Index: authorize.php
===================================================================
RCS file: authorize.php
diff -N authorize.php
--- /dev/null	1 Jan 1970 00:00:00 -0000
+++ authorize.php	14 Oct 2009 00:46:48 -0000
@@ -0,0 +1,154 @@
+<?php
+// $Id$
+
+/**
+ * @file
+ * Administrative script where the site owner (the user actually owning the
+ * files on the webserver) can authorize certain file-related operations to
+ * proceed with elevated privileges, for example to deploy and upgrade modules
+ * or themes. Users should not visit this page directly, but instead use an
+ * administrative user interface which knows how to redirect the user to this
+ * script as part of a multistep process. This script actually performs the
+ * selected operations without loading all of Drupal, to be able to more
+ * gracefully recover from errors. Access to the script is controlled by a
+ * global killswitch in settings.php ('allow_authorize_operations') and via
+ * the 'administer software updates' permission.
+ */
+
+/**
+ * Root directory of Drupal installation.
+ */
+define('DRUPAL_ROOT', getcwd());
+
+/**
+ * Global flag to identify update.php and authorize.php runs, and so
+ * avoid various unwanted operations, such as hook_init() and
+ * hook_exit() invokes, css/js preprocessing and translation, and
+ * solve some theming issues. This flag is checked on several places
+ * in Drupal code (not just authorize.php).
+ */
+define('MAINTENANCE_MODE', 'update');
+
+/**
+ * Render a 403 access denied page for authorize.php
+ */
+function authorize_access_denied_page() {
+  drupal_add_http_header('403 Forbidden');
+  watchdog('access denied', 'authorize.php', NULL, WATCHDOG_WARNING);
+  drupal_set_title('Access denied');
+  return t("You are not allowed to access this page.");
+}
+
+/**
+ * Determine if the current user is allowed to run authorize.php.
+ *
+ * The killswitch in settings.php overrides all else, otherwise, the user must
+ * have access to the 'administer software updates' permission.
+ *
+ * @return
+ *   TRUE if the current user can run authorize.php, otherwise FALSE.
+ */
+function authorize_access_allowed() {
+  return variable_get('allow_authorize_operations', TRUE) && user_access('administer software updates');
+}
+
+// *** Real work of the script begins here. ***
+
+require_once DRUPAL_ROOT . '/includes/bootstrap.inc';
+require_once DRUPAL_ROOT . '/includes/session.inc';
+require_once DRUPAL_ROOT . '/includes/common.inc';
+require_once DRUPAL_ROOT . '/includes/file.inc';
+require_once DRUPAL_ROOT . '/includes/module.inc';
+
+// We prepare only a minimal bootstrap. This includes the database and
+// variables, however, so we have access to the class autoloader registry.
+drupal_bootstrap(DRUPAL_BOOTSTRAP_SESSION);
+
+// This must go after drupal_bootstrap(), which unsets globals!
+global $conf;
+
+// We have to enable the user and system modules, even to check access and
+// display errors via the maintainence theme.
+$module_list['system']['filename'] = 'modules/system/system.module';
+$module_list['user']['filename'] = 'modules/user/user.module';
+module_list(TRUE, FALSE, FALSE, $module_list);
+drupal_load('module', 'system');
+drupal_load('module', 'user');
+
+// We also want to have the language system available, but we do *NOT* want to
+// actually call drupal_bootstrap(DRUPAL_BOOTSTRAP_LANGUAGE), since that would
+// also force us through the DRUPAL_BOOTSTRAP_PAGE_HEADER phase, which loads
+// all the modules, and that's exactly what we're trying to avoid.
+drupal_language_initialize();
+
+// Initialize the maintenance theme for this administrative script.
+drupal_maintenance_theme();
+
+$output = '';
+$show_messages = TRUE;
+
+if (authorize_access_allowed()) {
+  // Load both the Form API and Batch API.
+  require_once DRUPAL_ROOT . '/includes/form.inc';
+  require_once DRUPAL_ROOT . '/includes/batch.inc';
+  // Load the code that drives the authorize process.
+  require_once DRUPAL_ROOT . '/includes/authorize.inc';
+
+  // Initialize the URL path, but not via raising our bootstrap level.
+  drupal_path_initialize();
+
+  drupal_set_title(t('Authorize file system changes'));
+
+  // See if we've run the operation and need to display a report.
+  if (isset($_SESSION['authorize_results']) && $results = $_SESSION['authorize_results']) {
+
+    // Clear the session out.
+    unset($_SESSION['authorize_results']);
+    unset($_SESSION['authorize_operation']);
+    unset($_SESSION['authorize_filetransfer_backends']);
+
+    if (!empty($results['page_title'])) {
+      drupal_set_title(check_plain($results['page_title']));
+    }
+    if (!empty($results['page_message'])) {
+      drupal_set_message($results['page_message']['message'], $results['page_message']['type']);
+    }
+
+    $output = theme('authorize_report', array('messages' => $results['messages']));
+    
+    $links = array();
+    if (is_array($results['tasks'])) {
+      $links += $results['tasks'];
+    }
+
+    $links = array_merge($links, array(
+      l(t('Administration pages'), 'admin'),
+      l(t('Front page'), '<front>'),
+    ));
+
+    $output .= theme('item_list', array('items' => $links));
+  }
+  // If a batch is running, let it run.
+  elseif (isset($_GET['batch'])) {
+    $output = _batch_page();
+  }
+  else {
+    if (empty($_SESSION['authorize_operation']) || empty($_SESSION['authorize_filetransfer_backends'])) {
+      $output = t("It appears you have reached this page in error.");
+    }
+    elseif (!$batch = batch_get()) {
+      // We have a batch to process, show the filetransfer form.
+      $output = drupal_render(drupal_get_form('authorize_filetransfer_form'));
+    }
+  }
+  // We defer the display of messages until all operations are done.
+  $show_messages = !(($batch = batch_get()) && isset($batch['running']));
+}
+else {
+  $output = authorize_access_denied_page();
+}
+
+if (!empty($output)) {
+  print theme('update_page', array('content' => $output, 'show_messages' => $show_messages));
+}
+
cvs diff: Diffing includes
Index: includes/authorize.inc
===================================================================
RCS file: includes/authorize.inc
diff -N includes/authorize.inc
--- /dev/null	1 Jan 1970 00:00:00 -0000
+++ includes/authorize.inc	14 Oct 2009 06:37:27 -0000
@@ -0,0 +1,232 @@
+<?php
+// $Id$
+
+/**
+ * @file
+ * Helper functions and form handlers used for the authorize.php script.
+ */
+
+/**
+ * Build the form for choosing a FileTransfer type and supplying credentials.
+ */
+function authorize_filetransfer_form($form_state) {
+  global $base_url;
+  $form = array();
+
+  $form['#action'] = $base_url . '/authorize.php';
+  // CSS we depend on lives in modules/system/maintenance.css, which is loaded
+  // via the default maintenance theme.
+  $form['#attached']['js'][] = $base_url . '/misc/authorize.js';
+  
+  // Get all the available ways to transfer files.
+  if (empty($_SESSION['authorize_filetransfer_backends'])) {
+    drupal_set_message(t('Unable to continue, no available methods of file transfer'), 'error');
+    return array();
+  }
+  $available_backends = $_SESSION['authorize_filetransfer_backends'];
+  uasort($available_backends, 'drupal_sort_weight');
+
+  // Decide on a default backend.
+  if (isset($form_state['values']['connection_settings']['authorize_filetransfer_default'])) {
+    $authorize_filetransfer_default = $form_state['values']['connection_settings']['authorize_filetransfer_default'];
+  }
+  elseif ($authorize_filetransfer_default = variable_get('authorize_filetransfer_default', NULL));
+  else {
+    $authorize_filetransfer_default = key($available_backends);
+  }
+
+  $form['information']['main_header'] = array(
+    '#prefix' => '<h3>',
+    '#markup' => t('To continue please provide your server connection details'),
+    '#suffix' => '</h3>',
+  );
+
+  $form['connection_settings']['#tree'] = TRUE;
+  $form['connection_settings']['authorize_filetransfer_default'] = array(
+    '#type' => 'select',
+    '#title' => t('Connection method'),
+    '#default_value' => $authorize_filetransfer_default,
+    '#weight' => -10,
+  );
+
+  /*
+   * Here we create two submit buttons. For a JS enabled client, they will
+   * only ever see submit_process. However, if a client doesn't have JS
+   * enabled, they will see submit_connection on the first form (whden picking
+   * what filetranfer type to use, and submit_process on the second one (which
+   * leads to the actual operation)
+   */
+  $form['submit_connection'] = array(
+    '#prefix' => "<br style='clear:both'/>",
+    '#name' => 'enter_connection_settings', // This is later changed in JS.
+    '#type' => 'submit',
+    '#value' => t('Enter connetion settings'), // As is this. @see authorize.js.
+    '#weight' => 100,
+  );
+
+  $form['submit_process'] = array(
+    '#name' => 'process_updates', // This is later changed in JS.
+    '#type' => 'submit',
+    '#value' => t('Process Updates'), // As is this. @see authorize.js
+    '#weight' => 100,
+    '#attributes' => array('style' => 'display:none'),
+  );
+
+  // Build a hidden fieldset for each one.
+  foreach ($available_backends as $name => $backend) {
+    $form['connection_settings']['authorize_filetransfer_default']['#options'][$name] = $backend['title'];
+    $form['connection_settings'][$name] = array(
+      '#type' => 'fieldset',
+      '#attributes' => array('class' => "filetransfer-$name filetransfer"),
+      '#title' => t('@backend connection settings', array('@backend' => $backend['title'])),
+    );
+
+    $current_settings = variable_get("authorize_filetransfer_connection_settings_" . $name, array());
+    $form['connection_settings'][$name] += system_get_filetransfer_settings_form($name, $current_settings);
+
+    // Start non-JS code.
+    if (isset($form_state['values']['connection_settings']['authorize_filetransfer_default']) && $form_state['values']['connection_settings']['authorize_filetransfer_default'] == $name) {
+
+      // If the user switches from JS to non-JS, Drupal (and Batch API) will
+      // barf. This is a known bug: http://drupal.org/node/229825.
+      setcookie('has_js', '', time() - 3600, '/');
+      unset($_COOKIE['has_js']);
+
+      // Change the submit button to the submit_process one.
+      $form['submit_process']['#attributes'] = array();
+      unset($form['submit_connection']);
+
+      // Activate the proper filetransfer settings form.
+      $form['connection_settings'][$name]['#attributes']['style'] = 'display:block';
+      // Disable the select box.
+      $form['connection_settings']['authorize_filetransfer_default']['#disabled'] = TRUE;
+
+      // Create a button for changing the type of connection.
+      $form['connection_settings']['change_connection_type'] = array(
+        '#name' => 'change_connection_type',
+        '#type' => 'submit',
+        '#value' => t('Change connection type'),
+        '#weight' => -5,
+        '#attributes' => array('class' => 'filetransfer-change-connection-type'),
+      );
+    }
+    // End non-JS code.
+  }
+  return $form;
+}
+
+/**
+ * Validate callback for the filetransfer authorization form.
+ *
+ * @see authorize_filetransfer_form()
+ */
+function authorize_filetransfer_form_validate($form, &$form_state) {
+  if (isset($form_state['values']['connection_settings'])) {
+    $backend = $form_state['values']['connection_settings']['authorize_filetransfer_default'];
+    $filetransfer = authorize_get_filetransfer($backend, $form_state['values']['connection_settings'][$backend]);
+    try {
+      if (!$filetransfer) {
+        throw new Exception(t("Error, this type of connection protocol (%backend) doesn't exist.", array('%backend' => $backend)));
+      }
+      $filetransfer->connect();
+    }
+    catch (Exception $e) {
+      form_set_error('connection_settings', $e->getMessage());
+    }
+  }
+}
+
+/**
+ * Submit callback when a file transfer is being authorized.
+ *
+ * @see authorize_filetransfer_form()
+ */
+function authorize_filetransfer_form_submit($form, &$form_state) {
+  global $base_url;
+  switch ($form_state['clicked_button']['#name']) {
+    case 'process_updates':
+
+      // Save the connection settings to the DB.
+      $filetransfer_backend = $form_state['values']['connection_settings']['authorize_filetransfer_default'];
+
+      // If the database is available then try to save our settings. We have
+      // to make sure it is available since this code could potentially (will
+      // likely) be called during the installation process, before the
+      // database is set up.
+      if (db_is_active()) {
+        $connection_settings = array();
+        foreach ($form_state['values']['connection_settings'][$filetransfer_backend] as $key => $value) {
+          // We do *not* want to store passwords in the database, unless the
+          // backend explicitly says so via the magic #filetransfer_save form
+          // property. Otherwise, we store everything that's not explicitly
+          // marked with #filetransfer_save set to FALSE.
+          if (!isset($form['connection_settings'][$filetransfer_backend][$key]['#filetransfer_save'])) {
+            if ($form['connection_settings'][$filetransfer_backend][$key]['#type'] != 'password') {
+              $connection_settings[$key] = $value;
+            }
+          }
+          // The attribute is defined, so only save if set to TRUE.
+          elseif ($form['connection_settings'][$filetransfer_backend][$key]['#filetransfer_save']) {
+            $connection_settings[$key] = $value;
+          }
+        }
+        // Set this one as the default authorize method.
+        variable_set('authorize_filetransfer_default', $filetransfer_backend);
+        // Save the connection settings minus the password.
+        variable_set("authorize_filetransfer_connection_settings_" . $filetransfer_backend, $connection_settings);
+
+        $filetransfer = authorize_get_filetransfer($filetransfer_backend, $form_state['values']['connection_settings'][$filetransfer_backend]);
+        
+        // Now run the operation.
+        authorize_run_operation($filetransfer);
+      }
+      break;
+
+    case 'enter_connection_settings':
+      $form_state['rebuild'] = TRUE;
+      break;
+
+    case 'change_connection_type':
+      $form_state['rebuild'] = TRUE;
+      unset($form_state['values']['connection_settings']['authorize_filetransfer_default']);
+      break;
+  }
+}
+
+/**
+ * Run the batch operation specified in $_SESSION['authorize_operation']
+ *
+ * @param $filetransfer
+ *   The FileTransfer object to use for running the operation.
+ */
+function authorize_run_operation($filetransfer) {
+  $operation = $_SESSION['authorize_operation'];
+  unset($_SESSION['authorize_operation']);
+
+  if (!empty($operation['page_title'])) {
+    drupal_set_title(check_plain($operation['page_title']));
+  }
+
+  require_once DRUPAL_ROOT . '/' . $operation['file'];
+  call_user_func_array($operation['callback'], array_merge(array($filetransfer), $operation['arguments']));
+}
+
+/**
+ * Get a FileTransfer class for a specific transfer method and settings.
+ *
+ * @param $backend
+ *   The FileTransfer backend to get the class for.
+ * @param $settings
+ *   Array of settings for the FileTransfer.
+ * @return
+ *   An instantiated FileTransfer object for the requested method and settings,
+ *   or FALSE if there was an error finding or instantiating it.
+ */
+function authorize_get_filetransfer($backend, $settings = array()) {
+  $filetransfer = FALSE;
+  if (!empty($_SESSION['authorize_filetransfer_backends'][$backend])) {
+    $filetransfer = call_user_func_array(array($_SESSION['authorize_filetransfer_backends'][$backend]['class'], 'factory'), array(DRUPAL_ROOT, $settings));
+  }
+  return $filetransfer;
+}
+
Index: includes/common.inc
===================================================================
RCS file: /Users/wright/drupal/local_repo/drupal/includes/common.inc,v
retrieving revision 1.1017
diff -u -p -r1.1017 common.inc
--- includes/common.inc	13 Oct 2009 21:16:42 -0000	1.1017
+++ includes/common.inc	14 Oct 2009 06:57:52 -0000
@@ -4851,23 +4851,10 @@ function drupal_common_theme() {
       'arguments' => array('page' => NULL),
       'template' => 'page',
     ),
-    'maintenance_page' => array(
-      'arguments' => array('content' => NULL, 'show_messages' => TRUE),
-      'template' => 'maintenance-page',
-    ),
-    'update_page' => array(
-      'arguments' => array('content' => NULL, 'show_messages' => TRUE),
-    ),
-    'install_page' => array(
-      'arguments' => array('content' => NULL),
-    ),
     'region' => array(
       'arguments' => array('elements' => NULL),
       'template' => 'region',
     ),
-    'task_list' => array(
-      'arguments' => array('items' => NULL, 'active' => NULL),
-    ),
     'status_messages' => array(
       'arguments' => array('display' => NULL),
     ),
@@ -4922,6 +4909,26 @@ function drupal_common_theme() {
     'indentation' => array(
       'arguments' => array('size' => 1),
     ),
+    // from theme.maintenance.inc
+    'maintenance_page' => array(
+      'arguments' => array('content' => NULL, 'show_messages' => TRUE),
+      'template' => 'maintenance-page',
+    ),
+    'update_page' => array(
+      'arguments' => array('content' => NULL, 'show_messages' => TRUE),
+    ),
+    'install_page' => array(
+      'arguments' => array('content' => NULL),
+    ),
+    'task_list' => array(
+      'arguments' => array('items' => NULL, 'active' => NULL),
+    ),
+    'authorize_message' => array(
+      'arguments' => array('message' => NULL, 'success' => TRUE),
+    ),
+    'authorize_report' => array(
+      'arguments' => array('messages' => array()),
+    ),
     // from pager.inc
     'pager' => array(
       'arguments' => array('tags' => array(), 'element' => 0, 'parameters' => array(), 'quantity' => 9),
@@ -5797,3 +5804,25 @@ function xmlrpc($url) {
   return call_user_func_array('_xmlrpc', $args);
 }
 
+/**
+ * Drupal Updater registry.
+ *
+ * An Updater is a class that knows how to update various parts of the Drupal
+ * file system, for example to update modules that have newer releases, or to
+ * install a new theme.
+ *
+ * @return
+ *   Returns the Drupal Updater class registry.
+ *
+ * @see hook_updater_info()
+ * @see hook_updater_info_alter()
+ */
+function drupal_get_updaters() {
+  $updaters = &drupal_static(__FUNCTION__);
+  if (!isset($updaters)) {
+    $updaters = module_invoke_all('updater_info');
+    drupal_alter('updater_info', $updaters);
+  }
+  return $updaters;
+}
+
Index: includes/theme.maintenance.inc
===================================================================
RCS file: /Users/wright/drupal/local_repo/drupal/includes/theme.maintenance.inc,v
retrieving revision 1.42
diff -u -p -r1.42 theme.maintenance.inc
--- includes/theme.maintenance.inc	9 Oct 2009 00:59:54 -0000	1.42
+++ includes/theme.maintenance.inc	14 Oct 2009 07:48:46 -0000
@@ -202,3 +202,48 @@ function theme_update_page($variables) {
 
   return theme_render_template('themes/garland/maintenance-page.tpl.php', $variables);
 }
+
+/**
+ * Generate a report of the results from an operation run via authorize.php.
+ *
+ * @param array $variables
+ *   - messages: An array of result messages.
+ */
+function theme_authorize_report($variables) {
+  $messages = $variables['messages'];
+  $output = '';
+  if (!empty($messages)) {
+    $output .= '<div id="authorize-results">';
+    foreach ($messages as $heading => $logs) {
+      $output .= '<h3>' . check_plain($heading) . '</h3>';
+      foreach ($logs as $number => $log_message) {
+        if ($number === '#abort') {
+          continue;
+        }
+        $output .= theme('authorize_message', array('message' => $log_message['message'], 'success' => $log_message['success']));
+      }
+    }
+    $output .= '</div>';
+  }
+  return $output;
+}
+
+/**
+ * Render a single log message from the authorize.php batch operation.
+ *
+ * @param $variables
+ *   - message: The log message.
+ *   - success: A boolean indicating failure or success.
+ */
+function theme_update_plugin_manager_message($variables) {
+  $output = '';
+  $message = $variables['message'];
+  $success = $variables['success'];
+  if ($success) {
+    $output .= '<li class="success">' . check_plain($message) . '</li>';
+  }
+  else {
+    $output .= '<li class="failure"><strong>' . t('Failed') . ':</strong> ' . $message . '</li>';
+  }
+  return $output;
+}
Index: includes/updater.inc
===================================================================
RCS file: includes/updater.inc
diff -N includes/updater.inc
--- /dev/null	1 Jan 1970 00:00:00 -0000
+++ includes/updater.inc	13 Oct 2009 22:25:45 -0000
@@ -0,0 +1,322 @@
+<?php
+// $Id$
+
+/**
+ * @file
+ * Classes used for updating various files in the Drupal webroot. These
+ * classes use a FileTransfer object to actually perform the operations.
+ * Normally, the FileTransfer is provided when the site owner is redirected to
+ * authorize.php as part of a multistep process.
+ */
+ 
+/**
+ * Interface for a class which can update a Drupal project.
+ *
+ * An Updater currently serves the following purposes:
+ *   - It can take a given directory, and determine if it can operate on it.
+ *   - It can move the contents of that directoy into the appropriate place
+ *     on the system using FileTransfer classes.
+ *   - It can return a list of "next steps" after an update or install.
+ *   - In the future, it will most likely perform some of those steps as well.
+ */
+interface DrupalUpdaterInterface {
+
+  /**
+   * Checks if the project is installed.
+   * @return bool
+   */
+  public function isInstalled();
+
+  /**
+   * Returns the system name of the project.
+   * 
+   * @param string $directory
+   *  A directory containing a project.
+   */
+  public static function getProjectName($directory);
+
+  /**
+   * @return string an absolute path to the default install location.
+   */
+  public static function getInstallDirectory();
+
+  /**
+   * Determine if the Updater can handle the project provided in $directory.
+   *
+   * @todo: Provide something more rational here, like a project spec file.
+   *
+   * @param string $directory
+   *
+   * @return bool
+   */
+  public static function canUpdateDirectory($directory);
+
+  /**
+   * Actions to run after an install has occurred.
+   */
+  function postInstall();
+
+  /**
+   * Actions to run after an update has occurred.
+   */
+  function postUpdate();
+}
+
+/**
+ * Base class for Updaters used in Drupal.
+ */
+class Updater {
+
+  /**
+   * @var string $source Directory to install from.
+   */
+  public $source;
+  
+  function __construct($source) {
+    $this->source = $source;
+    $this->name = self::getProjectName($source);
+    $this->title = self::getProjectTitle($source);
+  }
+
+  /**
+   * Return an Updater of the appropriate type depending on the source.
+   *
+   * If a directory is provided which contains a module, will return a
+   * ModuleUpdater.
+   *
+   * @param string $source
+   *   Directory of a Drupal project.
+   * 
+   * @return object Updater
+   */
+  static function factory($source) {
+    if (is_dir($source)) {
+      $updater = self::getUpdaterFromDirectory($source);
+    }
+    else {
+      throw new UpdaterError('Unable to determine the type of the source directory');
+    }
+    return new $updater($source);
+  }
+
+  /**
+   * Determine which Updater class can operate on the given directory.
+   * 
+   * @param string $directory
+   *   Extracted Drupal project.
+   * @return string
+   *   The class name which can work with this project type.
+   */
+  static function getUpdaterFromDirectory($directory) {
+    // Gets a list of possible implementing classes
+    $updaters = drupal_get_updaters();
+    foreach ($updaters as $updater) {
+      $class = $updater['class'];
+      if (call_user_func("{$class}::canUpdateDirectory", $directory)) {
+        return $class;
+      }
+    }
+    throw new UpdaterError("Cannot determine the type of project");
+  }
+
+  /**
+   * Figure out what the most important (or only) info file is in a directory.
+   * 
+   * Since there is no enforcement of which info file is the project's "main"
+   * info file, this will get one with the same name as the directory, or the
+   * first one it finds.  Not ideal, but needs a larger solution.
+   *
+   * @param string $directory
+   *   Directory to search in.
+   * @return string
+   *   Path to the info file.
+   */
+  public static function findInfoFile($directory) {
+    $info_files = file_scan_directory($directory, '/.*\.info/');
+    if (!$info_files) {
+      return FALSE;
+    }
+    foreach ($info_files as $info_file) {
+      if (drupal_substr($info_file->filename, 0, -5) == basename($directory)) {
+        // Info file Has the same name as the directory, return it.
+        return $info_file->uri;
+      }
+    }
+    // Otherwise, return the first one.
+    $info_file = array_shift($info_files);
+    return $info_file->uri;
+  }
+
+  /**
+   * Get the name of the project directory (basename).
+   *
+   * @todo: It would be nice, if projects contained an info file which could
+   *        provide their canonical name.
+   * 
+   * @param string $directory
+   * @return string
+   */
+  public static function getProjectName($directory) {
+    return basename($directory);
+  }
+
+  /**
+   * Return the project name from a Drupal info file.
+   *
+   * @param string $directory
+   *   Directory to search for the info file.
+   * @return string
+   */
+  public static function getProjectTitle($directory) {
+    $info_file = self::findInfoFile($directory);
+    $info = drupal_parse_info_file($info_file);
+    if (!$info) {
+      //@TODO: Add the variables, t(), etc
+      throw new UpdaterError("Unable to parse info file");
+    }
+    return $info['name'];
+  }
+
+  /**
+   * Store the default parameters for the Updater.
+   *
+   * @param array $overrides
+   *   An array of overrides for the default parameters.
+   * @return array
+   *   An array of configuration parameters for an update or install operation.
+   */
+  private function getInstallArgs($overrides = array()) {
+    $args = array(
+      'make_backup' => FALSE,
+      'install_dir' => $this->getInstallDirectory(),
+      'backup_dir'  => $this->getBackupDir(),
+    );
+    return array_merge($args, $overrides);
+  }
+
+  /**
+   * Updates a Drupal project, returns a list of next actions.
+   *
+   * @param FileTransfer $ft
+   *   Object which is a child of FileTransfer. Used for moving files
+   *   to the server.
+   * @param array $overrides
+   *   An array of settings to override defaults
+   *   @see self::getInstallArgs
+   * @return array
+   *   An array of links which the user may need to complete the update
+   */
+  public function update(&$ft, $overrides = array()) {
+    try {
+      // Establish arguments with possible overrides.
+      $args = $this->getInstallArgs($overrides);
+
+      // Take a Backup.
+      if ($args['make_backup']) {
+        $this->makeBackup($args['install_dir'], $args['backup_dir']);
+      }
+      
+      if (!$this->name) {
+        // This is bad, don't want to delete the install directory.
+        throw new UpdaterError("Fatal error in update, cowardly refusing to wipe out the install directory");
+      }
+
+      // Note: If the project is installed in sites/all, it will not be
+      // deleted. It will be installed in sites/default as that will override
+      // the sites/all reference and not break other sites which are using it.
+      if (is_dir($args['install_dir'] . '/' . $this->name)) {
+        // Remove the existing installed file.
+        $ft->removeDirectory($args['install_dir'] . '/' . $this->name);
+      }
+
+      // Copy the directory in place.
+      $ft->copyDirectory($this->source, $args['install_dir']);
+      plugin_make_world_executable($ft, $args['install_dir'] . '/' . $this->name);
+      // Run the updates.
+      // @TODO: decide if we want to implement this.
+      $this->postUpdate();
+      // For now, just return a list of links of things to do.
+      return $this->postUpdateTasks();
+    }
+    catch (FileTransferException $e) {
+      throw new UpdaterError(t("File Transfer failed, reason: !reason", array('!reason' => t($e->getMessage(), $e->arguments))));
+    }
+  }
+
+  /**
+   * Installs a Drupal project, returns a list of next actions.
+   *
+   * @param FileTransfer $ft
+   *   Object which is a child of FileTransfer.
+   * @param array $overrides
+   *   An array of settings to override defaults.
+   *   @see self::getInstallArgs
+   * @return array
+   *   An array of links which the user may need to complete the install.
+   */
+  public function install(&$ft, $overrides = array()) {
+    try {
+      // Establish arguments with possible overrides.
+      $args = $this->getInstallArgs($overrides);
+      // Copy the directory in place.
+      $ft->copyDirectory($this->source, $args['install_dir']);
+      plugin_make_world_executable($ft, $args['install_dir'] . '/' . $this->name);
+      // Potentially enable something?
+      // @TODO: decide if we want to implement this.
+      $this->postInstall();
+      // For now, just return a list of links of things to do.
+      return $this->postInstallTasks();
+    }
+    catch (FileTransferException $e) {
+      throw new UpdaterError(t("File Transfer failed, reason: !reason", array('!reason' => t($e->getMessage(), $e->arguments))));
+    }
+  }
+
+  function makeBackup(&$ft, $from, $to) {
+    //@TODO: Not implemented
+  }
+
+  function getBackupDir() {
+    return file_directory_path('temporary');
+  }
+
+  /**
+   * Needs to be overridden by children to work
+   * Actions to take after the update is complete.
+   */
+  function postUpdate() {
+
+  }
+
+  /**
+   * Needs to be overridden by children to work
+   * Actions to take after the install is complete.
+   */
+  function postInstall() {
+
+  }
+
+  /**
+   * Returns an array of links to pages that should be visited post operation.
+   *
+   * @return array
+   *   Links which provide actions to take after the install is finished.
+   */
+  function postInstallTasks() {
+    return array();
+  }
+
+  /**
+   * Returns an array of links to pages that should be visited post operation.
+   *
+   * @return array
+   *   Links which provide actions to take after the update is finished.
+   */
+  function postUpdateTasks() {
+    return array();
+  }
+}
+
+class UpdaterError extends Exception {
+  
+}
cvs diff: Diffing includes/database
cvs diff: Diffing includes/database/mysql
cvs diff: Diffing includes/database/pgsql
cvs diff: Diffing includes/database/sqlite
cvs diff: Diffing includes/filetransfer
Index: includes/filetransfer/ftp.inc
===================================================================
RCS file: /Users/wright/drupal/local_repo/drupal/includes/filetransfer/ftp.inc,v
retrieving revision 1.6
diff -u -p -r1.6 ftp.inc
--- includes/filetransfer/ftp.inc	28 Aug 2009 07:51:55 -0000	1.6
+++ includes/filetransfer/ftp.inc	13 Oct 2009 08:09:40 -0000
@@ -5,6 +5,15 @@
  * Connection class using the FTP URL wrapper.
  */
 class FileTransferFTPWrapper extends FileTransfer {
+
+  public function __construct($jail, $username, $password, $hostname, $port) {
+    $this->username = $username;
+    $this->password = $password;
+    $this->hostname = $hostname;
+    $this->port = $port;
+    parent::__construct($jail);
+  }
+  
   function connect() {
     $this->connection = 'ftp://' . urlencode($this->username) . ':' . urlencode($this->password) . '@' . $this->hostname . ':' . $this->port . '/';
     if (!is_dir($this->connection)) {
@@ -19,29 +28,29 @@ class FileTransferFTPWrapper extends Fil
   }
 
   function createDirectoryJailed($directory) {
-    if (!@drupal_mkdir($directory)) {
+    if (!@drupal_mkdir($this->connection . $directory)) {
       $exception = new FileTransferException('Cannot create directory @directory.', NULL, array('@directory' => $directory));
       throw $exception;
     }
   }
 
   function removeDirectoryJailed($directory) {
-    if (is_dir($directory)) {
-      $dh = opendir($directory);
+    if (is_dir($this->connection . $directory)) {
+      $dh = opendir($this->connection . $directory);
       while (($resource = readdir($dh)) !== FALSE) {
         if ($resource == '.' || $resource == '..') {
           continue;
         }
         $full_path = $directory . DIRECTORY_SEPARATOR . $resource;
-        if (is_file($full_path)) {
+        if (is_file($this->connection . $full_path)) {
           $this->removeFile($full_path);
         }
-        elseif (is_dir($full_path)) {
+        elseif (is_dir($this->connection . $full_path)) {
           $this->removeDirectory($full_path . '/');
         }
       }
       closedir($dh);
-      if (!rmdir($directory)) {
+      if (!rmdir($this->connection . $directory)) {
         $exception = new FileTransferException('Cannot remove @directory.', NULL, array('@directory' => $directory));
         throw $exception;
       }
@@ -70,15 +79,18 @@ class FileTransferFTPWrapper extends Fil
   }
 
   /**
-   * This is impossible with the stream wrapper,
-   * So we cheat and use the other implementation
+   * This is impossible with the stream wrapper, so an exception is thrown.
+   *
+   * If the ftp extenstion is available, we will cheat and use it.
    *
-   * @staticvar FileTransferFTPExtension $ftp_ext_file_transfer
    * @param string $path
    * @param long $mode
    * @param bool $recursive
    */
   function chmodJailed($path, $mode, $recursive) {
+    if (!function_exists('ftp_connect')) {
+      throw new FileTransferException('Unable to set permissions on @path.  Change umask settings on server to be world executable.', array('@path' => $path));
+    }
     static $ftp_ext_file_transfer;
 
     if (!$ftp_ext_file_transfer) {
cvs diff: Diffing misc
Index: misc/authorize.js
===================================================================
RCS file: misc/authorize.js
diff -N misc/authorize.js
--- /dev/null	1 Jan 1970 00:00:00 -0000
+++ misc/authorize.js	13 Oct 2009 15:26:20 -0000
@@ -0,0 +1,29 @@
+// $Id$
+
+/**
+ * @file
+ * Conditionally hide or show the appropriate settings and saved defaults
+ * on the file transfer connection settings form used by authorize.php.
+ */
+
+(function ($) {
+
+Drupal.behaviors.authorizeFileTransferForm = {
+  attach: function(context) {
+    $('#edit-connection-settings-authorize-filetransfer-default').change(function() {
+      $('.filetransfer').hide().filter('.filetransfer-' + $(this).val()).show();
+    });
+    $('.filetransfer').hide().filter('.filetransfer-' + $('#edit-connection-settings-authorize-filetransfer-default').val()).show();
+
+    // Removes the float on the select box (used for non-JS interface)
+    if($('.connection-settings-update-filetransfer-default-wrapper').length > 0) {
+      console.log($('.connection-settings-update-filetransfer-default-wrapper'));
+      $('.connection-settings-update-filetransfer-default-wrapper').css('float', 'none');
+    }
+    // Hides the submit button for non-js users
+    $('#edit-submit-connection').hide();
+    $('#edit-submit-process').show();
+  }
+}
+
+})(jQuery);
cvs diff: Diffing misc/farbtastic
cvs diff: Diffing misc/ui
cvs diff: Diffing misc/ui/images
cvs diff: Diffing modules/system
Index: modules/system/maintenance.css
===================================================================
RCS file: /Users/wright/drupal/local_repo/drupal/modules/system/maintenance.css,v
retrieving revision 1.1
diff -u -p -r1.1 maintenance.css
--- modules/system/maintenance.css	30 Nov 2007 12:19:10 -0000	1.1
+++ modules/system/maintenance.css	13 Oct 2009 16:30:33 -0000
@@ -21,3 +21,18 @@
 #update-results li.failure strong {
   color: #b63300;
 }
+
+/* authorize.php styles */
+.connection-settings-update-filetransfer-default-wrapper {
+  float: left;
+}
+#edit-submit-connection {
+  clear: both;
+}
+.filetransfer {
+  display: none;
+  clear: both;
+}
+#edit-connection-settings-change-connection-type {
+  margin: 2.6em 0.5em 0em 1em;
+}
Index: modules/system/system.info
===================================================================
RCS file: /Users/wright/drupal/local_repo/drupal/modules/system/system.info,v
retrieving revision 1.16
diff -u -p -r1.16 system.info
--- modules/system/system.info	31 Aug 2009 18:30:27 -0000	1.16
+++ modules/system/system.info	13 Oct 2009 16:09:22 -0000
@@ -12,5 +12,6 @@ files[] = system.install
 files[] = system.test
 files[] = system.tar.inc
 files[] = system.tokens.inc
+files[] = system.updater.inc
 files[] = mail.sending.inc
 required = TRUE
Index: modules/system/system.module
===================================================================
RCS file: /Users/wright/drupal/local_repo/drupal/modules/system/system.module,v
retrieving revision 1.809
diff -u -p -r1.809 system.module
--- modules/system/system.module	13 Oct 2009 21:16:43 -0000	1.809
+++ modules/system/system.module	13 Oct 2009 21:19:34 -0000
@@ -1319,6 +1319,64 @@ function _system_themes_access($theme) {
 }
 
 /**
+ * Invoke a given callback via authorize.php to run with elevated privileges.
+ *
+ * To use authorize.php, certain variables must be stashed into
+ * $_SESSION. This function sets up all the necessary $_SESSION variables,
+ * then redirects to authorize.php to initiate the workflow that will
+ * eventually lead to the callback being invoked. The callback will be invoked
+ * at a low bootstrap level, without all modules being invoked, so it needs to
+ * be careful not to assume any code exists.
+ *
+ * @param $callback
+ *   The name of the function to invoke one the user authorizes the operation.
+ * @param $file
+ *   The full path to the file where the callback function is implemented.
+ * @param $arguments
+ *   Optional array of arguments to pass into the callback when it is invoked.
+ *   Note that the first argument to the callback is always the FileTransfer
+ *   object created by authorize.php when the user authorizes the operation.
+ * @return
+ *   Nothing. This function redirects to authorize.php and does not return.
+ */
+function system_run_authorized($callback, $file, $arguments = array()) {
+  global $base_url;
+
+  // First, figure out what file transfer backends the site supports, and put
+  // all of those in the SESSION so that authorize.php has access to all of
+  // them via the class autoloader, even without a full bootstrap.
+  $_SESSION['authorize_filetransfer_backends'] = module_invoke_all('filetransfer_backends');
+
+  // Now, define the callback to invoke.
+  $_SESSION['authorize_operation'] = array(
+    'callback' => $callback,
+    'file' => $file,
+    'arguments' => $arguments,
+  );
+
+  // Finally, redirect to authorize.php.
+  drupal_goto($base_url . '/authorize.php');
+}
+
+/**
+ * Implement hook_updater_info().
+ */
+function system_updater_info() {
+  return array(
+    'module' => array(
+      'class' => 'ModuleUpdater',
+      'name' => t('Update modules'),
+      'weight' => 0,
+    ),
+    'theme' => array(
+      'class' => 'ThemeUpdater',
+      'name' => t('Update themes'),
+      'weight' => 0,
+    ),
+  );
+}
+
+/**
  * Implement hook_filetransfer_backends().
  */
 function system_filetransfer_backends() {
Index: modules/system/system.updater.inc
===================================================================
RCS file: modules/system/system.updater.inc
diff -N modules/system/system.updater.inc
--- /dev/null	1 Jan 1970 00:00:00 -0000
+++ modules/system/system.updater.inc	13 Oct 2009 22:22:34 -0000
@@ -0,0 +1,118 @@
+<?php
+// $Id$
+
+/**
+ * @file
+ * Subclasses of the Updater class to update Drupal core knows how to update.
+ * At this time, only modules and themes are supported.
+ */
+ 
+/**
+ * Class for updating modules using FileTransfer classes via authorize.php.
+ */
+class ModuleUpdater extends Updater implements DrupalUpdaterInterface {
+
+  static function getInstallDirectory() {
+    return DRUPAL_ROOT . '/' . conf_path() . '/modules';
+  }
+
+  function isInstalled() {
+    return (bool) drupal_get_path('module', $this->name);
+  }
+
+  static function canUpdateDirectory($directory) {
+    if (file_scan_directory($directory, '/.*\.module/')) {
+      return TRUE;
+    }
+    return FALSE;
+  }
+
+  static function canUpdate($project_name) {
+    return (bool) drupal_get_path('module', $project_name);
+  }
+
+  /**
+   * @todo: Not implemented
+   * @return <type>
+   */
+  function getSchemaUpdates() {
+    require_once './includes/install.inc';
+    require_once './includes/update.inc';
+
+    if (_update_get_project_type($project) != 'module') {
+      return array();
+    }
+    module_load_include('install', $project);
+
+    if (!$updates = drupal_get_schema_versions($project)) {
+      return array();
+    }
+    $updates_to_run = array();
+    $modules_with_updates = update_get_update_list();
+    if ($updates = $modules_with_updates[$project]) {
+      if ($updates['start']) {
+        return $updates['pending'];
+      }
+    }
+    return array();
+  }
+
+  function postInstallTasks() {
+    return array(
+      l(t('Enable newly added modules in !project', array('!project' => $this->title)), 'admin/config/modules'),
+    );
+  }
+
+  function postUpdateTasks() {
+    // @todo: If there are schema updates.
+    return array(
+      l(t('Run database updates for !project', array('!project' => $this->title)), 'update.php'),
+    );
+  }
+
+}
+
+/**
+ * Class for updating themes using FileTransfer classes via authorize.php.
+ */
+class ThemeUpdater extends Updater implements DrupalUpdaterInterface {
+  public $installDirectory;
+
+  static function getInstallDirectory() {
+    return DRUPAL_ROOT . '/' . conf_path() . '/themes';
+  }
+
+  function isInstalled() {
+    return (bool) drupal_get_path('theme', $this->name);
+  }
+
+  static function canUpdateDirectory($directory) {
+    // This is a lousy test, but don't know how else to confirm it is a theme.
+    if (file_scan_directory($directory, '/.*\.module/')) {
+      return FALSE;
+    }
+    return TRUE;
+  }
+
+  static function canUpdate($project_name) {
+    return (bool) drupal_get_path('theme', $project_name);
+  }
+
+  function postInstall() {
+    // Update the system table.
+    system_get_theme_data();
+
+    // Active the theme
+    db_update('system')
+      ->fields(array('status' => 1))
+      ->condition('type', 'theme')
+      ->condition('name', $this->name)
+      ->execute();
+  }
+  
+  function postInstallTasks() {
+    return array(
+      l(t('Set the !project theme as default', array('!project' => $this->title)), 'admin/appearance'),
+    );
+  }
+}
cvs diff: Diffing modules/update
Index: modules/update/update.authorize.inc
===================================================================
RCS file: modules/update/update.authorize.inc
diff -N modules/update/update.authorize.inc
--- /dev/null	1 Jan 1970 00:00:00 -0000
+++ modules/update/update.authorize.inc	14 Oct 2009 06:41:08 -0000
@@ -0,0 +1,266 @@
+<?php
+// $Id$
+
+/**
+ * @file
+ * Callbacks and related functions invoked by authorize.php to update projects
+ * on the Drupal site. We use the Batch API to actually update each individual
+ * project on the site. All of the code in this file is run at a low bootstrap
+ * level (modules are not loaded), so these functions cannot assume access to
+ * the rest of the update module code.
+ */
+
+/**
+ * Callback invoked by authorize.php to update existing projects.
+ *
+ * @param $filetransfer
+ *   The FileTransfer object created by authorize.php for use during this
+ *   operation.
+ * @param $operations
+ *   An array of update-related operations to perform.
+ */
+function update_authorize_run_update($filetransfer, $operations) {
+  global $base_url;
+
+  // @todo: HACK. We should define $operations differently and just define the
+  // real arguments correctly now, instead of shoving them in.
+/*
+  foreach ($operations as $key => $args) {
+    $function = $args[0];
+    if ($function == 'update_batch_copy_project') {
+      $operations[$key][1][] = $filetransfer;
+    }
+  }
+*/
+
+  $batch = array(
+    'title' => t('Installing updates'),
+    'init_message' => t('Preparing update operation'),
+    'operations' => $operations,
+    'finished' => 'update_authorize_batch_finished',
+    'file' => drupal_get_path('module', 'update') . '/update.authorize.inc',
+  );
+
+  batch_set($batch);
+  // Invoke the batch via authorize.php.
+  batch_process($base_url . '/authorize.php', $base_url . '/authorize.php?batch=1');
+}
+
+/**
+ * Callback invoked by authorize.php to install a new project.
+ *
+ * @param FileTransfer $filetransfer
+ *   The FileTransfer object created by authorize.php for use during this
+ *   operation.
+ * @param string $class_name
+ *   The name of the Updater class to use for installing this.
+ * @param string $project_name
+ *   The canonical project short name (e.g. {system}.name).
+ * @param string $project_title
+ *   The human-readable project title.
+ * @param string $local_cache
+ *   The full path to the local directory where the project has already been
+ *   downloaded.
+ */
+function update_authorize_run_install($filetransfer, $class_name, $project_name, $project_title, $local_cache) {
+  global $base_url;
+
+  $batch_arguments = func_get_args();
+
+  $operations[] = array(
+    'update_authorize_batch_updater_install_project',
+    $batch_arguments,
+  );
+
+  $batch = array(
+    'title' => t('Installing %project', array('%project' => $project_title)),
+    'init_message' => t('Preparing update operation'),
+    'operations' => $operations,
+    'finished' => 'update_authorize_batch_finished',
+    'file' => drupal_get_path('module', 'update') . '/update.authorize.inc',
+  );
+  batch_set($batch);
+
+  // Invoke the batch via authorize.php.
+  batch_process($base_url . '/authorize.php', $base_url . '/authorize.php?batch=1');
+
+}
+
+/**
+ * @param FileTransfer $filetransfer
+ *   The FileTransfer object created by authorize.php for use during this
+ *   operation.
+ * @param string $class_name
+ *   The name of the Updater class to use for installing this.
+ * @param string $project_name
+ *   The canonical project short name (e.g. {system}.name).
+ * @param string $project_title
+ *   The human-readable project title.
+ * @param string $local_cache
+ *   The full path to the local directory where the project has already been
+ *   downloaded.
+ */
+function update_authorize_batch_updater_install_project($filetransfer, $class_name, $project_name, $project_title, $local_cache, &$context) {
+  // @todo: This is still all wrong.
+  update_batch_copy_project($project_name, $local_cache, $filetransfer, $context);
+}
+
+/**
+ * Batch operation: download a project and put it in a temporary cache.
+ *
+ * @param string $project name of the project being installed
+ * @param array &$context BatchAPI storage
+ *
+ * @return void;
+ */
+function update_batch_get_project($project, &$context) {
+  if (!isset($context['results']['log'])) {
+    $context['results']['log'] = array();
+  }
+  if (!isset($context['results']['log'][$project])) {
+    $context['results']['log'][$project] = array();
+  }
+
+  // This is here to show the user that we are in the process of downloading.
+  if (!isset($context['sandbox']['started'])) {
+    $context['sandbox']['started'] = TRUE;
+    $context['message'] = t('Downloading %project', array('%project' => $project));
+    $context['finished'] = 0;
+    return;
+  }
+  $latest_version = _update_get_recommended_version($project);
+  if ($local_cache = update_get_file($latest_version['download_link'])) {
+    watchdog('update', 'Downloaded %project to %local_cache', array('%project' => $project, '%local_cache' => $local_cache));
+  }
+  else {
+    $context['success'] = FALSE;
+    $content['results'][$project][] = t('Failed to download %project', array('%project' => $project));
+  }
+}
+
+/**
+ * Batch operation: copy a project to its proper place.
+ * For updates, will locate the current project and replace it.
+ * For new installs, will download and try to determine the type from the info file
+ * and then place it variable_get(update_default_{$type}_location) i.e. update_default_module_location().
+ *
+ * @todo Fix the $project param (refactor)
+ * @param string $project Either name of the project being installed or a
+ * @param string $url Location of a tarball to install if recommended version of $project not required
+ * @param string $filetransfer FileTransfer class
+ * @param array &$context BatchAPI storage
+ *
+ * @return void
+ */
+function update_batch_copy_project($project, $url, $filetransfer, &$context) {
+  module_load_include('inc', 'update', 'update.manager');
+
+  // Initialize some variables
+  if (!isset($context['results']['log'])) {
+    $context['results']['log'] = array();
+  }
+
+  if (!isset($context['results']['tasks'])) {
+    $context['results']['tasks'] = array();
+  }
+
+  /**
+   * The batch API uses a session, and since all the arguments are serialized
+   * and unserialized between requests, although the FileTransfer object
+   * itself will be reconstructed, the connection pointer itself will be lost.
+   * However, the FileTransfer object will still have the connection variable,
+   * even though the connection itself is now gone. So, although it's ugly, we
+   * have to unset the connection variable at this point so that the
+   * FileTransfer object will re-initiate the actual connection.
+   */
+  unset($filetransfer->connection);
+
+  if (!isset($context['results']['log'][$project])) {
+    $context['results']['log'][$project] = array();
+  }
+  
+  if (!empty($context['results']['log'][$project]['#abort'])) {
+    $context['#finished'] = 1;
+    return;
+  }
+
+  $local_cache = update_get_file($url);
+
+  // This extracts the file into the standard place.
+  try {
+    update_untar($local_cache);
+  }
+  catch (Exception $e) {
+    _update_batch_create_message($context['results']['log'][$project], $e->getMessage(), FALSE);
+    $context['results']['log'][$project]['#abort'] = TRUE;
+    return;
+  }
+  
+  $project_source_dir = DRUPAL_ROOT . '/' . file_directory_path('temporary') . '/update-extraction/' . $project;
+  $updater = Updater::factory($project_source_dir);
+
+  try {
+    if ($updater->isInstalled()) {
+      // This is an update.
+      $tasks = $updater->update($filetransfer);
+    }
+    else {
+      $tasks = $updater->install($filetransfer);
+    }
+  }
+  catch (UpdaterError $e) {
+    _update_batch_create_message($context['results']['log'][$project], t("Error installing / updating"), FALSE);
+    _update_batch_create_message($context['results']['log'][$project], $e->getMessage(), FALSE);
+    $context['results']['log'][$project]['#abort'] = TRUE;
+    return;
+  }
+
+  _update_batch_create_message($context['results']['log'][$project], t('Installed %project_name successfully', array('%project_name' => $project)));
+  $context['results']['tasks'] += $tasks;
+
+  // @todo WTF? Just because a single operation finished doesn't mean the
+  // batch is complete. Does this even work for updating multiple things?
+  $context['finished'] = 1;
+}
+
+/**
+ * Batch callback for when the authorized operations batch is finished.
+ */
+function update_authorize_batch_finished($success, $results) {
+  foreach ($results['log'] as $project => $messages) {
+    if (!empty($messages['#abort'])) {
+      $success = FALSE;
+    }
+  }
+  if ($success) {
+    variable_set('site_offline', FALSE);
+    $page_message = array(
+      'message' => t('Update was completed successfully! Your site has been taken out of maintenance mode.'),
+      'type' => 'status',
+    );
+  }
+  else {
+    $page_message = array(
+      'message' => t('Update failed! See the log below for more information. Your site is still in maintenance mode.'),
+      'type' => 'error',
+    );
+  }
+
+  // Set all these values into the SESSION so authorize.php can display them.
+  $_SESSION['authorize_results']['success'] = $success;
+  $_SESSION['authorize_results']['page_message'] = $page_message;
+  $_SESSION['authorize_results']['messages'] = $results['log'];
+  $_SESSION['authorize_results']['tasks'] = $results['tasks'];
+}
+
+/**
+ * Helper function to create a structure of log messages.
+ *
+ * @param array $project_results
+ * @param string $message
+ * @param bool $success
+ */
+function _update_batch_create_message(&$project_results, $message, $success = TRUE) {
+  $project_results[] = array('message' => $message, 'success' => $success);
+}
+
Index: modules/update/update.css
===================================================================
RCS file: /Users/wright/drupal/local_repo/drupal/modules/update/update.css,v
retrieving revision 1.5
diff -u -p -r1.5 update.css
--- modules/update/update.css	29 Apr 2009 03:57:21 -0000	1.5
+++ modules/update/update.css	13 Oct 2009 21:44:57 -0000
@@ -108,3 +108,17 @@ table.update,
 .update .check-manually {
   padding-left: 1em; /* LTR */
 }
+
+.update-major-version-warning {
+  color: #ff0000;
+}
+
+table tbody tr.update-security,
+table tbody tr.update-unsupported {
+  background: #fcc;
+}
+
+th.update-project-name {
+  width: 50%;
+}
+
Index: modules/update/update.info
===================================================================
RCS file: /Users/wright/drupal/local_repo/drupal/modules/update/update.info,v
retrieving revision 1.6
diff -u -p -r1.6 update.info
--- modules/update/update.info	26 Sep 2009 17:03:13 -0000	1.6
+++ modules/update/update.info	13 Oct 2009 20:04:30 -0000
@@ -4,10 +4,12 @@ description = Checks the status of avail
 version = VERSION
 package = Core
 core = 7.x
-files[] = update.compare.inc
-files[] = update.fetch.inc
 files[] = update.install
 files[] = update.module
+files[] = update.authorize.inc
+files[] = update.compare.inc
+files[] = update.fetch.inc
+files[] = update.manager.inc
 files[] = update.report.inc
 files[] = update.settings.inc
 files[] = update.test
Index: modules/update/update.manager.inc
===================================================================
RCS file: modules/update/update.manager.inc
diff -N modules/update/update.manager.inc
--- /dev/null	1 Jan 1970 00:00:00 -0000
+++ modules/update/update.manager.inc	14 Oct 2009 08:22:18 -0000
@@ -0,0 +1,534 @@
+<?php
+// $Id$
+
+/**
+ * @file
+ * Administrative screens and processing functions for managing updates,
+ * either adding new projects (modules and themes) or updating existing ones.
+ */
+ 
+/**
+ * Build the form for the update manager page to update existing projects.
+ *
+ * @param $form
+ * @param $form_state
+ * @param $context
+ *   String representing the context from which we're trying to update, can be:
+ *   'module', 'theme' or 'report'.
+ * @return
+ *   The form array for selecting which projects to update.
+ */
+function update_manager_update_form($form, $form_state = array(), $context) {
+  $form = array();
+  
+  if (!isset($form_state['values'])) {
+    // This is the first page of the update process.
+    $form = _update_manager_update_form_select_projects($context);
+  }
+  elseif (is_array($form_state['values']) && (array_filter($form_state['storage']['projects']) || array_filter($form_state['values']['projects']))) {
+    // This is the second page of the update process.
+    $form = _update_manager_update_form_display_steps();
+    $form['submit'] = array(
+      '#type' => 'submit',
+      '#name' => 'process_updates',
+      '#value' => t('Install updates'),
+      '#weight' => 100,
+    );
+  }
+  return $form;
+}
+
+/**
+ * Build the form for the first page in the update form workflow.
+ *
+ * This presents a table with all projects that have available updates with
+ * checkboxes to select which ones to upgrade.
+ *
+ * @param $context
+ *   String representing the context from which we're trying to update, can be:
+ *   'module', 'theme' or 'report'.
+ * @return
+ *   Form array for the first page of the update form.
+ */
+function _update_manager_update_form_select_projects($context) {
+  $form['#theme'] = 'update_available_updates_form';
+
+  $available = update_get_available(TRUE);
+  if (empty($available)) {
+    $form['message'] = array(
+      '#markup' => t('There was a problem getting update information. Please try again later.'),
+    );
+    return $form;
+  }
+
+  drupal_add_css('misc/ui/ui.all.css');
+  drupal_add_css('misc/ui/ui.dialog.css');
+  drupal_add_js('misc/ui/ui.core.js', array('weight' => JS_LIBRARY + 5));
+  drupal_add_js('misc/ui/ui.dialog.js', array('weight' => JS_LIBRARY + 6));
+  $form['#attached']['js'][] = drupal_get_path('module', 'update') . '/update.manager.js';
+  $form['#attached']['css'][] = drupal_get_path('module', 'update') . '/update.css';
+
+  // This will be a nested array. The first key is the kind of project, which
+  // can be either 'enabled', 'disabled', 'manual-enabled' (enabled add-ons
+  // which require manual updates, such as core or -dev projects) or
+  // 'manual-disabled' (disabled add-ons that need a manual update). Then,
+  // each subarray is an array of projects of that type, indexed by project
+  // short name, and containing an array of data for cells in that project's
+  // row in the appropriate table.
+  $projects = array();
+
+  module_load_include('inc', 'update', 'update.compare');
+  $project_data = update_calculate_project_data($available);
+  foreach ($project_data as $name => $project) {
+    // Filter out projects which are up2date already.
+    if ($project['status'] == UPDATE_CURRENT) {
+      continue;
+    }
+    // The project name to display can vary based on the info we have.
+    if (!empty($project['title'])) {
+      if (!empty($project['link'])) {
+        $project_name = l($project['title'], $project['link']);
+      }
+      else {
+        $project_name = check_plain($project['title']);
+      }
+    }
+    elseif (!empty($project['info']['name'])) {
+      $project_name = check_plain($project['info']['name']);
+    }
+    else {
+      $project_name = check_plain($name);
+    }
+    if ($project['project_type'] == 'theme' || $project['project_type'] == 'theme-disabled') {
+      $project_name .= ' ' . t('(Theme)');
+    }
+
+    if (empty($project['recommended'])) {
+      // If we don't know what to recommend they upgrade to, we should skip
+      // the project entirely.
+      continue;
+    }
+
+    $recommended_release = $project['releases'][$project['recommended']];
+    $recommended_version = $recommended_release['version'] . ' ' . l(t('(Release notes)'), $recommended_release['release_link'], array('attributes' => array('title' => t('Release notes for @project_name', array('@project_name' => $project_name)))));
+    if ($recommended_release['version_major'] != $project['existing_major']) {
+      $recommended_version .= '<div title="Major upgrade warning" class="update-major-version-warning">' . t('This update is a major version update which means that it may not be backwards compatible with your currently running version.  It is recommended that you read the release notes and proceed at your own risk.') . '</div>';
+    }
+
+    // Create an entry for this project.
+    $entry = array(
+      'title' => $project_name,
+      'installed_version' => $project['existing_version'],
+      'recommended_version' => $recommended_version,
+    );
+
+    switch ($project['status']) {
+      case UPDATE_NOT_SECURE:
+      case UPDATE_REVOKED:
+        $entry['title'] .= ' ' . t('(Security Update)');
+        $entry['#weight'] = -2;
+        $type = 'security';
+        break;
+
+      case UPDATE_NOT_SUPPORTED:
+        $type = 'unsupported';
+        $entry['title'] .= ' ' . t('(Unsupported)');
+        $entry['#weight'] = -1;
+        break;
+
+      case UPDATE_UNKNOWN:
+      case UPDATE_NOT_FETCHED:
+      case UPDATE_NOT_CHECKED:
+      case UPDATE_NOT_CURRENT:
+        $type = 'recommended';
+        break;
+
+      default:
+        // Jump out of the switch and onto the next project in foreach.
+        continue 2;
+    }
+
+    $entry['#attributes'] = array('class' => array('update-' . $type));
+
+    // Based on what kind of project this is, save the entry into the
+    // appropriate subarray.
+    switch ($project['project_type']) {
+      case 'core':
+        // Core is always enabled, but need manual updates at this time.
+        $projects['manual-enabled'][$name] = $entry;
+        break;
+        
+      case 'module':
+      case 'theme':
+        // Projects which are dev versions with no stable release need
+        // to be upgrade manually.
+        if (($project['install_type'] == 'dev' && $recommended_release['version_extra'] == 'dev')) {
+          $projects['manual-enabled'][$name] = $entry;
+        }
+        else {
+          $projects['enabled'][$name] = $entry;
+        }
+        break;
+
+      case 'module-disabled':
+      case 'theme-disabled':
+        // Projects which are dev versions with no stable release need
+        // to be upgrade manually.
+        if (($project['install_type'] == 'dev' && $recommended_release['version_extra'] == 'dev')) {
+          $projects['manual-disabled'][$name] = $entry;
+        }
+        else {
+          $projects['disabled'][$name] = $entry;
+        }
+        break;
+    }
+  }
+
+  if (empty($projects)) {
+    $form['message'] = array(
+      '#markup' => t('All of your projects are up to date.'),
+    );
+    return $form;
+  }
+
+  $headers = array(
+    'title' => array(
+      'data' => t('Name'),
+      'class' => array('update-project-name'),
+    ),
+    'installed_version' => t('Installed version'),
+    'recommended_version' => t('Recommended version'),
+  );
+
+  if (!empty($projects['enabled'])) {
+    $form['projects'] = array(
+      '#type' => 'tableselect',
+      '#header' => $headers,
+      '#options' => $projects['enabled'],
+    );
+    if (count($projects) > 1) {
+      $form['projects']['#prefix'] = '<h2>' . t('Enabled add-ons') . '</h2>';
+    }
+  }
+
+  if (!empty($projects['disabled'])) {
+    $form['disabled_projects'] = array(
+      '#type' => 'tableselect',
+      '#header' => $headers,
+      '#options' => $projects['disabled'],
+      '#weight' => 1,
+    );
+    if (count($projects) > 1) {
+      $form['disabled_projects']['#prefix'] = '<h2>' . t('Disabled add-ons') . '</h2>';
+    }
+  }
+
+  // If either table has been printed yet, we need a submit button and to
+  // validate the checkboxes.
+  if (!empty($projects['enabled']) || !empty($projects['disabled'])) {
+    $form['submit'] = array(
+      '#type' => 'submit',
+      '#value' => t('Install these updates'),
+      '#weight' => 10,
+    );
+    $form['#validate'][] = 'update_manager_update_form_select_projects_validate';
+  }
+
+  if (!empty($projects['manual-enabled'])) {
+    $prefix = '<h2>' . t('Add-ons requiring manual updates') . '</h2>';
+    $prefix .= '<p>' . t('Updates of Drupal core or development releases are not supported at this time.') . '</p>';
+    $form['manual_updates'] = array(
+      '#type' => 'markup',
+      '#markup' => theme('table', array('header' => $headers, 'rows' => $projects['manual-enabled'])),
+      '#prefix' => $prefix,
+      '#weight' => 20,
+    );
+  }
+
+  if (!empty($projects['manual-disabled'])) {
+    $prefix = '<h2>' . t('Disabled add-ons requiring manual updates') . '</h2>';
+    $prefix .= '<p>' . t('Updates of Drupal core or development releases are not supported at this time.') . '</p>';
+    $form['manual_disabled'] = array(
+      '#type' => 'markup',
+      '#markup' => theme('table', array('header' => $headers, 'rows' => $projects['manual-disabled'])),
+      '#prefix' => $prefix,
+      '#weight' => 25,
+    );
+  }
+
+  return $form;
+}
+
+/**
+ * Validation callback to ensure that at least one project is selected.
+ */
+function update_manager_update_form_select_projects_validate($form, &$form_state) {
+  if (!empty($form_state['values']['projects'])) {
+    $enabled = array_filter($form_state['values']['projects']);
+  }
+  if (!empty($form_state['values']['disabled_projects'])) {
+    $disabled = array_filter($form_state['values']['disabled_projects']);
+  }
+  if (empty($enabled) && empty($disabled)) {
+    form_set_error('projects', t('You must select at least one project to update.'));
+  }
+}
+
+function _update_manager_update_form_display_steps() {
+  $form['information']['#weight'] = -100;
+  $form['information']['backup_header'] = array(
+    '#prefix' => '<h3>',
+    '#markup' => t('Step 1: Backup your site'),
+    '#suffix' => '</h3>',
+  );
+
+  $form['information']['backup_message'] = array(
+    '#prefix' => '<p>',
+    '#markup' => t('We do not currently have a web based backup tool. <a href="@backup_url">Learn more about how to take a backup</a>.', array('@backup_url' => url('http://drupal.org/node/22281'))),
+    '#suffix' => '</p>',
+  );
+
+  $form['information']['maint_header'] = array(
+    '#prefix' => '<h3>',
+    '#markup' => t('Step 2: Enter maintenance mode'),
+    '#suffix' => '</h3>',
+  );
+
+  $form['information']['maint_message'] = array(
+    '#prefix' => '<p>',
+    '#markup' => t('It is strongly recommended that you put your site into maintenance mode while performing an update.'),
+    '#suffix' => '</p>',
+  );
+
+  $form['information']['site_offline'] = array(
+    '#title' => t('Perform updates with site in maintenance mode'),
+    '#type' => 'checkbox',
+    '#default_value' => TRUE,
+  );
+
+  return $form;
+}
+
+/**
+ * Submit function for the main update form.
+ *
+ * @see update_manager_update_form()
+ */
+function update_manager_update_form_submit($form, &$form_state) {
+  switch ($form_state['clicked_button']['#name']) {
+    case 'process_updates':
+      $operations = array();
+      foreach ($form_state['storage']['projects'] as $project) {
+        // @TODO: Present some type of warning when updating multi-site used modules.
+        // Put this in the begining (download everything first)
+        $operations[] = array('update_batch_get_project', array($project));
+        $latest_version = _update_get_recommended_version($project);
+        // This is the .tar.gz from d.o.
+        $url = $latest_version['download_link'];
+        
+        $operations[] = array(
+          'update_batch_copy_project',
+          array(
+            $project,
+            $url,
+          ),
+        );
+      }
+
+      if ($form_state['values']['site_offline'] == TRUE) {
+        // Put site in offline mode.
+        variable_set('site_offline', TRUE);
+      }
+
+      return system_run_authorized('update_authorize_run_update', drupal_get_path('module', 'update') . '/update.authorize.inc', $operations);
+    
+    default:
+      $form_state['rebuild'] = TRUE;
+      // This is the first page, and store the list of selected projects
+      $form_state['storage']['projects'] = array_keys(array_filter($form_state['values']['projects']));
+      break;
+  }
+}
+
+
+function update_manager_install_form(&$form_state) {
+  $form = array();
+
+  $form['project_url'] = array(
+    '#type' => 'textfield',
+    '#title' => t('URL'),
+    '#description' => t('Paste the url to a Drupal module or theme archive (.tar.gz) here to install it. (e.g http://ftp.drupal.org/files/projects/projectname.tar.gz)'),
+  );
+
+  $form['information'] = array(
+    '#prefix' => '<strong>',
+    '#markup' => 'Or',
+    '#suffix' => '</strong>',
+  );
+
+  $form['project_upload'] = array(
+    '#type' => 'file',
+    '#title' => t('Upload a module or theme'),
+    '#description' => t('Upload a Drupal module or theme (in .tar.gz format) to install it.'),
+  );
+
+  $form['submit'] = array(
+    '#type' => 'submit',
+    '#value' => t('Install'),
+  );
+
+  return $form;
+}
+
+function update_manager_install_form_validate($form, &$form_state) {
+  if (!($form_state['values']['project_url'] XOR !empty($_FILES['files']['name']['project_upload']))) {
+    form_set_error('project_url', t('Unable to continue, please provide a url or upload a module / theme'));
+    return;
+  }
+}
+
+function update_manager_install_form_submit($form, &$form_state) {
+  global $base_url;
+  
+  if ($form_state['values']['project_url']) {
+    $field = 'project_url';
+    $local_cache = update_get_file($form_state['values']['project_url']);
+    if (!$local_cache) {
+      form_set_error($field, t('Unable to retreive Drupal project from %url', array('%url' => $form_state['values']['project_url'])));
+      return;
+    }
+  }
+  elseif ($_FILES['files']['name']['project_upload']) {
+    $field = 'project_upload';
+    // @todo: add some validators here.
+    $finfo = file_save_upload($field, array(), NULL, FILE_EXISTS_REPLACE);
+    // @todo: find out if the module is already instealled, if so, throw an error.
+    $local_cache = $finfo->uri;
+  }
+  
+  $archive_tar = new Archive_Tar(drupal_realpath($local_cache));
+
+  $files = $archive_tar->listContent();
+  if (!$files) {
+    form_set_error($field, t('Provided URL is not a .tar.gz archive', array('%url' => $form_state['values']['url'])));
+    return;
+  }
+
+  $project = drupal_substr($files[0]['filename'], 0, -1); // Unfortunately, we can only use the directory name for this. :(
+  
+  $project_location = DRUPAL_ROOT . '/' . file_directory_path('temporary') . '/update-extraction/' . $project;
+  update_untar(drupal_realpath($local_cache));
+
+  // Make sure the Updater registry is loaded.
+  drupal_get_updaters();
+  $updater = Updater::factory($project_location);
+  $project_title = Updater::getProjectTitle($project_location);
+
+  if (!$project) {
+    form_set_error($field, t('Unable to determine %project name', array('%project' => $project_title)));
+  }
+  
+  if ($updater->isInstalled()) {
+    form_set_error($field, t('%project is already installed', array('%project' => $project_title)));
+    return;
+  }
+  
+  $arguments = array(
+    'class' => get_class($updater),
+    'project_name' => $project,
+    'project_title' => $project_title,
+    'local_cache' => $local_cache,
+  );
+
+  return system_run_authorized('update_authorize_run_install', drupal_get_path('module', 'update') . '/update.authorize.inc', $arguments);
+
+}
+
+/**
+ * Theme main update selector page.
+ *
+ * @param $variables
+ *   form: The form.
+ * 
+ * @ingroup themeable
+ */
+function theme_update_available_updates_form($variables) {
+  extract($variables);
+  $last = variable_get('update_last_check', 0);
+  $output = theme('update_last_check', array('last' => $last));
+  $output .= drupal_render_children($form);
+  return $output;
+}
+
+/**
+ * Untar a file, using the Archive_Tar class.
+ *
+ * @param string $file the filename you wish to extract
+ *
+ * @return void
+ * @throws Exception on failure.
+ */
+function update_untar($file) {
+  $extraction_dir = DRUPAL_ROOT . '/' . file_directory_path('temporary') . '/update-extraction';
+  if (!file_exists($extraction_dir)) {
+    mkdir($extraction_dir);
+  }
+  $archive_tar = new Archive_Tar(drupal_realpath($file));
+  if (!$archive_tar->extract($extraction_dir)) {
+    throw new Exception(t('Unable to extact %file', array('%file' => $file)));
+  }
+}
+
+/**
+ * Coppies a file from $url to the temporary directory for updates.
+ *
+ * If the file has already been downloaded, returns the the local path.
+ *
+ * @param $url
+ *   The URL of the file on the server.
+ *
+ * @return string
+ *   Path to local file.
+ */
+function update_get_file($url) {
+  $parsed_url = parse_url($url);
+  $remote_schemes = array('http', 'https', 'ftp', 'ftps', 'smb', 'nfs');
+  if (!in_array($parsed_url['scheme'], $remote_schemes)) {
+    // This is a local file, just return the path.
+    return drupal_realpath($url);
+  }
+
+  // Check the cache and download the file if needed.
+  $local = 'temporary://update-cache/' . basename($parsed_url['path']);
+
+  if (!file_exists(DRUPAL_ROOT . '/' . file_directory_path('temporary') . '/update-cache/')) {
+    mkdir(DRUPAL_ROOT . '/' . file_directory_path('temporary') . '/update-cache/');
+  }
+  
+  if (!file_exists($local)) {
+    return system_retrieve_file($url, $local);
+  }
+  else {
+    return $local;
+  }
+}
+
+
+/**
+ * Gets the latest recommended release of a project.
+ *
+ * This function will prioritize updates on the same branch as the current version.
+ *
+ * @param string $name Name of the project
+ * @return array An array of information about the latest recommended
+ * release of the project
+ */
+function _update_get_recommended_version($name) {
+  if ($available = update_get_available(FALSE)) {
+    module_load_include('inc', 'update', 'update.compare');
+    $project_data = update_calculate_project_data($available);
+    $project = $project_data[$name];
+    return $project['releases'][$project['recommended']];
+  }
+}
+
Index: modules/update/update.module
===================================================================
RCS file: /Users/wright/drupal/local_repo/drupal/modules/update/update.module,v
retrieving revision 1.49
diff -u -p -r1.49 update.module
--- modules/update/update.module	13 Oct 2009 02:14:05 -0000	1.49
+++ modules/update/update.module	13 Oct 2009 20:17:09 -0000
@@ -77,11 +77,13 @@ define('UPDATE_MAX_FETCH_TIME', 5);
 function update_help($path, $arg) {
   switch ($path) {
     case 'admin/reports/updates':
-      global $base_url;
-      $output = '<p>' . t('Here you can find information about available updates for your installed modules and themes. Note that each module or theme is part of a "project", which may or may not have the same name, and might include multiple modules or themes within it.') . '</p>';
-      $output .= '<p>' . t('To extend the functionality or to change the look of your site, a number of contributed <a href="@modules">modules</a> and <a href="@themes">themes</a> are available.', array('@modules' => 'http://drupal.org/project/modules', '@themes' => 'http://drupal.org/project/themes')) . '</p>';
-      $output .= '<p>' . t('Each time Drupal core or a contributed module or theme is updated, it is important that <a href="@update-php">update.php</a> is run.', array('@update-php' => url($base_url . '/update.php', array('external' => TRUE)))) . '</p>';
-      return $output;
+      return '<p>' . t('Here you can find information about available updates for your installed modules and themes. Note that each module or theme is part of a "project", which may or may not have the same name, and might include multiple modules or themes within it.') . '</p>';
+
+    case 'admin/appearance/install':
+    case 'admin/config/modules/install':
+    case 'admin/reports/updates/install':
+      return '<p>' . t('To install a new module or theme, either upload the .tar.gz file that you have downloaded, or paste the URL of a .tar.gz you wish to install. You can find <a href="@module_url">modules</a> and <a href="@theme_url">themes</a> at <a href="@drupal_org_url">http://drupal.org</a>.', array('@module_url' => 'http://drupal.org/project/modules', '@theme_url' => 'http://drupal.org/project/themes', '@drupal_org_url' => 'http://drupal.org')) . '</p>';
+
     case 'admin/appearance':
     case 'admin/config/modules':
       include_once DRUPAL_ROOT . '/includes/install.inc';
@@ -98,9 +100,13 @@ function update_help($path, $arg) {
         }
       }
 
+    case 'admin/appearance/update':
+    case 'admin/config/modules/update':
+    case 'admin/reports/updates/update':
+    case 'admin/reports/updates/update':
     case 'admin/reports/updates/settings':
     case 'admin/reports/status':
-      // These two pages don't need additional nagging.
+      // These pages don't need additional nagging.
       break;
 
     case 'admin/help#update':
@@ -156,6 +162,7 @@ function update_menu() {
     'access arguments' => array('administer site configuration'),
     'file' => 'update.settings.inc',
     'type' => MENU_LOCAL_TASK,
+    'weight' => 50,
   );
   $items['admin/reports/updates/check'] = array(
     'title' => 'Manual update check',
@@ -165,16 +172,80 @@ function update_menu() {
     'file' => 'update.fetch.inc',
   );
 
+  $items['admin/update'] = array(
+    'title' => 'Updating your site',
+    'description' => 'Second step of site update / new project install',
+    'page callback' => 'drupal_get_form',
+    'page arguments' => array('update_update_form'),
+    'access arguments' => array('administer site configuration'),
+    'weight' => 10,
+    'type' => MENU_CALLBACK,
+    'file' => 'update.manager.inc',
+  );
+
+  // We want action links for updating projects at a few different locations:
+  // both the module and theme administration pages, and on the available
+  // updates report itself. The menu items will be identical, except for their
+  // paths, so we just define them in a loop. We pass in a string indicating
+  // what context we're entering the action from, so that we can customize the
+  // appearance as needed.
+  $paths = array(
+    'report' => 'admin/reports/updates',
+    'module' => 'admin/config/modules',
+    'theme' => 'admin/appearance',
+  );
+  foreach ($paths as $context => $path) {
+    $items[$path . '/install'] = array(
+      'title' => 'Install',
+      'description' => 'Install new modules and themes',
+      'page callback' => 'drupal_get_form',
+      'page arguments' => array('update_manager_install_form', $context),
+      'access callback' => 'update_manager_access',
+      'access arguments' => array(),
+      'weight' => 25,
+      'type' => MENU_LOCAL_ACTION,
+      'file' => 'update.manager.inc',
+    );
+    $items[$path . '/update'] = array(
+      'title' => 'Update',
+      'description' => 'Update your installed modules and themes',
+      'page callback' => 'drupal_get_form',
+      'page arguments' => array('update_manager_update_form', $context),
+      'access callback' => 'update_manager_access',
+      'access arguments' => array(),
+      'weight' => 20,
+      'type' => MENU_LOCAL_ACTION,
+      'file' => 'update.manager.inc',
+    );
+  }
+
   return $items;
 }
 
 /**
- * Implement the hook_theme() registry.
+ * Determine if the current user can access the updater menu items.
+ *
+ * This is used as a menu system access callback. It both enforces the
+ * 'administer software updates' permission and the global killswitch for the
+ * authorize.php script.
+ *
+ * @see update_menu()
+ */
+function update_manager_access() {
+  return variable_get('allow_authorize_operations', TRUE) && user_access('administer software updates');
+}
+
+/**
+ * Implement hook_theme().
  */
 function update_theme() {
   return array(
-    'update_settings' => array(
+    'update_available_updates_form' => array(
       'arguments' => array('form' => NULL),
+      'file' => 'update.manager.inc',
+    ),
+    'update_last_check' => array(
+      'arguments' => array('last' => NULL),
     ),
     'update_report' => array(
       'arguments' => array('data' => NULL),
@@ -618,6 +689,30 @@ function _update_project_status_sort($a,
 }
 
 /**
+ * Render the HTML to display the last time we checked for update data.
+ *
+ * In addition to properly formating the given timestamp, this function also
+ * provides a "Check manually" link that refreshes the available update and
+ * redirects back to the same page.
+ *
+ * @param $variables
+ *   'last': The timestamp when the site last checked for available updates.
+ *
+ * @see theme_update_report()
+ * @see theme_update_available_updates_form()
+ *
+ * @ingroup themeable
+ */
+function theme_update_last_check($variables) {
+  $last = $variables['last'];
+  $output = '<div class="update checked">';
+  $output .= $last ? t('Last checked: @time ago', array('@time' => format_interval(REQUEST_TIME - $last))) : t('Last checked: never');
+  $output .= ' <span class="check-manually">(' . l(t('Check manually'), 'admin/reports/updates/check', array('query' => drupal_get_destination())) . ')</span>';
+  $output .= "</div>\n";
+  return $output;
+}
+
+/**
  * @defgroup update_status_cache Private update status cache system
  * @{
  *
Index: modules/update/update.report.inc
===================================================================
RCS file: /Users/wright/drupal/local_repo/drupal/modules/update/update.report.inc,v
retrieving revision 1.25
diff -u -p -r1.25 update.report.inc
--- modules/update/update.report.inc	13 Oct 2009 02:14:05 -0000	1.25
+++ modules/update/update.report.inc	13 Oct 2009 08:09:40 -0000
@@ -29,9 +29,7 @@ function theme_update_report($variables)
   $data = $variables['data'];
 
   $last = variable_get('update_last_check', 0);
-  $output = '<div class="update checked">' . ($last ? t('Last checked: @timestamp (@time ago)', array('@time' => format_interval(REQUEST_TIME - $last), '@timestamp' => format_date($last))) : t('Last checked: never'));
-  $output .= ' <span class="check-manually">(' . l(t('Check manually'), 'admin/reports/updates/check') . ')</span>';
-  $output .= "</div>\n";
+  $output = theme('update_last_check', array('last' => $last));
 
   if (!is_array($data)) {
     $output .= '<p>' . $data . '</p>';
Index: modules/update/update.test
===================================================================
RCS file: /Users/wright/drupal/local_repo/drupal/modules/update/update.test,v
retrieving revision 1.9
diff -u -p -r1.9 update.test
--- modules/update/update.test	13 Oct 2009 08:02:49 -0000	1.9
+++ modules/update/update.test	13 Oct 2009 08:09:40 -0000
@@ -45,7 +45,6 @@ class UpdateTestHelper extends DrupalWeb
    */
   protected function standardTests() {
     $this->assertRaw('<h3>' . t('Drupal core') . '</h3>');
-    $this->assertRaw(l(t('Check manually'), 'admin/reports/updates/check'), t('Link to check available updates manually appears.'));
     $this->assertRaw(l(t('Drupal'), 'http://example.com/project/drupal'), t('Link to the Drupal project appears.'));
     $this->assertNoText(t('No available releases found'));
   }
cvs diff: Diffing modules/update/tests
