Index: README
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/paranoia/README,v
retrieving revision 1.3
diff -u -p -r1.3 README
--- README	26 Mar 2007 07:58:45 -0000	1.3
+++ README	13 Jan 2009 18:31:23 -0000
@@ -1,4 +1,4 @@
-paranoia.module is for all the good sysadmins out there who think
+Paranoia module is for all the good sysadmins out there who think
 that allowing random CMS admins to execute PHP of their choice is not
 a safe idea.
 
@@ -6,13 +6,14 @@ What it will do is the following:
 
 - Disable granting of the "use PHP for block visibility" permission.
   Save the permissions form once to remove all previous grants.
-- Disable creation of input formats that use the PHP filter.
-- Disable editing the user #1 account.
-- Disable disabling this module. Yes, that's right you need to go 
-  to the database to get rid of it again. It is also not shown as being installed.
+  (An error appears in the site status report if a role still has this permission.)
+- Disable the PHP module.
+- Remove the PHP and paranoia modules from the module admin page.
+  Provide a hook to let you remove other modules from the module admin page.
+
+NOTE:
+The only way to disable paranoia module is by changing its status in the database system table.  By design it does not show up in the module administration page after it is enabled.
 
-To take full advantage of this module you need to delete the standard
-PHP filter at admin/filters.
 
 Author
 
Index: paranoia.info
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/paranoia/paranoia.info,v
retrieving revision 1.2
diff -u -p -r1.2 paranoia.info
--- paranoia.info	18 Jun 2007 22:53:53 -0000	1.2
+++ paranoia.info	13 Jan 2009 18:31:23 -0000
@@ -1,3 +1,5 @@
 ; $Id: paranoia.info,v 1.2 2007/06/18 22:53:53 dww Exp $
 name = Paranoia
-description = "Disallows usage of PHP code from inside Drupal and tampering with the uid = 1 account. Remember to delete the PHP input filter from the default input format."
+description = Protects the site from insecure configurations.
+core = 6.x
+
Index: paranoia.install
===================================================================
RCS file: paranoia.install
diff -N paranoia.install
--- /dev/null	1 Jan 1970 00:00:00 -0000
+++ paranoia.install	13 Jan 2009 18:31:23 -0000
@@ -0,0 +1,13 @@
+<?php
+// $Id$
+
+/**
+ * Implementation of hook_enable().
+ */
+function paranoia_enable() {
+  // Disable the php module if it is enabled.
+  if (module_exists('php')) {
+    module_disable(array('php'));
+    drupal_set_message(t('Paranoia module disabled the PHP module.'));
+  }
+}
\ No newline at end of file
Index: paranoia.module
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/paranoia/paranoia.module,v
retrieving revision 1.6
diff -u -p -r1.6 paranoia.module
--- paranoia.module	22 May 2007 17:45:14 -0000	1.6
+++ paranoia.module	13 Jan 2009 18:31:23 -0000
@@ -1,42 +1,86 @@
 <?php
 // $Id: paranoia.module,v 1.6 2007/05/22 17:45:14 killes Exp $
-// A module that locks a site down to achieve more security from malicious end users.
+/**
+ * @file
+ * - Disables PHP block visibility permission and gives status error if a role has this permission.
+ * - Disables the PHP module.
+ * - Hides the PHP and paranoia modules from the modules page.
+ */
 
-function paranoia_form_alter($form_id, &$form) {
+
+/**
+ * Implementation of hook_form_alter().
+ */
+function paranoia_form_alter(&$form, $form_state, $form_id) {
   switch ($form_id) {
-    case 'user_admin_perm':
-      // Do not allow any user safe user #1 to enter PHP anywhere
+    case 'user_admin_perm': // Disable PHP Blocks
       unset($form['permission']['use PHP for block visibility']);
-      unset($form['permission']['execute php code']);
       foreach (element_children($form['checkboxes']) as $rid) {
-        unset($form['checkboxes'][$rid]['use PHP for block visibility']);
+        foreach ($form['checkboxes'][$rid]['#default_value'] as $key => $value) {
+          if ($value == 'use PHP for block visibility') {
+          }
+        }
         unset($form['checkboxes'][$rid]['#options']['use PHP for block visibility']);
-        unset($form['checkboxes'][$rid]['execute php code']);
-        unset($form['checkboxes'][$rid]['#options']['execute php code']);
       }
       break;
-    case 'filter_admin_format_form':
-      // Disable creation of input formats that use the PHP filter
-      // Note you should also delete the PHP filter from the default
-      // input format.
-      unset($form['filters']['filter/1']);
-      break;
-    case 'system_modules':
-      // Disable disabling of this module
-      unset($form['name']['paranoia'], $form['version']['paranoia'], $form['description']['paranoia'], $form['throttle']['paranoia'], $form['throttle']['#options']['paranoia']);
-      $form['status']['paranoia'] = array('#type' => 'hidden', '#value' => 1);
-      break;
-    case 'user_edit':
-      if (arg(1) == 1) {
-        // disable deletion of the No. 1 user, also changing of
-        // password, status, or mail address.
-        unset($form['delete'], $form['account']['mail'], $form['account']['pass'], $form['account']['status']);
+    
+    case 'system_modules':   // Hide Paranoia and PHP modules from module admin form
+      $hidden_modules = module_invoke_all('paranoia_hide');
+      foreach($hidden_modules as $module){
+        _paranoia_hide_module($form, $module);
       }
       break;
-    case 'block_admin_configure':
-      unset($form['page_vis_settings']['visibility']['#options'][2]);
-      $form['page_vis_settings']['pages']['#description'] = t("Enter one page per line as Drupal paths. The '*' character is a wildcard. Example paths are <em>blog</em> for the blog page and <em>blog/*</em> for every personal blog. <em>&lt;front&gt;</em> is the front page.");
-      break;
   }
+}
+
+/**
+ * Remove a module from the module administration form.
+ */
+function _paranoia_hide_module(&$form, $module){
+  unset(
+    $form['validation_modules']['#value'][$module],
+    $form['name'][$module],
+    $form['version'][$module],
+    $form['description'][$module],
+    $form['throttle'][$module],
+    $form['throttle']['#options'][$module],
+    $form['status']['#options'][$module]
+  );
+}
+ 
+/**
+ * Implementation of hook_requirements().
+ */
+function paranoia_requirements($phase) {
+  $requirements = array();
+  if ($phase == 'runtime') {
+    // Ensure that no roles have permission to use PHP for block visibility.
+    module_load_include('inc', 'user', 'user.admin');
+    $form = user_admin_perm($form_state);
+    foreach (element_children($form['checkboxes']) as $rid) {
+      if (in_array('use PHP for block visibility', $form['checkboxes'][$rid]['#default_value'])) {
+        $requirements['paranoia'] = array(
+          'title' => t('Paranoia'),
+          'description' => t('A user role has permission to use PHP for block visibility.  Resubmit your <a href="@admin/user/permissions">user permissions</a> to close this security hole.', array('@admin/user/permissions' => url('admin/user/permissions'))),
+          'severity' => REQUIREMENT_ERROR,
+          );
+      }
+    }
+    // Ensure the PHP module is not enabled.
+    if (module_exists('php')) {
+      $requirements['paranoia_php'] = array(
+        'title' => t('Paranoia'),
+        'description' => t('The PHP module is enabled.  This module should be disabled (but paranoia module prevents it from showing in the module admin form).  It may have been enabled in the database, circumventing the effectiveness of paranoia module.'),
+        'severity' => REQUIREMENT_ERROR,
+        );
+    }
+  }
+  return $requirements;
+}
 
+/**
+ * Implementation of hook_paranoia_hide().
+ */
+function paranoia_paranoia_hide() {
+  return array('php', 'paranoia');
 }
\ No newline at end of file