From 6faf01ec3c7df3d5456c334405ef4d044313ff73 Mon Sep 17 00:00:00 2001
From: Furox <real.furkannn@gmail.com>
Date: Fri, 4 Sep 2026 23:10:09 +0300
Subject: [PATCH] fix: require TLS for FTP backup destinations

---
 packages/server/src/db/schema/destination.ts | 28 ++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/packages/server/src/db/schema/destination.ts b/packages/server/src/db/schema/destination.ts
index 79342cecf..a0b9a53fd 100644
--- a/packages/server/src/db/schema/destination.ts
+++ b/packages/server/src/db/schema/destination.ts
@@ -64,6 +64,7 @@ const validateDestination = (
 		accessKey?: string;
 		region?: string;
 		endpoint?: string;
+		additionalFlags?: string[];
 	},
 	ctx: z.RefinementCtx,
 ) => {
@@ -108,6 +109,33 @@ const validateDestination = (
 			}
 		}
 	}
+
+	if (data.provider === RCLONE_DESTINATION_PROVIDERS.FTP) {
+		const flags = data.additionalFlags ?? [];
+		const implicitTlsEnabled =
+			(flags.includes("--ftp-tls") || flags.includes("--ftp-tls=true")) &&
+			!flags.includes("--ftp-tls=false");
+		const explicitTlsEnabled =
+			(flags.includes("--ftp-explicit-tls") ||
+				flags.includes("--ftp-explicit-tls=true")) &&
+			!flags.includes("--ftp-explicit-tls=false");
+
+		if (!implicitTlsEnabled && !explicitTlsEnabled) {
+			ctx.addIssue({
+				code: "custom",
+				path: ["additionalFlags"],
+				message:
+					"FTP destinations must use TLS. Add --ftp-explicit-tls for port 21 or --ftp-tls for implicit FTPS (usually port 990).",
+			});
+		}
+		if (implicitTlsEnabled && explicitTlsEnabled) {
+			ctx.addIssue({
+				code: "custom",
+				path: ["additionalFlags"],
+				message: "Choose either implicit FTPS or explicit FTPS, not both.",
+			});
+		}
+	}
 };
 
 export const apiCreateDestination = createSchema