Index: update.php
===================================================================
RCS file: /cvs/drupal/drupal/update.php,v
retrieving revision 1.305
diff -u -p -r1.305 update.php
--- update.php	28 Sep 2009 22:16:32 -0000	1.305
+++ update.php	7 Oct 2009 18:35:31 -0000
@@ -99,21 +99,23 @@ function update_script_selection_form() 
   return $form;
 }
 
-
 function update_helpful_links() {
   // NOTE: we can't use l() here because the URL would point to 'update.php?q=admin'.
   $links[] = '<a href="' . base_path() . '">Front page</a>';
-  $links[] = '<a href="' . base_path() . '?q=admin">Administration pages</a>';
+  if (user_access('access administration pages')) {
+    $links[] = '<a href="' . base_path() . '?q=admin">Administration pages</a>';
+  }
   return $links;
 }
 
+
 function update_results_page() {
   drupal_set_title('Drupal database update');
   $links = update_helpful_links();
 
   update_task_list();
   // Report end result
-  if (module_exists('dblog')) {
+  if (module_exists('dblog') && user_access('access site reports')) {
     $log_message = ' All errors have been <a href="' . base_path() . '?q=admin/reports/dblog">logged</a>.';
   }
   else {
@@ -121,7 +123,12 @@ function update_results_page() {
   }
 
   if ($_SESSION['update_success']) {
-    $output = '<p>Updates were attempted. If you see no failures below, you may proceed happily to the <a href="' . base_path() . '?q=admin">administration pages</a>. Otherwise, you may need to update your database manually.' . $log_message . '</p>';
+    if (user_access('access administration pages')) {
+      $output = '<p>Updates were attempted. If you see no failures below, you may proceed happily to the <a href="' . base_path() . '?q=admin">administration pages</a>. Otherwise, you may need to update your database manually.' . $log_message . '</p>';
+    }
+    else {
+      $output = '<p>Updates were attempted. If you see no failures below, you may proceed happily back to your <a href="' . base_path() . '">site</a>. Otherwise, you may need to update your database manually.' . $log_message . '</p>';
+    }
   }
   else {
     list($module, $version) = array_pop(reset($_SESSION['updates_remaining']));
Index: modules/system/system.test
===================================================================
RCS file: /cvs/drupal/drupal/modules/system/system.test,v
retrieving revision 1.81
diff -u -p -r1.81 system.test
--- modules/system/system.test	3 Oct 2009 19:16:04 -0000	1.81
+++ modules/system/system.test	7 Oct 2009 18:35:38 -0000
@@ -1210,7 +1210,7 @@ class TokenReplaceTestCase extends Drupa
     // passed properly through the call stack and being handled correctly by a 'known'
     // token, [node:title].
     $this->assertFalse(strcmp($target, $result), t('Basic placeholder tokens replaced.'));
-    
+
     $raw_tokens = array('title' => '[node:title]');
     $generated = token_generate('node', $raw_tokens, array('node' => $node));
     $this->assertFalse(strcmp($generated['[node:title]'], check_plain($node->title)), t('Token sanitized.'));
@@ -1290,3 +1290,46 @@ array_space[a b] = Value';
     $this->assertEqual($parsed, $expected, t('Entire parsed .info string and expected array are identical.'));
   }
 }
+
+/**
+ * Tests for the update system functionality.
+ */
+class UpdateScriptFunctionalTest extends DrupalWebTestCase {
+  private $update_url;
+  private $update_user;
+
+  public static function getInfo() {
+    return array(
+      'name' => 'Update functionality',
+      'description' => 'Tests the update script access and functionality.',
+      'group' => 'System',
+    );
+  }
+
+  function setUp() {
+    parent::setUp();
+    $this->update_url = $GLOBALS['base_url'] . '/update.php';
+    $this->update_user = $this->drupalCreateUser(array('administer software updates'));
+  }
+
+  /**
+   * Test update.php when there are no updates to apply.
+   */
+  function testNoUpdateFunctionality() {
+    // Click through update.php with 'administer software updates' permission.
+    $this->drupalLogin($this->update_user);
+    $this->drupalPost($this->update_url, array(), t('Continue'), array('external' => TRUE));
+    $this->assertText(t('No pending updates.'));
+    $this->assertNoLink('Administration pages');
+    $this->clickLink('Front page');
+    $this->assertResponse(200);
+
+    // Click through update.php with 'access administration pages' permission.
+    $admin_user = $this->drupalCreateUser(array('administer software updates', 'access administration pages'));
+    $this->drupalLogin($admin_user);
+    $this->drupalPost($this->update_url, array(), t('Continue'), array('external' => TRUE));
+    $this->assertText(t('No pending updates.'));
+    $this->clickLink('Administration pages');
+    $this->assertResponse(200);
+  }
+}