Only print script warnings when a script is used. Remove stray mention of script...

Acked-by: Jan Just Keijser <janjust@nikhef.nl>
Message-Id: <1369920428-11350-1-git-send-email-arne@rfc2549.org>
URL: http://article.gmane.org/gmane.network.openvpn.devel/7625

Signed-off-by: Gert Doering <gert@greenie.muc.de>

diff --git a/src/openvpn/common.h b/src/openvpn/common.h
index dd2c83f47d58d3efac30da784d37605254f23344..2f85bec2b70ca675a29f63084df695c1103c8aec 100644 (file)
--- a/src/openvpn/common.h
+++ b/src/openvpn/common.h
@@ -100,6 +100,6 @@ typedef unsigned long ptr_type;
 /*
  * Script security warning
  */
-#define SCRIPT_SECURITY_WARNING "WARNING: External program may not be called unless '--script-security 2' or higher is enabled.  Use '--script-security 3 system' for backward compatibility with 2.1_rc8 and earlier.  See --help text or man page for detailed info."
+#define SCRIPT_SECURITY_WARNING "WARNING: External program may not be called unless '--script-security 2' or higher is enabled. See --help text or man page for detailed info."
 
 #endif

diff --git a/src/openvpn/init.c b/src/openvpn/init.c
index 2a0ba8530f2b4f31e1837a19a6af8a4e97abc4ad..1dc7ee7dbbaff704cec8d15e2ef863c9be2ce79d 100644 (file)
--- a/src/openvpn/init.c
+++ b/src/openvpn/init.c
@@ -2542,12 +2542,19 @@ do_option_warnings (struct context *c)
     msg (M_WARN, "NOTE: --connect-timeout option is not supported on this OS");
 #endif
 
-  if (script_security >= SSEC_SCRIPTS)
-    msg (M_WARN, "NOTE: the current --script-security setting may allow this configuration to call user-defined scripts");
-  else if (script_security >= SSEC_PW_ENV)
-    msg (M_WARN, "WARNING: the current --script-security setting may allow passwords to be passed to scripts via environmental variables");
-  else
-    msg (M_WARN, "NOTE: " PACKAGE_NAME " 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables");
+ /* Check if a script is used and print approiate warnings */
+ if (o->up_script || o->ipchange || o->down_script || o->route_script
+     || o->route_predown_script || o->auth_user_pass_verify_script
+     || o->client_disconnect_script || o->client_connect_script
+     || o->learn_address_script || o->tls_verify)
+   {
+     if (script_security >= SSEC_SCRIPTS)
+       msg (M_WARN, "NOTE: the current --script-security setting may allow this configuration to call user-defined scripts");
+     else if (script_security >= SSEC_PW_ENV)
+       msg (M_WARN, "WARNING: the current --script-security setting may allow passwords to be passed to scripts via environmental variables");
+     else
+       msg (M_WARN, "NOTE: " PACKAGE_NAME " 2.1+ requires '--script-security 2' or higher to call user-defined scripts or executables");
+   }
 }
 
 static void