From b6398422d02738c9962e55541dada64cfcbc3dba Mon Sep 17 00:00:00 2001 From: Filipe Santos Date: Sun, 26 Jul 2026 13:58:16 +1200 Subject: [PATCH 1/7] netwatch-dns: fix :toarray on unset doh-cert Co-authored-by: Christian Hesse --- netwatch-dns.rsc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/netwatch-dns.rsc b/netwatch-dns.rsc index ac7ce0ac..6fd09a1d 100644 --- a/netwatch-dns.rsc +++ b/netwatch-dns.rsc @@ -103,7 +103,7 @@ } :foreach DohServer in=$DohServers do={ - :foreach DohCert in=[ :toarray delimiter=":" ($DohServer->"doh-cert") ] do={ + :foreach DohCert in=[ :toarray delimiter=":" [ :tostr ($DohServer->"doh-cert") ] ] do={ :if ([ :len $DohCert ] > 0) do={ :if ([ $CertificateAvailable $DohCert "fetch" ] = false || \ [ $CertificateAvailable $DohCert "dns" ] = false) do={ From deee37d918b55d18a161c3f6c88f271e1729f78a Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Mon, 27 Jul 2026 21:38:30 +0200 Subject: [PATCH 2/7] update list of contributors --- CONTRIBUTIONS.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CONTRIBUTIONS.md b/CONTRIBUTIONS.md index d2472771..17a5ca32 100644 --- a/CONTRIBUTIONS.md +++ b/CONTRIBUTIONS.md @@ -20,6 +20,7 @@ for details! * [Anatoly Bubenkov](mailto:bubenkoff@gmail.com) (@bubenkoff) * [Ben Harris](mailto:mail@bharr.is) (@bharrisau) * [Daniel Ziegenberg](mailto:daniel@ziegenberg.at) (@ziegenberg) +* [Filipe Santos](mailto:git@not.sh) (horjulf) * [Ignacio Serrano](mailto:ignic@ignic.com) (@ignic) * [Ilya Kulakov](mailto:kulakov.ilya@gmail.com) (@Kentzo) * [Leonardo David Monteiro](mailto:leo@cub3.xyz) (@leosfsm) From 461aab48e89e65090ce3090ffe477badf21c345c Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Thu, 23 Jul 2026 09:33:57 +0200 Subject: [PATCH 3/7] global-functions: $ScriptInstallUpdate: support setting policy --- global-functions.rsc | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/global-functions.rsc b/global-functions.rsc index 85744878..35e4de7f 100644 --- a/global-functions.rsc +++ b/global-functions.rsc @@ -1434,8 +1434,15 @@ :error false; } + :local ReqPolicy [ $ParseKeyValueStore [ $Grep $SourceNew ("\23 requires policy, ") ] ]; + :if ([ :len ($ReqPolicy->"policy") ] > 0) do={ + :set ($ScriptVal->"policy") [ :toarray delimiter=";" ($ReqPolicy->"policy") ]; + $LogPrint debug $0 ("New policy for script '" . $ScriptVal->"name" . \ + "': " . ($ReqPolicy->"policy")); + } + $LogPrint info $0 ("Updating script: " . $ScriptVal->"name"); - /system/script/set owner=($ScriptVal->"name") \ + /system/script/set owner=($ScriptVal->"name") policy=($ScriptVal->"policy") \ source=[ $IfThenElse ($ScriptUpdatesCRLF = true) $SourceCRLF $SourceNew ] $Script; :if ($ScriptVal->"name" = "global-config" || \ $ScriptVal->"name" = "global-functions" || \ From 3fd8fd1f09cb7d5f790f82e4abfe4ac44c0e530b Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Thu, 23 Jul 2026 09:35:00 +0200 Subject: [PATCH 4/7] global-functions: $ScriptInstallUpdate: support setting dont-require-permissions --- global-functions.rsc | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/global-functions.rsc b/global-functions.rsc index 35e4de7f..f77b96ce 100644 --- a/global-functions.rsc +++ b/global-functions.rsc @@ -1440,9 +1440,14 @@ $LogPrint debug $0 ("New policy for script '" . $ScriptVal->"name" . \ "': " . ($ReqPolicy->"policy")); } + :if ([ :len ($ReqPolicy->"dont-require-permissions") ] > 0) do={ + :set ($ScriptVal->"dont-require-permissions") ($ReqPolicy->"dont-require-permissions"); + $LogPrint debug $0 ("Setting dont-require-permissions for script '" . $ScriptVal->"name" . "'."); + } $LogPrint info $0 ("Updating script: " . $ScriptVal->"name"); /system/script/set owner=($ScriptVal->"name") policy=($ScriptVal->"policy") \ + dont-require-permissions=($ScriptVal->"dont-require-permissions") \ source=[ $IfThenElse ($ScriptUpdatesCRLF = true) $SourceCRLF $SourceNew ] $Script; :if ($ScriptVal->"name" = "global-config" || \ $ScriptVal->"name" = "global-functions" || \ From db751235c2885809d5e757e73f77284b1dc9ea55 Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Thu, 23 Jul 2026 13:56:10 +0200 Subject: [PATCH 5/7] global-functions: $ScriptInstallUpdate: drop the check for matching policies... ... as this started to produce false positives. --- global-functions.rsc | 8 -------- 1 file changed, 8 deletions(-) diff --git a/global-functions.rsc b/global-functions.rsc index f77b96ce..9c8d88fc 100644 --- a/global-functions.rsc +++ b/global-functions.rsc @@ -1336,14 +1336,6 @@ :local ScriptInfo [ $ParseKeyValueStore ($ScriptVal->"comment") ]; :local SourceNew; - :foreach Scheduler in=[ /system/scheduler/find where on-event~("\\b" . $ScriptVal->"name" . "\\b") ] do={ - :local SchedulerVal [ /system/scheduler/get $Scheduler ]; - :if ($ScriptVal->"policy" != $SchedulerVal->"policy") do={ - $LogPrint warning $0 ("Policies differ for script '" . $ScriptVal->"name" . \ - "' and its scheduler '" . $SchedulerVal->"name" . "'!"); - } - } - :do { :if ($ScriptInfo->"ignore" = true) do={ $LogPrint debug $0 ("Ignoring script '" . $ScriptVal->"name" . "', as requested."); From 1b3fb933e31a913d94a1e9caa380436a514f28a5 Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Thu, 23 Jul 2026 09:54:08 +0200 Subject: [PATCH 6/7] global-functions: $ScriptInstallUpdate: match in one regular expression --- global-functions.rsc | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/global-functions.rsc b/global-functions.rsc index 9c8d88fc..6da5e740 100644 --- a/global-functions.rsc +++ b/global-functions.rsc @@ -1441,9 +1441,7 @@ /system/script/set owner=($ScriptVal->"name") policy=($ScriptVal->"policy") \ dont-require-permissions=($ScriptVal->"dont-require-permissions") \ source=[ $IfThenElse ($ScriptUpdatesCRLF = true) $SourceCRLF $SourceNew ] $Script; - :if ($ScriptVal->"name" = "global-config" || \ - $ScriptVal->"name" = "global-functions" || \ - $ScriptVal->"name" ~ ("^(global-functions\\.d|mod)/.")) do={ + :if ($ScriptVal->"name" ~ ("^(global-config|global-functions(\\.d/.+)?|mod/.+)\$")) do={ :set ReloadGlobal true; } } on-error={ } From 0a97bd14d0f3c7ad35b22763ec9b5fe8f300eb56 Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Wed, 22 Jul 2026 22:12:11 +0200 Subject: [PATCH 7/7] mode-button: set dont-require-permissions Actually this is a fixup for the RouterOS 7.24 changes. --- mode-button.rsc | 1 + 1 file changed, 1 insertion(+) diff --git a/mode-button.rsc b/mode-button.rsc index 364fa33f..ee183b4d 100644 --- a/mode-button.rsc +++ b/mode-button.rsc @@ -5,6 +5,7 @@ # # requires RouterOS, version=7.21 # requires device-mode, scheduler +# requires policy, dont-require-permissions # # act on multiple mode and reset button presses # https://rsc.eworm.de/doc/mode-button.md