chore(deps): update drakkan/sftpgo docker tag to v2.6.4

[renovate]

This PR contains the following updates:

Package	Update	Change
drakkan/sftpgo	patch	v2.6.2-alpine -> v2.6.4-alpine

---

Release Notes

drakkan/sftpgo (drakkan/sftpgo)

v2.6.4

Compare Source

Bug Fixes

• OIDC session cookie: use a cryptographically secure opaque random string, as we already do in all other security-sensitive code in SFTPGo. CVE-2024-52801. Thanks to @​denisvr72 for reporting.
• EventManager: fix connection leak when performing file operations on a third-party SFTP server, for example, to copy a file to another SFTP server after an upload.

CI

• Switch to Azure Trusted Signing to sign Windows binaries.

v2.6.3

Compare Source

New features

• EventManager: system commands are disabled by default and an allow list has been added to explicitly define which ones are allowed. CVE-2024-52309. Thanks to @​hyperreality for reporting.
• EventManager: add {{EscapedVirtualPath}} placeholder.
• EventManager: add {{DateTime}} placeholder.

Bug Fixes

• WebAdmin: check CSRF header when deleting blocked hosts in the same way we already do for all other state-changing endpoints.
• WebAdmin: correctly display multiple active connections for the same session.
• WebClient: improve readability of upload progress.
• Plugins: fix passing additional environment variables.

Backward incompatible changes

If you rely on EventManager to execute system commands, you should add the commands to the allowed list like this:

SFTPGO_COMMON__EVENT_MANAGER__ENABLED_COMMANDS="/bin/command1,/usr/bin/command2"

The following admin permissions have been removed:

• manage_admins
• manage_apikeys
• manage_system
• retention_checks
• manage_event_rules
• manage_roles
• manage_ip_lists

Now you need to add the * permission to replace the removed granular permissions because the removed permissions allow actions that should only be allowed to super administrators.
For example, you can define an administrator with the manage_system permission and not with the manage_admins or manage_user permission, but the manage_system permission allows you to restore a backup and then create users and administrators.
There is no point in having separate, overlapping permissions.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.