink-backed destinations now fail closed. Verified exclusive-share destinations continue to use their physical backing path for rsync.

Implementation Summary

• Replace recursive realpath() target resolution with a component walk.
• Validate and translate only verified exclusive-share links.
• Reject unrecognized symlink destinations.
• Apply the adapter to both copy and move operations.
• Update regression coverage for symlink rejection and call-site wiring.

Verification

• php -l emhttp/plugins/dynamix/nchan/file_manager
• php -l tests/file-manager-rsync-target-path.php
• php tests/file-manager-rsync-target-path.php
• git diff --check

Validation Limits

The local regression test uses a temporary symlink fixture. Full validation of the exclusive-share exception requires an Unraid runtime with state/shares.ini, state/disks.ini, and system.LOCATION metadata.

Risk

Contained; the change fails closed for unknown symlinks and does not disable rsync security checks. The main compatibility risk is intentionally stricter handling of non-system symlink destinations.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 5dd2c7e4-56bb-44c1-88ad-bd6aedf1340a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔧 PR Test Plugin Available

A test plugin has been generated for this PR that includes the modified files.

Version: 2026.09.09.1249
Build: View Workflow Run

📥 Installation Instructions:

Install via Unraid Web UI:

1. Go to Plugins → Install Plugin
2. Copy and paste this URL:

https://preview.dl.unraid.net/pr-plugins/pr-2746/webgui-pr-2746.plg

3. Click Install

Alternative: Direct Download

• 📦 Download PLG
• 📦 Download TXZ

⚠️ Important Notes:

• Testing only: This plugin is for testing PR changes
• Backup included: Original files are automatically backed up
• Easy removal: Files are restored when plugin is removed
• Conflicts: Remove this plugin before installing production updates
• Post-merge behavior: This preview stays available after merge until preview storage expires or it is manually cleaned up

📝 Modified Files:

Click to expand file list

emhttp/plugins/dynamix/nchan/file_manager

🔄 To Remove:

Navigate to Plugins → Installed Plugins and remove webgui-pr-2746, or run:

plugin remove webgui-pr-2746

---

_{🤖 This comment is automatically generated and will be updated with each new push to this PR.}