feat(backups): add rclone-backed FTP/SFTP destination types by lweyrich1 · Pull Request #3788 · Dokploy/dokploy

lweyrich1 · 2026-02-23T20:38:38Z

Summary

Adds small MVP support for additional backup destination types via rclone by introducing FTP and SFTP destination providers.

This keeps the existing destination model and backup flow, but routes upload/list/restore paths through rclone backends based on provider.

Fixes #416

What changed

Added provider options in destination UI:
- FTP (via rclone backend)
- SFTP (via rclone backend)
Updated destination connection test to handle FTP/SFTP (rclone ls :ftp:... / :sftp:...)
Extended backup utils with provider-aware helpers:
- getS3Credentials(...) now returns FTP/SFTP flags when selected
- new getRcloneDestinationBase(...) for provider-aware remote prefixes (:s3:, :ftp:, :sftp:)
Switched backup upload/cleanup/list/restore code paths to use provider-aware destination base
- database backups
- compose backups
- web-server backups
- volume backups
- restore flows
Added tests for new helpers in apps/dokploy/__test__/utils/backups.test.ts
Small README note mentioning FTP/SFTP support via rclone.

How to test locally

Add a destination in Settings -> Destinations using provider FTP or SFTP
- Access Key Id = username
- Secret Access Key = password
- Endpoint = host (for SFTP optionally host:port)
- Bucket = remote base path (e.g. /backups)
Use Test Connection in the UI
Trigger a backup and confirm artifact appears in remote path.

CI / runtime dependency

Requires rclone binary available on the Dokploy host/server (already used by existing S3 backup flows).
For CI environments that run integration tests against real remotes, install via:
- curl https://rclone.org/install.sh | sudo bash

No payment/KYC flow changes, and UI changes are minimal.

Greptile Summary

Added FTP and SFTP backup destination support using rclone backends. Updated destination configuration UI to show context-aware labels (Username/Password for FTP/SFTP vs Access Key/Secret Key for S3). Modified backup and restore flows across all database types to use provider-aware destination paths via new getRcloneDestinationBase() helper.

introduced new provider options in constants.ts for FTP and SFTP
extended getS3Credentials() to return FTP/SFTP-specific rclone flags when those providers are selected
added getRcloneDestinationBase() to build correct remote prefixes (:ftp:, :sftp:, :s3:) based on provider
updated all backup/restore utilities to use the new helpers
enhanced destination test connection to handle FTP/SFTP protocols
added comprehensive test coverage for new helper functions

Critical issue: credentials passed to rclone flags are not escaped, allowing command injection if passwords contain quotes or special shell characters

Confidence Score: 2/5

Not safe to merge due to command injection vulnerability in credential handling
The implementation correctly extends rclone support but has critical command injection vulnerabilities where user-provided credentials (passwords, usernames, hostnames) are directly interpolated into shell commands without proper escaping. A password containing " or $(...) would break the command or execute arbitrary code.
Pay close attention to packages/server/src/utils/backups/utils.ts and apps/dokploy/server/api/routers/destination.ts - these contain the command injection vulnerabilities that must be fixed before merge

_{Last reviewed commit: 382ff6b}

_{(2/5) Greptile learns from your feedback when you react with thumbs up/down!}

greptile-apps

_{22 files reviewed, 6 comments}

_{Edit Code Review Agent Settings | Greptile}

greptile-apps · 2026-02-23T20:42:41Z

packages/server/src/utils/backups/utils.ts

+			`--ftp-host="${endpoint}"`,
+			`--ftp-user="${accessKey}"`,
+			`--ftp-pass="${secretAccessKey}"`,


passwords with special shell characters (quotes, $, backticks) will break commands or enable injection

Suggested change

`--ftp-host="${endpoint}"`,

`--ftp-user="${accessKey}"`,

`--ftp-pass="${secretAccessKey}"`,

`--ftp-host="${endpoint.replace(/"/g, '\\"')}"`,

`--ftp-user="${accessKey.replace(/"/g, '\\"')}"`,

`--ftp-pass="${secretAccessKey.replace(/"/g, '\\"')}"`,

greptile-apps · 2026-02-23T20:42:42Z

packages/server/src/utils/backups/utils.ts

+			`--sftp-host="${host}"`,
+			`--sftp-user="${accessKey}"`,
+			`--sftp-pass="${secretAccessKey}"`,


same injection vulnerability as FTP - passwords need escaping

Suggested change

`--sftp-host="${host}"`,

`--sftp-user="${accessKey}"`,

`--sftp-pass="${secretAccessKey}"`,

`--sftp-host="${host.replace(/"/g, '\\"')}"`,

`--sftp-user="${accessKey.replace(/"/g, '\\"')}"`,

`--sftp-pass="${secretAccessKey.replace(/"/g, '\\"')}"`,

greptile-apps · 2026-02-23T20:42:43Z

apps/dokploy/server/api/routers/destination.ts

+						`--ftp-host="${endpoint}"`,
+						`--ftp-user="${accessKey}"`,
+						`--ftp-pass="${secretAccessKey}"`,


apply same escaping here for test connection to prevent injection

Suggested change

`--ftp-host="${endpoint}"`,

`--ftp-user="${accessKey}"`,

`--ftp-pass="${secretAccessKey}"`,

`--ftp-host="${endpoint.replace(/"/g, '\\"')}"`,

`--ftp-user="${accessKey.replace(/"/g, '\\"')}"`,

`--ftp-pass="${secretAccessKey.replace(/"/g, '\\"')}"`,

greptile-apps · 2026-02-23T20:42:44Z

apps/dokploy/server/api/routers/destination.ts

+						`--sftp-host="${host}"`,
+						`--sftp-user="${accessKey}"`,
+						`--sftp-pass="${secretAccessKey}"`,


apply same escaping for SFTP test connection

Suggested change

`--sftp-host="${host}"`,

`--sftp-user="${accessKey}"`,

`--sftp-pass="${secretAccessKey}"`,

`--sftp-host="${host.replace(/"/g, '\\"')}"`,

`--sftp-user="${accessKey.replace(/"/g, '\\"')}"`,

`--sftp-pass="${secretAccessKey.replace(/"/g, '\\"')}"`,

greptile-apps · 2026-02-23T20:42:45Z

packages/server/src/utils/backups/utils.ts

+	}
+
+	if (provider === "SFTP") {
+		const [host, port] = endpoint.split(":");


endpoint.split(":") will fail if IPv6 address is used (e.g., [::1]:22), consider using lastIndexOf or URL parsing

greptile-apps · 2026-02-23T20:42:46Z

packages/server/src/utils/backups/utils.ts


+export const getRcloneDestinationBase = (destination: Destination) => {
+	if (destination.provider === "FTP") {
+		return `:ftp:${destination.bucket}`;


bucket value should be escaped to prevent path injection if it contains special characters

lweyrich1 · 2026-02-24T18:07:57Z

pushed a small hardening tweak: we now escape user-provided values when building rclone flags (credentials/endpoint/etc). keeps the existing format but avoids shell-breaking chars and reduces injection risk if someone puts weird values in there.

lweyrich1 · 2026-02-24T18:08:05Z

follow-up: my previous comment got mangled by shell backticks. intent: keep existing --flag="..." style (tests expect it), but escape characters (, ", $, `) so credentials/endpoints can’t break the command and it mitigates injection risk.

feat(backups): add rclone ftp/sftp destination support

382ff6b

lweyrich1 requested a review from Siumauricio as a code owner February 23, 2026 20:38

greptile-apps bot reviewed Feb 23, 2026

View reviewed changes

fix: escape rclone flags to avoid shell breakage

78a068b

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Comments

feat(backups): add rclone-backed FTP/SFTP destination types#3788

feat(backups): add rclone-backed FTP/SFTP destination types#3788
lweyrich1 wants to merge 2 commits intoDokploy:canaryfrom
lweyrich1:feat/416-rclone-destination-mvp

lweyrich1 commented Feb 23, 2026 •

edited by greptile-apps bot

Loading

Uh oh!

greptile-apps bot left a comment

Uh oh!

greptile-apps bot Feb 23, 2026

Uh oh!

greptile-apps bot Feb 23, 2026

Uh oh!

greptile-apps bot Feb 23, 2026

Uh oh!

greptile-apps bot Feb 23, 2026

Uh oh!

greptile-apps bot Feb 23, 2026

Uh oh!

greptile-apps bot Feb 23, 2026

Uh oh!

lweyrich1 commented Feb 24, 2026

Uh oh!

lweyrich1 commented Feb 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Comments

Conversation

lweyrich1 commented Feb 23, 2026 • edited by greptile-apps bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What changed

How to test locally

CI / runtime dependency

Greptile Summary

Confidence Score: 2/5

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

lweyrich1 commented Feb 24, 2026

Uh oh!

lweyrich1 commented Feb 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

lweyrich1 commented Feb 23, 2026 •

edited by greptile-apps bot

Loading