From 2f5d8c7cd875632410bc4a32b9c97c16a2f024f8 Mon Sep 17 00:00:00 2001 From: Jesse Keating Date: Wed, 15 Apr 2009 07:21:07 +0000 Subject: [PATCH 1/9] Initialize branch F-11 for wordpress-mu --- branch | 1 + 1 file changed, 1 insertion(+) create mode 100644 branch diff --git a/branch b/branch new file mode 100644 index 0000000..25c7708 --- /dev/null +++ b/branch @@ -0,0 +1 @@ +F-11 From 0cf7ea1dfe416216f9c9c7167b25bb073e91d50d Mon Sep 17 00:00:00 2001 From: Bret Richard McMillan Date: Fri, 10 Jul 2009 18:12:58 +0000 Subject: [PATCH 2/9] patch for cve-2009-2334 --- cve-2009-2334.patch | 113 ++++++++++++++++++++++++++++++++++++++++++++ wordpress-mu.spec | 7 ++- 2 files changed, 119 insertions(+), 1 deletion(-) create mode 100644 cve-2009-2334.patch diff --git a/cve-2009-2334.patch b/cve-2009-2334.patch new file mode 100644 index 0000000..1fe7abf --- /dev/null +++ b/cve-2009-2334.patch @@ -0,0 +1,113 @@ +diff --git a/wp-admin/includes/plugin.php b/wp-admin/includes/plugin.php +index 796c4c9..1dd38ce 100644 +--- a/wp-admin/includes/plugin.php ++++ b/wp-admin/includes/plugin.php +@@ -541,7 +541,7 @@ function uninstall_plugin($plugin) { + // + + function add_menu_page( $page_title, $menu_title, $access_level, $file, $function = '', $icon_url = '' ) { +- global $menu, $admin_page_hooks; ++ global $menu, $admin_page_hooks, $_registered_pages; + + $file = plugin_basename( $file ); + +@@ -556,11 +556,13 @@ function add_menu_page( $page_title, $menu_title, $access_level, $file, $functio + + $menu[] = array ( $menu_title, $access_level, $file, $page_title, 'menu-top ' . $hookname, $hookname, $icon_url ); + ++ $_registered_pages[$hookname] = true; ++ + return $hookname; + } + + function add_object_page( $page_title, $menu_title, $access_level, $file, $function = '', $icon_url = '') { +- global $menu, $admin_page_hooks, $_wp_last_object_menu; ++ global $menu, $admin_page_hooks, $_wp_last_object_menu, $_registered_pages; + + $file = plugin_basename( $file ); + +@@ -577,11 +579,13 @@ function add_object_page( $page_title, $menu_title, $access_level, $file, $funct + + $menu[$_wp_last_object_menu] = array ( $menu_title, $access_level, $file, $page_title, 'menu-top ' . $hookname, $hookname, $icon_url ); + ++ $_registered_pages[$hookname] = true; ++ + return $hookname; + } + + function add_utility_page( $page_title, $menu_title, $access_level, $file, $function = '', $icon_url = '') { +- global $menu, $admin_page_hooks, $_wp_last_utility_menu; ++ global $menu, $admin_page_hooks, $_wp_last_utility_menu, $_registered_pages; + + $file = plugin_basename( $file ); + +@@ -598,6 +602,8 @@ function add_utility_page( $page_title, $menu_title, $access_level, $file, $func + + $menu[$_wp_last_utility_menu] = array ( $menu_title, $access_level, $file, $page_title, 'menu-top ' . $hookname, $hookname, $icon_url ); + ++ $_registered_pages[$hookname] = true; ++ + return $hookname; + } + +@@ -606,6 +612,7 @@ function add_submenu_page( $parent, $page_title, $menu_title, $access_level, $fi + global $menu; + global $_wp_real_parent_file; + global $_wp_submenu_nopriv; ++ global $_registered_pages; + + $file = plugin_basename( $file ); + +@@ -635,6 +642,8 @@ function add_submenu_page( $parent, $page_title, $menu_title, $access_level, $fi + if (!empty ( $function ) && !empty ( $hookname )) + add_action( $hookname, $function ); + ++ $_registered_pages[$hookname] = true; ++ + return $hookname; + } + +@@ -859,14 +868,21 @@ function user_can_access_admin_page() { + global $_wp_menu_nopriv; + global $_wp_submenu_nopriv; + global $plugin_page; ++ global $_registered_pages; + + $parent = get_admin_page_parent(); + +- if ( isset( $_wp_submenu_nopriv[$parent][$pagenow] ) ) ++ if ( !isset( $plugin_page ) && isset( $_wp_submenu_nopriv[$parent][$pagenow] ) ) + return false; + +- if ( isset( $plugin_page ) && isset( $_wp_submenu_nopriv[$parent][$plugin_page] ) ) +- return false; ++ if ( isset( $plugin_page ) ) { ++ if ( isset( $_wp_submenu_nopriv[$parent][$plugin_page] ) ) ++ return false; ++ ++ $hookname = get_plugin_page_hookname($plugin_page, $parent); ++ if ( !isset($_registered_pages[$hookname]) ) ++ return false; ++ } + + if ( empty( $parent) ) { + if ( isset( $_wp_menu_nopriv[$pagenow] ) ) +@@ -875,6 +891,8 @@ function user_can_access_admin_page() { + return false; + if ( isset( $plugin_page ) && isset( $_wp_submenu_nopriv[$pagenow][$plugin_page] ) ) + return false; ++ if ( isset( $plugin_page ) && isset( $_wp_menu_nopriv[$plugin_page] ) ) ++ return false; + foreach (array_keys( $_wp_submenu_nopriv ) as $key ) { + if ( isset( $_wp_submenu_nopriv[$key][$pagenow] ) ) + return false; +@@ -884,6 +902,9 @@ function user_can_access_admin_page() { + return true; + } + ++ if ( isset( $plugin_page ) && ( $plugin_page == $parent ) && isset( $_wp_menu_nopriv[$plugin_page] ) ) ++ return false; ++ + if ( isset( $submenu[$parent] ) ) { + foreach ( $submenu[$parent] as $submenu_array ) { + if ( isset( $plugin_page ) && ( $submenu_array[2] == $plugin_page ) ) { diff --git a/wordpress-mu.spec b/wordpress-mu.spec index fed14bb..53ba0b9 100644 --- a/wordpress-mu.spec +++ b/wordpress-mu.spec @@ -2,12 +2,13 @@ Summary: WordPress-MU multi-user blogging software URL: http://mu.wordpress.org/latest.tar.gz Name: wordpress-mu Version: 2.7 -Release: 5%{?dist} +Release: 6%{?dist} Group: Applications/Publishing License: GPLv2 Source0: %{name}-%{version}.tar.gz Source1: wordpress-mu-httpd-conf Source2: README.fedora.wordpress-mu +Patch0: cve-2009-2334.patch BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) Requires: php >= 4.1.0, httpd, php-mysql BuildArch: noarch @@ -18,6 +19,7 @@ one instance to serve multiple users. %prep %setup -q -n wordpress-mu +%patch0 -p1 -b .patch1 # disable-wordpress-core-update, updates are always installed via rpm # @@ -98,6 +100,9 @@ rm -rf %{buildroot} %dir %{_sysconfdir}/wordpress-mu %changelog +* Fri Jul 10 2009 Bret McMillan - 2.7-6 +- Patch for CVE-2009-2334 + * Wed Feb 25 2009 Fedora Release Engineering - 2.7-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild From c91171f2e6484f31f0e963693cb00098d4c71f99 Mon Sep 17 00:00:00 2001 From: Bret Richard McMillan Date: Wed, 12 Aug 2009 17:31:39 +0000 Subject: [PATCH 3/9] update to 2.8.4a for security fixes --- .cvsignore | 1 + sources | 1 + wordpress-mu.spec | 10 ++++++---- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.cvsignore b/.cvsignore index ca82e68..63636b0 100644 --- a/.cvsignore +++ b/.cvsignore @@ -1 +1,2 @@ wordpress-mu-2.7.tar.gz +wordpress-mu-2.8.4a.tar.gz diff --git a/sources b/sources index 68fdf49..e157a09 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ b7d119c663833a3fe00d30224530447e wordpress-mu-2.7.tar.gz +72dcdfaa60ede87d320b479579028d5e wordpress-mu-2.8.4a.tar.gz diff --git a/wordpress-mu.spec b/wordpress-mu.spec index 53ba0b9..03a2c72 100644 --- a/wordpress-mu.spec +++ b/wordpress-mu.spec @@ -1,14 +1,13 @@ Summary: WordPress-MU multi-user blogging software URL: http://mu.wordpress.org/latest.tar.gz Name: wordpress-mu -Version: 2.7 -Release: 6%{?dist} +Version: 2.8.4a +Release: 1%{?dist} Group: Applications/Publishing License: GPLv2 Source0: %{name}-%{version}.tar.gz Source1: wordpress-mu-httpd-conf Source2: README.fedora.wordpress-mu -Patch0: cve-2009-2334.patch BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) Requires: php >= 4.1.0, httpd, php-mysql BuildArch: noarch @@ -19,7 +18,6 @@ one instance to serve multiple users. %prep %setup -q -n wordpress-mu -%patch0 -p1 -b .patch1 # disable-wordpress-core-update, updates are always installed via rpm # @@ -90,6 +88,7 @@ rm -rf %{buildroot} %{_datadir}/wordpress-mu/wp-mail.php %{_datadir}/wordpress-mu/wp-pass.php %{_datadir}/wordpress-mu/wp-rdf.php +%{_datadir}/wordpress-mu/wp-register.php %{_datadir}/wordpress-mu/wp-rss.php %{_datadir}/wordpress-mu/wp-rss2.php %{_datadir}/wordpress-mu/wp-settings.php @@ -100,6 +99,9 @@ rm -rf %{buildroot} %dir %{_sysconfdir}/wordpress-mu %changelog +* Wed Aug 12 2009 Bret McMillan - 2.8.4a-1 +- Update to version 2.8.4a for security fixes + * Fri Jul 10 2009 Bret McMillan - 2.7-6 - Patch for CVE-2009-2334 From 19dae22a624a4a2af7947d6f1660207f2f7acf67 Mon Sep 17 00:00:00 2001 From: Bret Richard McMillan Date: Fri, 6 Nov 2009 22:01:20 +0000 Subject: [PATCH 4/9] updating to 2.8.5.2 for security fixes --- wordpress-mu.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/wordpress-mu.spec b/wordpress-mu.spec index 03a2c72..6f6d099 100644 --- a/wordpress-mu.spec +++ b/wordpress-mu.spec @@ -1,7 +1,7 @@ Summary: WordPress-MU multi-user blogging software URL: http://mu.wordpress.org/latest.tar.gz Name: wordpress-mu -Version: 2.8.4a +Version: 2.8.5.2 Release: 1%{?dist} Group: Applications/Publishing License: GPLv2 @@ -99,6 +99,9 @@ rm -rf %{buildroot} %dir %{_sysconfdir}/wordpress-mu %changelog +* Fri Nov 6 2009 Bret McMillan - 2.8.5.2-1 +- Update to version 2.8.5.2 for security fixes + * Wed Aug 12 2009 Bret McMillan - 2.8.4a-1 - Update to version 2.8.4a for security fixes From f6a960319db9d69f69b9e48fa95ec503f5cabd60 Mon Sep 17 00:00:00 2001 From: Bret Richard McMillan Date: Fri, 6 Nov 2009 22:09:10 +0000 Subject: [PATCH 5/9] updating sources --- .cvsignore | 3 +-- sources | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/.cvsignore b/.cvsignore index 63636b0..785848a 100644 --- a/.cvsignore +++ b/.cvsignore @@ -1,2 +1 @@ -wordpress-mu-2.7.tar.gz -wordpress-mu-2.8.4a.tar.gz +wordpress-mu-2.8.5.2.tar.gz diff --git a/sources b/sources index e157a09..dbddd58 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ -b7d119c663833a3fe00d30224530447e wordpress-mu-2.7.tar.gz -72dcdfaa60ede87d320b479579028d5e wordpress-mu-2.8.4a.tar.gz +7d733e276cb5983f58a39365bc97b81e wordpress-mu-2.8.5.2.tar.gz From 1f3509e47847f8cb5449d1b182157399dc127b8b Mon Sep 17 00:00:00 2001 From: Bill Nottingham Date: Thu, 26 Nov 2009 01:18:11 +0000 Subject: [PATCH 6/9] Fix typo that causes a failure to update the common directory. (releng #2781) --- Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index 70626f2..58736f5 100644 --- a/Makefile +++ b/Makefile @@ -1,10 +1,10 @@ # Makefile for source rpm: wordpress-mu -# $Id$ +# $Id: Makefile,v 1.1 2008/08/25 19:55:16 kevin Exp $ NAME := wordpress-mu SPECFILE = $(firstword $(wildcard *.spec)) define find-makefile-common -for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done +for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done endef MAKEFILE_COMMON := $(shell $(find-makefile-common)) From 0e21a9c93fc391482f9ae41db3104e0e8e54ca66 Mon Sep 17 00:00:00 2001 From: Bret Richard McMillan Date: Mon, 30 Nov 2009 22:12:42 +0000 Subject: [PATCH 7/9] update to 2.8.6 --- .cvsignore | 2 +- sources | 2 +- wordpress-mu.spec | 5 ++++- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/.cvsignore b/.cvsignore index 785848a..fd7d8a5 100644 --- a/.cvsignore +++ b/.cvsignore @@ -1 +1 @@ -wordpress-mu-2.8.5.2.tar.gz +wordpress-mu-2.8.6.tar.gz diff --git a/sources b/sources index dbddd58..7244037 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -7d733e276cb5983f58a39365bc97b81e wordpress-mu-2.8.5.2.tar.gz +dfa27af33afe0c206933e509edd5835c wordpress-mu-2.8.6.tar.gz diff --git a/wordpress-mu.spec b/wordpress-mu.spec index 6f6d099..d995e43 100644 --- a/wordpress-mu.spec +++ b/wordpress-mu.spec @@ -1,7 +1,7 @@ Summary: WordPress-MU multi-user blogging software URL: http://mu.wordpress.org/latest.tar.gz Name: wordpress-mu -Version: 2.8.5.2 +Version: 2.8.6 Release: 1%{?dist} Group: Applications/Publishing License: GPLv2 @@ -99,6 +99,9 @@ rm -rf %{buildroot} %dir %{_sysconfdir}/wordpress-mu %changelog +* Mon Nov 30 2009 Bret McMillan - 2.8.6-1 +- update to 2.8.6; couple of security fixes, including 1 XSS + * Fri Nov 6 2009 Bret McMillan - 2.8.5.2-1 - Update to version 2.8.5.2 for security fixes From 0eb4c1e735e2c66c7cbc75d9dfda2f47483ce307 Mon Sep 17 00:00:00 2001 From: Bret Richard McMillan Date: Fri, 29 Jan 2010 18:54:07 +0000 Subject: [PATCH 8/9] updating to 2.9.1.1 --- .cvsignore | 2 +- sources | 2 +- wordpress-mu.spec | 7 ++++++- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.cvsignore b/.cvsignore index fd7d8a5..6ced768 100644 --- a/.cvsignore +++ b/.cvsignore @@ -1 +1 @@ -wordpress-mu-2.8.6.tar.gz +wordpress-mu-2.9.1.1.tar.gz diff --git a/sources b/sources index 7244037..33adc56 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -dfa27af33afe0c206933e509edd5835c wordpress-mu-2.8.6.tar.gz +85ffe0c80032257e99ca65c8fe978d3a wordpress-mu-2.9.1.1.tar.gz diff --git a/wordpress-mu.spec b/wordpress-mu.spec index d995e43..dee3cc9 100644 --- a/wordpress-mu.spec +++ b/wordpress-mu.spec @@ -1,7 +1,7 @@ Summary: WordPress-MU multi-user blogging software URL: http://mu.wordpress.org/latest.tar.gz Name: wordpress-mu -Version: 2.8.6 +Version: 2.9.1.1 Release: 1%{?dist} Group: Applications/Publishing License: GPLv2 @@ -99,6 +99,11 @@ rm -rf %{buildroot} %dir %{_sysconfdir}/wordpress-mu %changelog +* Fri Jan 29 2010 Bret McMillan - 2.9.1.1-1 +- collected bug fixes and enhancements from wordpress 2.9.x merged into wpmu 2.9.1 +- Plugins options fix: http://trac.mu.wordpress.org/ticket/1193 +- wp_getUserBlogs fix: http://trac.mu.wordpress.org/ticket/1195 + * Mon Nov 30 2009 Bret McMillan - 2.8.6-1 - update to 2.8.6; couple of security fixes, including 1 XSS From 22e4f60fb8476eb31c295c105f336ffc4a19cf33 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 29 Jul 2010 15:24:01 +0000 Subject: [PATCH 9/9] dist-git conversion --- .cvsignore => .gitignore | 0 Makefile | 21 --------------------- branch | 1 - import.log | 1 - 4 files changed, 23 deletions(-) rename .cvsignore => .gitignore (100%) delete mode 100644 Makefile delete mode 100644 branch delete mode 100644 import.log diff --git a/.cvsignore b/.gitignore similarity index 100% rename from .cvsignore rename to .gitignore diff --git a/Makefile b/Makefile deleted file mode 100644 index 58736f5..0000000 --- a/Makefile +++ /dev/null @@ -1,21 +0,0 @@ -# Makefile for source rpm: wordpress-mu -# $Id: Makefile,v 1.1 2008/08/25 19:55:16 kevin Exp $ -NAME := wordpress-mu -SPECFILE = $(firstword $(wildcard *.spec)) - -define find-makefile-common -for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done -endef - -MAKEFILE_COMMON := $(shell $(find-makefile-common)) - -ifeq ($(MAKEFILE_COMMON),) -# attept a checkout -define checkout-makefile-common -test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2 -endef - -MAKEFILE_COMMON := $(shell $(checkout-makefile-common)) -endif - -include $(MAKEFILE_COMMON) diff --git a/branch b/branch deleted file mode 100644 index 25c7708..0000000 --- a/branch +++ /dev/null @@ -1 +0,0 @@ -F-11 diff --git a/import.log b/import.log deleted file mode 100644 index 83b639a..0000000 --- a/import.log +++ /dev/null @@ -1 +0,0 @@ -wordpress-mu-2_6_1-1_fc8:HEAD:wordpress-mu-2.6.1-1.fc8.src.rpm:1220452323