Fix shell injection in the Zimbra backup and restore scripts

Both scripts built a command string by interpolating user input into
bash -c:

    sudo -u zimbra bash -c "... -m '$EMAIL' ..."

The single quotes inside the double-quoted string are not protection --
the outer shell expands $EMAIL first. An address of

    x' ; id ; echo '

closes the quote and runs arbitrary commands. Both scripts require root
and invoke this through sudo -u zimbra, so injected commands execute as
the account that owns the entire mail store. Verified against the exact
quoting pattern before and after the change.

Fixed by single-quoting the script body so nothing is interpolated, and
passing values as positional arguments. The bash -c wrapper is kept
deliberately rather than calling zmmailbox directly, since it may depend
on shell setup and this could not be tested against a live Zimbra.

Two related holes in the same input paths:

- $EMAIL is also part of the backup filename, so a "/" wrote outside
  $BACKUP_DIR. Now validated as a plain address.
- The restore prompt took a filename and concatenated it into a path, so
  "../../etc/shadow" escaped $BACKUP_DIR. Now rejects anything
  containing a separator.

Also switched the backup listing from `ls | grep "$EMAIL"` to a find
with grep -F: unquoted the address was treated as a regex, so "." in it
matched any character.

zimbra_restore.sh

@@ -35,11 +35,19 @@ fi
 
 # List available backups for that user
 echo "📁 Available backups for $EMAIL:"
-ls "$BACKUP_DIR" | grep "$EMAIL" | grep '\.tgz$'
+# -F: match the address literally. Unquoted it was a regex, so "." in
+# any address matched any character.
+find "$BACKUP_DIR" -maxdepth 1 -type f -name '*.tgz' -printf '%f\n' | grep -F "$EMAIL" || true
 echo
 
 # Prompt for filename
 read -p "Enter the exact filename of the backup to restore (e.g., [email protected]_2024-06-11_10-20-30.tgz): " FILENAME
+# A bare filename only. Without this, "../../etc/shadow" would resolve
+# outside $BACKUP_DIR and be handed to the restore command.
+if [[ "$FILENAME" != "${FILENAME##*/}" || -z "$FILENAME" ]]; then
+    echo "❌ Enter a filename only, not a path: $FILENAME"
+    exit 1
+fi
 FULL_PATH="${BACKUP_DIR}/${FILENAME}"
 
 # Validate file exists
@@ -58,7 +66,11 @@ fi
 
 # Run the restore command as zimbra user
 echo "🔄 Restoring backup..."
-sudo -u zimbra bash -c "/opt/zimbra/bin/zmmailbox -z -m '$EMAIL' postRestURL '/?fmt=tgz&resolve=skip' --file '$FULL_PATH'"
+# Single-quoted body: nothing is interpolated. $EMAIL and $FULL_PATH
+# arrive as positional arguments. Interpolating them (as this line
+# previously did) let shell metacharacters in either value run commands
+# as the zimbra user.
+sudo -u zimbra bash -c '/opt/zimbra/bin/zmmailbox -z -m "$1" postRestURL "/?fmt=tgz&resolve=skip" --file "$2"' _ "$EMAIL" "$FULL_PATH"
 
 # Check result
 if [ $? -eq 0 ]; then