IP address blocking does not work on update.php

Committed. Thanks DamZ.

Hm, this doesn't look right to me... It seems like this change prevents IP address blocking from working on update.php altogether?

We can turn it off during the D6->D7 upgrade, but once someone is running full D7, the IP address blocking should start working again (as was the case with the code that this replaced).

I wonder if something similar to the old method would work (try to bootstrap to the correct phase, then catch any exceptions)?

However, I seem to remember from another issue that exception handling in update.php isn't currently working correctly at all.... So possibly this issue is one we should return to later, once update.php is overall less broken.

there is no ACCESS in bootstrap anymore.

This still valid... retitling to accurately reflect the current issue described above.

rgrep BOOTSTRAP_ACCESS *
chx@veyron:/var/www/drupal$

Better :)

update has its own access control.

@chx, this is a bug and an unintentional regression. Every page in Drupal has its own access control, and update.php is no different - but the intended behavior is that IP address blocking prevents the page from being bootstrapped or accessed in any way. This is how it works in Drupal 6, and how it worked in Drupal 7 before this issue.

It is possible that we can downgrade this from "critical" - it's hard to imagine a scenario where this would lead to total disaster. But it should be fixed.

Downgrading, would be nice to fix. Would be nicer to remove ip address blocking from core 'cos it's a big mess.

#1: 583008-kill-bootstrap-access.patch queued for re-testing.

#1: 583008-kill-bootstrap-access.patch queued for re-testing.