fix: Optimize TGT LUN params for passthrough

web-ui/api.php

@@ -325,17 +325,20 @@ function addLun($params) {
         return;
     }
 
-    // Determine backing store type (simplify to just bstype)
+    // For generic SCSI devices (sg), we MUST specify bstype=sg AND device-type=pt (passthrough)
     $bstypeParam = '';
-    if (strpos($device, '/dev/sg') === 0) {
-        $bstypeParam = '--bstype sg'; 
+    
+    // Validate device path strictly to avoid needing escapeshellarg (which adds quotes that might confuse tgtadm parsing in some versions)
+    // Regex allows /dev/sg0-999 or /dev/st0-999 or /dev/nst0-999
+    if (preg_match('#^/dev/(sg|st|nst)[0-9]+$#', $device)) {
+        $bstypeParam = '--bstype sg --device-type pt';
     }
 
     $command = sprintf(
         'sudo /usr/sbin/tgtadm --lld iscsi --mode logicalunit --op new --tid %d --lun %d --backing-store %s %s 2>&1',
         $tid,
         $lun,
-        escapeshellarg($device),
+        $device, // Safe to use raw because we validated usage above or in previous regex check
         $bstypeParam
     );