Fixes from a full QA and security review
Security
- Restored guest files keep their permissions. Files restored from VM backups (ext4/XFS inside Proxmox, ESXi/vCenter and Hyper-V VMs) were written readable for everyone on the target machine — a restored
/etc/shadowor private key could be read by any local user. They now keep the permissions they had in the VM; files from NTFS volumes are readable only by the owner. - Enabling and disabling a job is recorded in the audit log (the API already did; the console did not). Disabling an unknown job now answers "not found".
- Sign-out cookies carry the same Secure/HttpOnly/SameSite flags as the session cookie.
VMware
- Accept a changed host certificate. When vCenter takes over an ESXi host it replaces the host's certificate, and BackupZit (correctly) refuses to connect to a host that is added directly. The Agents page now shows the new fingerprint with an Accept the new certificate button; before, the only way was to remove and re-add the host.
Other
- Guide search no longer fails on Turkish text (the letter İ changes its length when lowercased).
- Proxmox restores and replicas no longer offer the temporary instant-recovery storage
backupzit-instantas a target. - Removed unused code found by staticcheck.
Checked with: full QA on the lab (all 19 job types backed up; restores from SFTP, MinIO, MinIO with Object Lock, SMB, Azure, hardened repository, NFS/SMB NAS, Windows files, Linux system, Proxmox VM and instant recovery, Hyper-V VM, PostgreSQL, MariaDB, vCenter guest files; roles, LDAP, API, reports, notifications), govulncheck, staticcheck, gosec, Semgrep, Trivy, Gitleaks, an authenticated OWASP ZAP scan (no high findings), nmap and OpenVAS.
Update the console and then the agents (Agents → Update all) — the permission fix runs in the agents.
Releases are signed with the BackupZit release key; consoles verify them before installing.
