Update.php page not found [solved]

Summary: After upgrading Drupal to 6.20, my attempts to run update.php failed. The system displayed Drupal's "page not found" page.

Solution: The permissions on update.php should not allow group write. The permissions were 0664. They should be 0644.

Too Much Detail: I upgraded my test site successfully to Drupal 6.20. Everything worked as expected, including update.php. I committed the changes to Bazaar and used bzr upload to copy the changes to my live site.

Although update.php had not reported any updates on my test site, I ran it on the live site "just in case." It failed and displayed Drupal's "page not found" page. I tried again with the same results.

Bazaar confirmed that update.php had changed in Drupal 6.20—the first change in many versions. I confirmed that update.php was identical on the working test site and the failing live site.

The Recent Log Entries report revealed that the "page not found" message came from 500.shtml. A search on Drupal.org found nothing directly relevant.

The Apache error log provided a clue:

[Thu Dec 30 08:14:34 2010] [error] [client 173.59.242.188] SoftException in Application.cpp:256: File "/home/mysite/public_html/update.php" is writeable by group, referer: http://www.mysite.com/admin/build/modules/list

I found update.php permissions of 0644 on the test site and 0664 on the live site. Apparently the bzr upload allowed the group write permission to be set. I will have to investigate bzr upload.

Changing update.php permissions from 0664 to 0644 solved the problem. Now update.php runs on both the test and live sites.

Case closed.