From cc644351b66756e77779c2c6ac6829307fc2c2c9 Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Wed, 29 Jul 2026 23:11:48 +0200 Subject: [PATCH 1/6] fw-addr-lists: fix list without certificate --- fw-addr-lists.rsc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fw-addr-lists.rsc b/fw-addr-lists.rsc index 7fe41588..55b7afd7 100644 --- a/fw-addr-lists.rsc +++ b/fw-addr-lists.rsc @@ -72,7 +72,7 @@ :local Data false; :local TimeOut [ $EitherOr [ :totime ($List->"timeout") ] $FwAddrListTimeOut ]; - :foreach Cert in=[ :toarray delimiter=":" ($List->"cert") ] do={ + :foreach Cert in=[ :toarray delimiter=":" [ :tostr ($List->"cert") ] ] do={ :if ([ :len ($Cert) ] > 0) do={ :set CheckCertificate true; :if ([ $CertificateAvailable $Cert "fetch" ] = false) do={ From a8c6aa90b6147cc11a9de2a61e4fa60eba68f2de Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Thu, 23 Jul 2026 09:33:57 +0200 Subject: [PATCH 2/6] global-functions: $ScriptInstallUpdate: support setting policy --- global-functions.rsc | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/global-functions.rsc b/global-functions.rsc index 85744878..35e4de7f 100644 --- a/global-functions.rsc +++ b/global-functions.rsc @@ -1434,8 +1434,15 @@ :error false; } + :local ReqPolicy [ $ParseKeyValueStore [ $Grep $SourceNew ("\23 requires policy, ") ] ]; + :if ([ :len ($ReqPolicy->"policy") ] > 0) do={ + :set ($ScriptVal->"policy") [ :toarray delimiter=";" ($ReqPolicy->"policy") ]; + $LogPrint debug $0 ("New policy for script '" . $ScriptVal->"name" . \ + "': " . ($ReqPolicy->"policy")); + } + $LogPrint info $0 ("Updating script: " . $ScriptVal->"name"); - /system/script/set owner=($ScriptVal->"name") \ + /system/script/set owner=($ScriptVal->"name") policy=($ScriptVal->"policy") \ source=[ $IfThenElse ($ScriptUpdatesCRLF = true) $SourceCRLF $SourceNew ] $Script; :if ($ScriptVal->"name" = "global-config" || \ $ScriptVal->"name" = "global-functions" || \ From 1ebbb7f3a7b3e2beaeaf19c3ce8d1033a59295b7 Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Thu, 23 Jul 2026 09:35:00 +0200 Subject: [PATCH 3/6] global-functions: $ScriptInstallUpdate: support setting dont-require-permissions --- global-functions.rsc | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/global-functions.rsc b/global-functions.rsc index 35e4de7f..f77b96ce 100644 --- a/global-functions.rsc +++ b/global-functions.rsc @@ -1440,9 +1440,14 @@ $LogPrint debug $0 ("New policy for script '" . $ScriptVal->"name" . \ "': " . ($ReqPolicy->"policy")); } + :if ([ :len ($ReqPolicy->"dont-require-permissions") ] > 0) do={ + :set ($ScriptVal->"dont-require-permissions") ($ReqPolicy->"dont-require-permissions"); + $LogPrint debug $0 ("Setting dont-require-permissions for script '" . $ScriptVal->"name" . "'."); + } $LogPrint info $0 ("Updating script: " . $ScriptVal->"name"); /system/script/set owner=($ScriptVal->"name") policy=($ScriptVal->"policy") \ + dont-require-permissions=($ScriptVal->"dont-require-permissions") \ source=[ $IfThenElse ($ScriptUpdatesCRLF = true) $SourceCRLF $SourceNew ] $Script; :if ($ScriptVal->"name" = "global-config" || \ $ScriptVal->"name" = "global-functions" || \ From 4fd2d89320c9b1a5b13af4961a8c106fb3b1cd5b Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Thu, 23 Jul 2026 13:56:10 +0200 Subject: [PATCH 4/6] global-functions: $ScriptInstallUpdate: drop the check for matching policies... ... as this started to produce false positives. --- global-functions.rsc | 8 -------- 1 file changed, 8 deletions(-) diff --git a/global-functions.rsc b/global-functions.rsc index f77b96ce..9c8d88fc 100644 --- a/global-functions.rsc +++ b/global-functions.rsc @@ -1336,14 +1336,6 @@ :local ScriptInfo [ $ParseKeyValueStore ($ScriptVal->"comment") ]; :local SourceNew; - :foreach Scheduler in=[ /system/scheduler/find where on-event~("\\b" . $ScriptVal->"name" . "\\b") ] do={ - :local SchedulerVal [ /system/scheduler/get $Scheduler ]; - :if ($ScriptVal->"policy" != $SchedulerVal->"policy") do={ - $LogPrint warning $0 ("Policies differ for script '" . $ScriptVal->"name" . \ - "' and its scheduler '" . $SchedulerVal->"name" . "'!"); - } - } - :do { :if ($ScriptInfo->"ignore" = true) do={ $LogPrint debug $0 ("Ignoring script '" . $ScriptVal->"name" . "', as requested."); From 306842ed743abfcbf4b2aa3fe472ffdf531eb50b Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Thu, 23 Jul 2026 09:54:08 +0200 Subject: [PATCH 5/6] global-functions: $ScriptInstallUpdate: match in one regular expression --- global-functions.rsc | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/global-functions.rsc b/global-functions.rsc index 9c8d88fc..6da5e740 100644 --- a/global-functions.rsc +++ b/global-functions.rsc @@ -1441,9 +1441,7 @@ /system/script/set owner=($ScriptVal->"name") policy=($ScriptVal->"policy") \ dont-require-permissions=($ScriptVal->"dont-require-permissions") \ source=[ $IfThenElse ($ScriptUpdatesCRLF = true) $SourceCRLF $SourceNew ] $Script; - :if ($ScriptVal->"name" = "global-config" || \ - $ScriptVal->"name" = "global-functions" || \ - $ScriptVal->"name" ~ ("^(global-functions\\.d|mod)/.")) do={ + :if ($ScriptVal->"name" ~ ("^(global-config|global-functions(\\.d/.+)?|mod/.+)\$")) do={ :set ReloadGlobal true; } } on-error={ } From 1d4b7cd77d99544a48c75e1a2348c000d3f690e5 Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Wed, 22 Jul 2026 22:12:11 +0200 Subject: [PATCH 6/6] mode-button: set dont-require-permissions Actually this is a fixup for the RouterOS 7.24 changes. --- mode-button.rsc | 1 + 1 file changed, 1 insertion(+) diff --git a/mode-button.rsc b/mode-button.rsc index 364fa33f..ee183b4d 100644 --- a/mode-button.rsc +++ b/mode-button.rsc @@ -5,6 +5,7 @@ # # requires RouterOS, version=7.21 # requires device-mode, scheduler +# requires policy, dont-require-permissions # # act on multiple mode and reset button presses # https://rsc.eworm.de/doc/mode-button.md