From 461aab48e89e65090ce3090ffe477badf21c345c Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Thu, 23 Jul 2026 09:33:57 +0200
Subject: [PATCH 1/5] global-functions: $ScriptInstallUpdate: support setting
 policy

---
 global-functions.rsc | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/global-functions.rsc b/global-functions.rsc
index 85744878..35e4de7f 100644
--- a/global-functions.rsc
+++ b/global-functions.rsc
@@ -1434,8 +1434,15 @@
         :error false;
       }
 
+      :local ReqPolicy [ $ParseKeyValueStore [ $Grep $SourceNew ("\23 requires policy, ") ] ];
+      :if ([ :len ($ReqPolicy->"policy") ] > 0) do={
+        :set ($ScriptVal->"policy") [ :toarray delimiter=";" ($ReqPolicy->"policy") ];
+        $LogPrint debug $0 ("New policy for script '" . $ScriptVal->"name" . \
+            "': " . ($ReqPolicy->"policy"));
+      }
+
       $LogPrint info $0 ("Updating script: " . $ScriptVal->"name");
-      /system/script/set owner=($ScriptVal->"name") \
+      /system/script/set owner=($ScriptVal->"name") policy=($ScriptVal->"policy") \
           source=[ $IfThenElse ($ScriptUpdatesCRLF = true) $SourceCRLF $SourceNew ] $Script;
       :if ($ScriptVal->"name" = "global-config" || \
            $ScriptVal->"name" = "global-functions" || \

From 3fd8fd1f09cb7d5f790f82e4abfe4ac44c0e530b Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Thu, 23 Jul 2026 09:35:00 +0200
Subject: [PATCH 2/5] global-functions: $ScriptInstallUpdate: support setting
 dont-require-permissions

---
 global-functions.rsc | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/global-functions.rsc b/global-functions.rsc
index 35e4de7f..f77b96ce 100644
--- a/global-functions.rsc
+++ b/global-functions.rsc
@@ -1440,9 +1440,14 @@
         $LogPrint debug $0 ("New policy for script '" . $ScriptVal->"name" . \
             "': " . ($ReqPolicy->"policy"));
       }
+      :if ([ :len ($ReqPolicy->"dont-require-permissions") ] > 0) do={
+        :set ($ScriptVal->"dont-require-permissions") ($ReqPolicy->"dont-require-permissions");
+        $LogPrint debug $0 ("Setting dont-require-permissions for script '" . $ScriptVal->"name" . "'.");
+      }
 
       $LogPrint info $0 ("Updating script: " . $ScriptVal->"name");
       /system/script/set owner=($ScriptVal->"name") policy=($ScriptVal->"policy") \
+          dont-require-permissions=($ScriptVal->"dont-require-permissions") \
           source=[ $IfThenElse ($ScriptUpdatesCRLF = true) $SourceCRLF $SourceNew ] $Script;
       :if ($ScriptVal->"name" = "global-config" || \
            $ScriptVal->"name" = "global-functions" || \

From db751235c2885809d5e757e73f77284b1dc9ea55 Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Thu, 23 Jul 2026 13:56:10 +0200
Subject: [PATCH 3/5] global-functions: $ScriptInstallUpdate: drop the check
 for matching policies...

... as this started to produce false positives.
---
 global-functions.rsc | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/global-functions.rsc b/global-functions.rsc
index f77b96ce..9c8d88fc 100644
--- a/global-functions.rsc
+++ b/global-functions.rsc
@@ -1336,14 +1336,6 @@
     :local ScriptInfo [ $ParseKeyValueStore ($ScriptVal->"comment") ];
     :local SourceNew;
 
-    :foreach Scheduler in=[ /system/scheduler/find where on-event~("\\b" . $ScriptVal->"name" . "\\b") ] do={
-      :local SchedulerVal [ /system/scheduler/get $Scheduler ];
-      :if ($ScriptVal->"policy" != $SchedulerVal->"policy") do={
-        $LogPrint warning $0 ("Policies differ for script '" . $ScriptVal->"name" . \
-          "' and its scheduler '" . $SchedulerVal->"name" . "'!");
-      }
-    }
-
     :do {
       :if ($ScriptInfo->"ignore" = true) do={
         $LogPrint debug $0 ("Ignoring script '" . $ScriptVal->"name" . "', as requested.");

From 1b3fb933e31a913d94a1e9caa380436a514f28a5 Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Thu, 23 Jul 2026 09:54:08 +0200
Subject: [PATCH 4/5] global-functions: $ScriptInstallUpdate: match in one
 regular expression

---
 global-functions.rsc | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/global-functions.rsc b/global-functions.rsc
index 9c8d88fc..6da5e740 100644
--- a/global-functions.rsc
+++ b/global-functions.rsc
@@ -1441,9 +1441,7 @@
       /system/script/set owner=($ScriptVal->"name") policy=($ScriptVal->"policy") \
           dont-require-permissions=($ScriptVal->"dont-require-permissions") \
           source=[ $IfThenElse ($ScriptUpdatesCRLF = true) $SourceCRLF $SourceNew ] $Script;
-      :if ($ScriptVal->"name" = "global-config" || \
-           $ScriptVal->"name" = "global-functions" || \
-           $ScriptVal->"name" ~ ("^(global-functions\\.d|mod)/.")) do={
+      :if ($ScriptVal->"name" ~ ("^(global-config|global-functions(\\.d/.+)?|mod/.+)\$")) do={
         :set ReloadGlobal true;
       }
     } on-error={ }

From 0a97bd14d0f3c7ad35b22763ec9b5fe8f300eb56 Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Wed, 22 Jul 2026 22:12:11 +0200
Subject: [PATCH 5/5] mode-button: set dont-require-permissions

Actually this is a fixup for the RouterOS 7.24 changes.
---
 mode-button.rsc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mode-button.rsc b/mode-button.rsc
index 364fa33f..ee183b4d 100644
--- a/mode-button.rsc
+++ b/mode-button.rsc
@@ -5,6 +5,7 @@
 #
 # requires RouterOS, version=7.21
 # requires device-mode, scheduler
+# requires policy, dont-require-permissions
 #
 # act on multiple mode and reset button presses
 # https://rsc.eworm.de/doc/mode-button.md