diff -urp --strip-trailing-cr drupal-6-head/includes/bootstrap.inc drupal-6-mypatch/includes/bootstrap.inc --- drupal-6-head/includes/bootstrap.inc 2007-08-07 10:41:24.000000000 +0200 +++ drupal-6-mypatch/includes/bootstrap.inc 2007-08-26 13:51:37.000000000 +0200 @@ -274,7 +274,7 @@ function conf_init() { global $base_url, $base_path, $base_root; // Export the following settings.php variables to the global namespace - global $db_url, $db_prefix, $cookie_domain, $conf, $installed_profile; + global $db_url, $db_prefix, $cookie_domain, $conf, $installed_profile, $update_access_check; $conf = array(); if (file_exists('./'. conf_path() .'/settings.php')) { diff -urp --strip-trailing-cr drupal-6-head/modules/system/system.install drupal-6-mypatch/modules/system/system.install --- drupal-6-head/modules/system/system.install 2007-08-26 12:58:36.000000000 +0200 +++ drupal-6-mypatch/modules/system/system.install 2007-08-26 14:14:33.000000000 +0200 @@ -166,6 +166,23 @@ function system_requirements($phase) { } } + // Verify the update.php access setting + if ($phase == 'runtime') { + if ($GLOBALS['update_access_check'] == FALSE) { + $requirements['update access'] = array( + 'value' => $t('Not protected'), + 'severity' => REQUIREMENT_ERROR, + 'description' => t('The update.php script is accessible to everyone without authentication check, which is a security risk. You must change the $update_access_check value in your settings.php back to TRUE.'), + ); + } + else { + $requirements['update access'] = array( + 'value' => $t('Protected'), + ); + } + $requirements['update access']['title'] = $t('Access to update.php'); + } + // Test Unicode library include_once './includes/unicode.inc'; $requirements = array_merge($requirements, unicode_requirements()); diff -urp --strip-trailing-cr drupal-6-head/sites/default/default.settings.php drupal-6-mypatch/sites/default/default.settings.php --- drupal-6-head/sites/default/default.settings.php 2007-08-26 13:28:06.000000000 +0200 +++ drupal-6-mypatch/sites/default/default.settings.php 2007-08-26 13:52:06.000000000 +0200 @@ -94,6 +94,17 @@ $db_url = 'mysql://username:password@loc $db_prefix = ''; /** + * Access control for update.php script + * + * If you are updating your Drupal installation using the update.php script + * being not logged in as administrator, you will need to modify the access + * check statement below. Change the TRUE to a FALSE to disable the access + * check. After finishing the upgrade, be sure to open this file and change the + * FALSE back to a TRUE! + */ +$update_access_check = TRUE; + +/** * Base URL (optional). * * If you are experiencing issues with different site domains, diff -urp --strip-trailing-cr drupal-6-head/update.php drupal-6-mypatch/update.php --- drupal-6-head/update.php 2007-08-26 12:42:34.000000000 +0200 +++ drupal-6-mypatch/update.php 2007-08-26 14:19:48.000000000 +0200 @@ -9,14 +9,10 @@ * instructions. * * If you are not logged in as administrator, you will need to modify the access - * check statement below. Change the TRUE to a FALSE to disable the access - * check. After finishing the upgrade, be sure to open this file and change the - * FALSE back to a TRUE! + * check statement inside your settings.php file. After finishing the upgrade, + * be sure to open settings.php again, and change it back to its original state! */ -// Enforce access checking? -$access_check = TRUE; - /** * Add a column to a database using syntax appropriate for PostgreSQL. * Save result of SQL commands in $ret array. @@ -427,8 +423,8 @@ function update_results_page() { $output = '

The update process was aborted prematurely while running update #'. $version .' in '. $module .'.module. All other errors have been logged. You may need to check the watchdog database table manually.

'; } - if ($GLOBALS['access_check'] == FALSE) { - $output .= "

Reminder: don't forget to set the \$access_check value at the top of update.php back to TRUE.

"; + if ($GLOBALS['update_access_check'] == FALSE) { + $output .= "

Reminder: don't forget to set the \$update_access_check value in your settings.php file back to TRUE.

"; } $output .= theme('item_list', $links); @@ -482,11 +478,11 @@ function update_info_page() { function update_access_denied_page() { drupal_set_title('Access denied'); - return '

Access denied. You are not authorized to access this page. Please log in as the admin user (the first user you created). If you cannot log in, you will have to edit update.php to bypass this access check. To do this:

+ return '

Access denied. You are not authorized to access this page. Please log in as the admin user (the first user you created). If you cannot log in, you will have to edit settings.php to bypass this access check. To do this:

    -
  1. With a text editor find the update.php file on your system. It should be in the main Drupal directory that you installed all the files into.
    2. -
  2. There is a line near top of update.php that says $access_check = TRUE;. Change it to $access_check = FALSE;.
    3. -
  3. As soon as the script is done, you must change the update.php script back to its original form to $access_check = TRUE;.
    4. +
  4. With a text editor find the settings.php file on your system. From the main Drupal directory that you installed all the files into, go to sites/your_site_name if such directory exists, or else to sites/default which applies otherwise.
    5. +
  5. There is a line inside your settings.php file that says $update_access_check = TRUE;. Change it to $update_access_check = FALSE;.
    6. +
  6. As soon as the update.php script is done, you must change the settings.php file back to its original form with $update_access_check = TRUE;.
  7. To avoid having this problem in future, remember to log in to your website as the admin user (the user you first created) before you backup your database at the beginning of the update process.
'; } @@ -815,7 +811,7 @@ update_create_batch_table(); ini_set('display_errors', TRUE); // Access check: -if (($access_check == FALSE) || ($user->uid == 1)) { +if (($update_access_check == FALSE) || ($user->uid == 1)) { include_once './includes/install.inc'; include_once './includes/batch.inc'; diff -urp --strip-trailing-cr drupal-6-head/UPGRADE.txt drupal-6-mypatch/UPGRADE.txt --- drupal-6-head/UPGRADE.txt 2007-01-09 10:16:10.000000000 +0100 +++ drupal-6-mypatch/UPGRADE.txt 2007-08-26 14:30:29.000000000 +0200 @@ -25,8 +25,8 @@ UPGRADING 2. Log on as the user with user ID 1. User ID 1 is the first account created and the main administrator account. User ID 1 needs to be logged in so that you can access update.php - (step 9) which can only be run by user ID 1. Do not close - your browser until step 10 is complete. + (step 10) which can only be run by user ID 1. Do not close + your browser until step 11 is complete. 3. Place the site in "Off-line" mode, to mask any errors from site visitors. @@ -64,13 +64,14 @@ UPGRADING Note: if you are unable to access update.php do the following: - - Open update.php with a text editor. + - Open your settings.php with a text editor. - - There is a line near top of update.php that says - $access_check = TRUE;. Change it to $access_check = FALSE;. + - There is a line that says $update_access_check = TRUE;. + Change it to $update_access_check = FALSE;. - - As soon as the script is done, you must change the update.php - script back to its original form to $access_check = TRUE;. + - As soon as the update.php script is done, you must change + the settings.php file back to its original form with + $update_access_check = TRUE;. 11. Finally, return site to "Online" mode so your visitors may resume browsing.