Fixes from the phase-1 code review

- one locking protocol per location: backup steps and restores hold a
  shared lock, prune and untrash an exclusive one and refuse while any
  run (backup, restore, export) exists; starting a backup checks and
  creates the run under the exclusive lock, closing the race with prune
- snapshot entries are validated when read (relative path without '.',
  '..', NUL, backslash or control characters); raw restore also checks
  that the resolved directory stays below the target; the restore API
  and service accept canonical paths only
- recovery kit confirmation requires a recent password confirmation and
  the confirmation code printed in the current kit file (new code per
  kit version), proving the kit was actually downloaded
- prune decides on the authenticated index files on the location and
  refreshes the local index cache from them
- restore job marks the run failed on any error; restore runs without
  progress for 6 hours are failed so they cannot block cleanup forever
- tests for safe paths and a malicious snapshot path

lib/BackgroundJob/BackupJob.php

@@ -47,12 +47,26 @@ class BackupJob extends TimedJob {
 				$run = $this->backups->step($run, min($deadline, microtime(true) + $budget));
 			}
 		}
+		$this->failStaleRestores();
 		$this->weeklyPrune();
 		foreach ($this->targets->list() as $t) {
 			$this->alerts->checkStale($t);
 		}
 	}
 
+	/** A restore run that has not moved for 6 hours is considered dead (it would block cleanup forever). */
+	private function failStaleRestores(): void {
+		foreach ($this->runs->findRunning(null, 'restore') as $run) {
+			if (time() - $run->getUpdatedAt() > 6 * 3600) {
+				$run->setStatus(\OCA\NgBackup\Db\Run::FAILED);
+				$run->setError('No progress for 6 hours; marked as failed');
+				$run->setFinishedAt(time());
+				$this->runs->update($run);
+				$this->alerts->runFailed($run, '#' . $run->getTargetId());
+			}
+		}
+	}
+
 	/** Once a week (after Sunday's backup), apply the retention policy to non-append-only locations. */
 	private function weeklyPrune(): void {
 		$lastWeek = $this->appConfig->getValueString(Application::APP_ID, 'last_prune_week', '');

lib/BackgroundJob/RestoreJob.php

@@ -29,16 +29,22 @@ class RestoreJob extends QueuedJob {
 	}
 
 	protected function run($argument): void {
-		$run = $this->runs->find((int)$argument['run']);
+		$runId = (int)($argument['run'] ?? 0);
+		try {
+			$run = $this->runs->find($runId);
+		} catch (\Throwable $e) {
+			$this->logger->error('NG Backup restore job: run ' . $runId . ' not found', ['exception' => $e]);
+			return;
+		}
 		if ($run->getStatus() !== Run::RUNNING) {
 			return;
 		}
-		$req = json_decode($run->getState(), true, 512, JSON_THROW_ON_ERROR);
-		$run->setPhase('restoring');
-		$run->setUpdatedAt(time());
-		$this->runs->update($run);
-		@set_time_limit(0);
 		try {
+			$req = json_decode($run->getState(), true, 512, JSON_THROW_ON_ERROR);
+			$run->setPhase('restoring');
+			$run->setUpdatedAt(time());
+			$run = $this->runs->update($run);
+			@set_time_limit(0);
 			$result = $this->restore->restoreUserFiles($this->targets->get((string)$run->getTargetId()), $req['snapshot'], $req['path'], $req['mode']);
 			$run->setStatus(Run::DONE);
 			$run->setPhase('done');
@@ -47,7 +53,10 @@ class RestoreJob extends QueuedJob {
 			$this->logger->error('NG Backup restore ' . $run->getId() . ' failed: ' . $e->getMessage(), ['exception' => $e]);
 			$run->setStatus(Run::FAILED);
 			$run->setError($e->getMessage());
-			$this->alerts->runFailed($run, '#' . $run->getTargetId());
+			try {
+				$this->alerts->runFailed($run, '#' . $run->getTargetId());
+			} catch (\Throwable) {
+			}
 		}
 		$run->setFinishedAt(time());
 		$run->setUpdatedAt(time());