Index: security_review.checks.inc
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/security_review/security_review.checks.inc,v
retrieving revision 1.1.2.3
diff -u -p -r1.1.2.3 security_review.checks.inc
--- security_review.checks.inc	16 Nov 2009 22:13:34 -0000	1.1.2.3
+++ security_review.checks.inc	5 Dec 2009 21:01:35 -0000
@@ -4,7 +4,7 @@
 /**
  * @file
  * Checks for security_review module.
- * 
+ *
  */
 
 /**
@@ -45,7 +45,7 @@ function security_review_check_file_perm
   $element['title'] =  t("Web server file system permissions");
   $element['descriptions'][] = t("It is dangerous to allow the web server to write to files inside the document root of your server. Doing so would allow Drupal to write files that could then be executed. An attacker might use such a vulnerability to take control of your site. An exception is the files directory which Drupal needs permission to write to in order to provide features like file attachments.");
   $element['descriptions'][] = t("<a href='!link'>Read more about file system permissions in the handbooks.</a>", array('!link' => url('http://drupal.org/node/244924')));
-  
+
   $last_check = security_review_get_last_check('security_review', 'file_perms');
   if ($last_check['skip'] == '1') {
     $element['findings']['descriptions'][] = _security_review_check_skipped($last_check);
@@ -54,7 +54,7 @@ function security_review_check_file_perm
     $return = security_review_check_file_perms();
     $element['findings']['descriptions'][] = t('It is recommended that the following files or directories be corrected.');
     foreach ($return['value'] as $file) {
-      $element['findings']['items'][] = check_plain($file); 
+      $element['findings']['items'][] = check_plain($file);
     }
   }
   $output = theme('security_review_check_help', $element);
@@ -98,7 +98,7 @@ function security_review_check_input_for
       }
     }
   }
-  
+
   if (!empty($check_return_value)) {
     $result = FALSE;
   }
@@ -140,7 +140,7 @@ function security_review_check_error_rep
     $result = FALSE;
   }
   else {
-    $result = TRUE; 
+    $result = TRUE;
   }
   return array('result' => $result);
 }
@@ -196,7 +196,7 @@ function security_review_check_private_f
 }
 
 /**
- * 
+ *
  */
 function security_review_check_upload_extensions() {
   $result = TRUE;
@@ -235,10 +235,10 @@ function security_review_check_upload_ex
   elseif ($last_check['result'] == '0') {
     $return = security_review_check_upload_extensions();
     $element['findings']['descriptions'][] = t('<a href="!link">Alter file upload settings.</a>', array('!link' => url('admin/settings/uploads')));
-  
+
     $element['findings']['descriptions'][] = t('The following extensions are considered unsafe and should be removed or limited from use.');
     foreach ($return['value'] as $extension) {
-      $element['findings']['items'][] = $extension; 
+      $element['findings']['items'][] = $extension;
     }
   }
   $output = theme('security_review_check_help', $element);
@@ -266,7 +266,7 @@ function security_review_check_query_err
         $check_result_value[] = $ip;
       }
     }
-  }  
+  }
   if (!empty($check_result_value)) {
      $result = FALSE;
   }
@@ -316,7 +316,7 @@ function security_review_check_failed_lo
         $check_result_value[] = $ip;
       }
     }
-  }  
+  }
   if (!empty($check_result_value)) {
      $result = FALSE;
   }
@@ -330,7 +330,7 @@ function security_review_check_failed_lo
 function security_review_check_failed_logins_help() {
   $element['title'] = t('Abundant failed logins from the same IP');
   $element['descriptions'][] = t("Failed login attempts from the same IP may be an artifact of a malicous user attempting to brute-force their way onto your site as an authenticated user to carry out nefarious deeds. ");
-  
+
   $last_check = security_review_get_last_check('security_review', 'failed_logins');
   if ($last_check['skip'] == '1') {
     $element['findings']['descriptions'][] = _security_review_check_skipped($last_check);
@@ -408,14 +408,14 @@ function security_review_check_nodes($la
   if (!empty($check_result_value)) {
     $result = FALSE;
   }
-  
+
   return array('result' => $result, 'value' => $check_result_value);
 }
 
 function security_review_check_nodes_help() {
   $element['title'] = t('Dangerous tags in nodes');
   $element['descriptions'][] = t("Script and PHP code in the body of nodes does not align with Drupal best practices and may be a vulnerability if an untrusted user is allowed to edit such content. It is recommended you remove such content from the body of nodes.");
-  
+
   $last_check = security_review_get_last_check('security_review', 'nodes');
   if ($last_check['skip'] == '1') {
     $element['findings']['descriptions'][] = _security_review_check_skipped($last_check);
@@ -430,7 +430,7 @@ function security_review_check_nodes_hel
     }
     $element['findings']['pager'] = theme('pager', NULL, 50);
   }
-  
+
   $output = theme('security_review_check_help', $element);
   return $output;
 }
@@ -441,7 +441,7 @@ function security_review_check_comments(
   $timestamp = NULL;
   if (module_exists('comment')) {
   $sql = "SELECT nid, cid FROM {comments} WHERE comment LIKE '%<script%' OR comment LIKE '%<?php%'";
-    if (!is_null($last_check)) {
+    if (!is_null($last_run)) {
       $sql .= " AND timestamp >= %d";
       $timestamp = $last_check['lastrun'];
     }
@@ -462,7 +462,7 @@ function security_review_check_comments(
 function security_review_check_comments_help() {
   $element['title'] = t('Dangerous tags in comments');
   $element['descriptions'][] = t("There is little reason for script and PHP tags to be in comments (unless they are code examples) and could be in use maliciously.");
-  
+
   $last_check = security_review_get_last_check('security_review', 'comments');
   if ($last_check['skip'] == '1') {
     $element['findings']['descriptions'][] = _security_review_check_skipped($last_check);
@@ -479,7 +479,7 @@ function security_review_check_comments_
     }
     $element['findings']['pager'] = theme('pager', NULL, 20);
   }
-  
+
   $output = theme('security_review_check_help', $element);
   return $output;
 }
\ No newline at end of file
Index: security_review.help.inc
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/security_review/security_review.help.inc,v
retrieving revision 1.1
diff -u -p -r1.1 security_review.help.inc
--- security_review.help.inc	4 Nov 2009 01:02:40 -0000	1.1
+++ security_review.help.inc	5 Dec 2009 21:01:35 -0000
@@ -12,7 +12,7 @@ function _security_review_help() {
   $output .= '<p>';
   $output .= t('You should take the security of your site very seriously.
     Fortunately, Drupal is fairly secure by default.
-    The Security Review module automates many of the easy-to-make mistakes that render your site insecure, however it does not automatically make your site impenetrable. 
+    The Security Review module automates many of the easy-to-make mistakes that render your site insecure, however it does not automatically make your site impenetrable.
     You should give care to what modules you install and how you configure your site and server.
     Be mindful of who visits your site and what features you expose for their use.');
   $output .= '</p>';
@@ -63,7 +63,7 @@ function _security_review_help_spam() {
 
 function theme_security_review_help_options($element) {
   $output .= '<div class="sec-rev-help-option">';
-  $output .= l($element['problem'], 'admin/reports/security-review/help', array('fragment' => $element['type'], 'attributes' => array('class' =>'sec-rev-help-dyn')));
+  $output .= l($element['problem'], 'admin/reports/security-review/help', array('fragment' => $element['type'], 'attributes' => array('class' => 'sec-rev-help-dyn')));
   $output .= '<div class="sec-rev-help-content">';
   $output .= '<p>' . $element['description'] . '</p>';
   foreach ($element['options'] as $option) {
Index: security_review.module
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/security_review/security_review.module,v
retrieving revision 1.1.2.2
diff -u -p -r1.1.2.2 security_review.module
--- security_review.module	16 Nov 2009 20:55:27 -0000	1.1.2.2
+++ security_review.module	5 Dec 2009 21:01:35 -0000
@@ -22,19 +22,19 @@ function security_review_perm() {
 function security_review_menu() {
   $items = array();
   $items['admin/reports/security-review'] = array(
-    'title' => 'Security Review',
+    'title' => 'Security review',
     'description' => 'Perform and review the security of your site.',
     'page callback' => 'security_review_page',
     'access arguments' => array('access security review list'),
     'type' => MENU_NORMAL_ITEM,
   );
   $items['admin/reports/security-review/run'] = array(
-    'title' => 'Run & Review',
+    'title' => 'Run & review',
     'access arguments' => array('access security review list'),
     'type' => MENU_DEFAULT_LOCAL_TASK,
   );
   $items['admin/reports/security-review/toggle/%'] = array(
-    'title' => 'Security Review Toggle',
+    'title' => 'Security review toggle',
     'page callback' => 'security_review_toggle_check',
     'page arguments' => array(4),
     'access arguments' => array('access security review list'),
@@ -55,7 +55,7 @@ function security_review_menu() {
     'type' => MENU_LOCAL_TASK,
     'weight' => 15,
   );
-  
+
   return $items;
 }
 
@@ -75,6 +75,7 @@ function security_review_theme($existing
  */
 function security_review_page() {
   $checks = array();
+  $output = '';
   // Retrieve the checklist.
   $checklist = module_invoke_all('security_checks');
   // Retrieve results from last run of the checklist.
@@ -91,7 +92,11 @@ function security_review_page() {
     $output .= security_review_reviewed($checklist, $checks);
   }
   else {
-    drupal_set_message(t('It appears this is your first time using the Security Review checklist. Before running the checklist please review the settings page at !link to set which roles are untrusted.', array('!link' => l('admin/reports/security-review/settings', 'admin/reports/security-review/settings'))));
+    // If they haven't configured the site, prompt them to do so.
+    $variable = db_result(db_query("SELECT name FROM {variable} WHERE name = 'security_review_log'"));
+    if (empty($variable)) {
+      drupal_set_message(t('It appears this is your first time using the Security Review checklist. Before running the checklist please review the settings page at !link to set which roles are untrusted.', array('!link' => l('admin/reports/security-review/settings', 'admin/reports/security-review/settings'))));
+    }
   }
   return $output;
 }
@@ -177,7 +182,7 @@ function security_review_reviewed($check
 
 function theme_security_review_reviewed($items = array(), $header = '', $desc = '') {
   drupal_add_js(drupal_get_path('module', 'security_review') . '/security_review.js', 'module', 'footer');
-  $output .= '<h3>' . $header . '</h3>';
+  $output = '<h3>' . $header . '</h3>';
   $output .= '<p>' . $desc . '</p>';
   $output .= '<table class="system-status-report">';
   foreach ($items as $item) {
@@ -196,7 +201,7 @@ function theme_security_review_reviewed(
  * Calling function should filter and sanitize.
  */
 function theme_security_review_check_help($element) {
-  $output .= '<h3>' . $element['title'] . '</h3>';
+  $output = '<h3>' . $element['title'] . '</h3>';
   foreach ($element['descriptions'] as $description) {
     $output .= '<p>' . $description . '</p>';
   }
@@ -207,7 +212,7 @@ function theme_security_review_check_hel
     if (!empty($element['findings']['items'])) {
       $output .= theme('item_list', $element['findings']['items']);
     }
-    if ($element['findings']['pager']) {
+    if (!empty($element['findings']['pager'])) {
       $output .= $element['findings']['pager'];
     }
   }
@@ -226,13 +231,13 @@ function security_review_run_form($form_
     '#type' => 'submit',
     '#value' => t('Run checklist'),
   );
-  
+
   return $form;
 }
 
 function security_review_run_form_submit($form, &$form_state) {
   $checklist = module_invoke_all('security_checks');
-  
+
   $result = security_review_run($checklist);
   if ($result !== FALSE) {
     drupal_set_message(t('Review complete'));
@@ -263,7 +268,7 @@ function security_review_run($checklist)
               if (is_null($return)) {
                 continue; // Check was n/a, so skip.
               }
-              
+
             }
             break;
         }
@@ -317,7 +322,7 @@ function security_review_store_results($
         'result' => $check['result'],
         'lastrun' => $check['lastrun'] ? $check['lastrun'] : time(),
       );
-      db_query("DELETE FROM {security_review} WHERE namespace = '%s' AND reviewcheck = '%s'", $module, $check_name); 
+      db_query("DELETE FROM {security_review} WHERE namespace = '%s' AND reviewcheck = '%s'", $module, $check_name);
       drupal_write_record('security_review', $record);
     }
   }
@@ -408,7 +413,7 @@ function security_review_security_checks
     'failure' => t('Untrusted roles have been granted administrative permissions.'),
     'file' => 'security_review.checks',
   );
-  
+
   return array('security_review' => $checks);
 }
 
@@ -562,14 +567,14 @@ function security_review_admin_permissio
 function security_review_settings() {
   $roles = user_roles();
   foreach ($roles as $rid => $role) {
-    $options[$rid] = check_plain($role); 
+    $options[$rid] = check_plain($role);
   }
   $message = '';
   $defaults = security_review_default_untrusted_roles();
   if (in_array(DRUPAL_AUTHENTICATED_RID, $defaults)) {
     $message = 'You have allowed anonymous users to create accounts without approval, the authenticated role thus defaults to untrusted.';
   }
-  
+
   $form['security_review_untrusted_roles'] = array(
     '#type' => 'checkboxes',
     '#title' => t('Untrusted roles'),
@@ -577,14 +582,14 @@ function security_review_settings() {
     '#options' => $options,
     '#default_value' => variable_get('security_review_untrusted_roles', $defaults),
   );
-  
+
   $form['security_review_log'] = array(
     '#type' => 'checkbox',
     '#title' => t('Log checklist results'),
     '#description' => t('Each result of a check can be logged to watchdog.'),
     '#default_value' => variable_get('security_review_log', TRUE),
   );
-  
+
   return system_settings_form($form);
 }