csrf: tweak previous

src/etc/inc/system.inc

@@ -963,6 +963,7 @@ function system_webgui_start()
     global $config;
 
     chdir('/usr/local/www');
+    @unlink('/usr/local/www/csrf/csrf-secret.php');
 
     /* defaults */
     $portarg = "80";

src/etc/rc

@@ -183,7 +183,7 @@ echo "done."
 
 # let the PHP-based configuration subsystem set up the system now
 echo -n "Launching the init system..."
-rm -f /usr/local/www/csrf/csrf-secret.php /root/lighttpd*
+rm -f /root/lighttpd*
 touch /var/run/booting
 /usr/local/etc/rc.bootup
 rm /var/run/booting

src/www/csrf/csrf-magic.php

@@ -425,6 +425,8 @@ function csrf_get_secret()
     }
     if (is_writable($dir)) {
         $secret = csrf_generate_secret();
+        touch($file);
+        chmod($file, 0600);
         $fh = fopen($file, 'w');
         fwrite($fh, '<?php $secret = "'.$secret.'";' . PHP_EOL);
         fclose($fh);