$NetBSD: patch-scp_admin.inc.php,v 1.1 2025/06/30 14:34:15 hauke Exp $
Removing the setup directory creates noise when the package is
deleted; it is really enough to make it unreadable to the web server.
--- scp/admin.inc.php.orig 2025-06-25 16:45:19.787476545 +0000
+++ scp/admin.inc.php
@@ -43,8 +43,8 @@ if($ost->isUpgradePending()) {
if(!strcasecmp(basename($_SERVER['SCRIPT_NAME']), 'settings.php'))
die($sysnotice);
- } elseif(file_exists('../setup/')) {
- $sysnotice=__('Please take a minute to delete setup directory (../setup/) for security reasons.');
+ } elseif(file_exists('../setup/') && is_readable('../setup/')) {
+ $sysnotice=__('For security reasons, make the setup directory (../setup/) inaccessible to the web server, or delete it.');
} elseif(CONFIG_FILE && file_exists(CONFIG_FILE) && is_writable(CONFIG_FILE)) {
//Confirm for real that the file is writable by group or world.
clearstatcache(); //clear the cache!