From 7f7320f0d901f612449aa500e3942d97afd65714 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@fedoraproject.org>
Date: Tue, 3 Mar 2009 20:49:45 +0000
Subject: [PATCH 01/15] Initialize branch EL-5 for wordpress-mu

---
 branch | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 branch

diff --git a/branch b/branch
new file mode 100644
index 0000000..42f697a
--- /dev/null
+++ b/branch
@@ -0,0 +1 @@
+EL-5

From 73305470eee77e590a6202d963364fd50d2e4c07 Mon Sep 17 00:00:00 2001
From: Bret Richard McMillan <bretm@fedoraproject.org>
Date: Fri, 10 Jul 2009 18:40:36 +0000
Subject: [PATCH 02/15] patch added for cve-2009-2334

---
 cve-2009-2334.patch | 113 ++++++++++++++++++++++++++++++++++++++++++++
 wordpress-mu.spec   |   7 ++-
 2 files changed, 119 insertions(+), 1 deletion(-)
 create mode 100644 cve-2009-2334.patch

diff --git a/cve-2009-2334.patch b/cve-2009-2334.patch
new file mode 100644
index 0000000..1fe7abf
--- /dev/null
+++ b/cve-2009-2334.patch
@@ -0,0 +1,113 @@
+diff --git a/wp-admin/includes/plugin.php b/wp-admin/includes/plugin.php
+index 796c4c9..1dd38ce 100644
+--- a/wp-admin/includes/plugin.php
++++ b/wp-admin/includes/plugin.php
+@@ -541,7 +541,7 @@ function uninstall_plugin($plugin) {
+ //
+ 
+ function add_menu_page( $page_title, $menu_title, $access_level, $file, $function = '', $icon_url = '' ) {
+-	global $menu, $admin_page_hooks;
++	global $menu, $admin_page_hooks, $_registered_pages;
+ 
+ 	$file = plugin_basename( $file );
+ 
+@@ -556,11 +556,13 @@ function add_menu_page( $page_title, $menu_title, $access_level, $file, $functio
+ 
+ 	$menu[] = array ( $menu_title, $access_level, $file, $page_title, 'menu-top ' . $hookname, $hookname, $icon_url );
+ 
++	$_registered_pages[$hookname] = true;
++
+ 	return $hookname;
+ }
+ 
+ function add_object_page( $page_title, $menu_title, $access_level, $file, $function = '', $icon_url = '') {
+-	global $menu, $admin_page_hooks, $_wp_last_object_menu;
++	global $menu, $admin_page_hooks, $_wp_last_object_menu, $_registered_pages;
+ 
+ 	$file = plugin_basename( $file );
+ 
+@@ -577,11 +579,13 @@ function add_object_page( $page_title, $menu_title, $access_level, $file, $funct
+ 
+ 	$menu[$_wp_last_object_menu] = array ( $menu_title, $access_level, $file, $page_title, 'menu-top ' . $hookname, $hookname, $icon_url );
+ 
++	$_registered_pages[$hookname] = true;
++
+ 	return $hookname;
+ }
+ 
+ function add_utility_page( $page_title, $menu_title, $access_level, $file, $function = '', $icon_url = '') {
+-	global $menu, $admin_page_hooks, $_wp_last_utility_menu;
++	global $menu, $admin_page_hooks, $_wp_last_utility_menu, $_registered_pages;
+ 
+ 	$file = plugin_basename( $file );
+ 
+@@ -598,6 +602,8 @@ function add_utility_page( $page_title, $menu_title, $access_level, $file, $func
+ 
+ 	$menu[$_wp_last_utility_menu] = array ( $menu_title, $access_level, $file, $page_title, 'menu-top ' . $hookname, $hookname, $icon_url );
+ 
++	$_registered_pages[$hookname] = true;
++
+ 	return $hookname;
+ }
+ 
+@@ -606,6 +612,7 @@ function add_submenu_page( $parent, $page_title, $menu_title, $access_level, $fi
+ 	global $menu;
+ 	global $_wp_real_parent_file;
+ 	global $_wp_submenu_nopriv;
++	global $_registered_pages;
+ 
+ 	$file = plugin_basename( $file );
+ 
+@@ -635,6 +642,8 @@ function add_submenu_page( $parent, $page_title, $menu_title, $access_level, $fi
+ 	if (!empty ( $function ) && !empty ( $hookname ))
+ 		add_action( $hookname, $function );
+ 
++	$_registered_pages[$hookname] = true;
++
+ 	return $hookname;
+ }
+ 
+@@ -859,14 +868,21 @@ function user_can_access_admin_page() {
+ 	global $_wp_menu_nopriv;
+ 	global $_wp_submenu_nopriv;
+ 	global $plugin_page;
++        global $_registered_pages;
+ 
+ 	$parent = get_admin_page_parent();
+ 
+-	if ( isset( $_wp_submenu_nopriv[$parent][$pagenow] ) )
++        if ( !isset( $plugin_page ) && isset( $_wp_submenu_nopriv[$parent][$pagenow] ) )
+ 		return false;
+ 
+-	if ( isset( $plugin_page ) && isset( $_wp_submenu_nopriv[$parent][$plugin_page] ) )
+-		return false;
++        if ( isset( $plugin_page ) ) {
++                if ( isset( $_wp_submenu_nopriv[$parent][$plugin_page] ) )
++                       return false;
++
++                $hookname = get_plugin_page_hookname($plugin_page, $parent);
++                if ( !isset($_registered_pages[$hookname]) )
++                        return false;
++        }
+ 
+ 	if ( empty( $parent) ) {
+ 		if ( isset( $_wp_menu_nopriv[$pagenow] ) )
+@@ -875,6 +891,8 @@ function user_can_access_admin_page() {
+ 			return false;
+ 		if ( isset( $plugin_page ) && isset( $_wp_submenu_nopriv[$pagenow][$plugin_page] ) )
+ 			return false;
++		if ( isset( $plugin_page ) && isset( $_wp_menu_nopriv[$plugin_page] ) )
++			return false;
+ 		foreach (array_keys( $_wp_submenu_nopriv ) as $key ) {
+ 			if ( isset( $_wp_submenu_nopriv[$key][$pagenow] ) )
+ 				return false;
+@@ -884,6 +902,9 @@ function user_can_access_admin_page() {
+ 		return true;
+ 	}
+ 
++	if ( isset( $plugin_page ) && ( $plugin_page == $parent ) && isset( $_wp_menu_nopriv[$plugin_page] ) )
++		return false;
++
+ 	if ( isset( $submenu[$parent] ) ) {
+ 		foreach ( $submenu[$parent] as $submenu_array ) {
+ 			if ( isset( $plugin_page ) && ( $submenu_array[2] == $plugin_page ) ) {
diff --git a/wordpress-mu.spec b/wordpress-mu.spec
index fed14bb..53ba0b9 100644
--- a/wordpress-mu.spec
+++ b/wordpress-mu.spec
@@ -2,12 +2,13 @@ Summary: WordPress-MU multi-user blogging software
 URL: http://mu.wordpress.org/latest.tar.gz
 Name: wordpress-mu
 Version: 2.7
-Release: 5%{?dist}
+Release: 6%{?dist}
 Group: Applications/Publishing
 License: GPLv2
 Source0: %{name}-%{version}.tar.gz
 Source1: wordpress-mu-httpd-conf
 Source2: README.fedora.wordpress-mu
+Patch0: cve-2009-2334.patch
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 Requires: php >= 4.1.0, httpd, php-mysql
 BuildArch: noarch
@@ -18,6 +19,7 @@ one instance to serve multiple users.
 
 %prep
 %setup -q -n wordpress-mu
+%patch0 -p1 -b .patch1
 
 # disable-wordpress-core-update, updates are always installed via rpm
 #
@@ -98,6 +100,9 @@ rm -rf %{buildroot}
 %dir %{_sysconfdir}/wordpress-mu
 
 %changelog
+* Fri Jul 10 2009 Bret McMillan <bretm@redhat.com> - 2.7-6
+- Patch for CVE-2009-2334
+
 * Wed Feb 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.7-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
 

From 707d303fd7aa536381d79cce926c770dd0aa9173 Mon Sep 17 00:00:00 2001
From: Bret Richard McMillan <bretm@fedoraproject.org>
Date: Thu, 30 Jul 2009 16:40:58 +0000
Subject: [PATCH 03/15] backport of 2.8.2 XSS fix

---
 2.8.2-commentor-fix.patch | 146 ++++++++++++++++++++++++++++++++++++++
 wordpress-mu.spec         |   7 +-
 2 files changed, 152 insertions(+), 1 deletion(-)
 create mode 100644 2.8.2-commentor-fix.patch

diff --git a/2.8.2-commentor-fix.patch b/2.8.2-commentor-fix.patch
new file mode 100644
index 0000000..4e6ba4b
--- /dev/null
+++ b/2.8.2-commentor-fix.patch
@@ -0,0 +1,146 @@
+commit e8f2fc7acb6da2fc30a154ca6431449f0ea0d527
+Author: Bret McMillan <bretm@redhat.com>
+Date:   Thu Jul 30 11:39:44 2009 -0400
+
+    backport of fixes for WordPress 2.8.2 XSS vulnerability
+
+diff --git a/wp-admin/comment.php b/wp-admin/comment.php
+index 00ea590..d92a717 100644
+--- a/wp-admin/comment.php
++++ b/wp-admin/comment.php
+@@ -22,7 +22,7 @@ if ( isset( $_POST['deletecomment'] ) )
+  *
+  * @param string $msg Error Message. Assumed to contain HTML and be sanitized.
+  */
+-function comment_footer_die( $msg ) {  //
++function comment_footer_die( $msg ) {
+ 	echo "<div class='wrap'><p>$msg</p></div>";
+ 	include('admin-footer.php');
+ 	die;
+@@ -119,7 +119,7 @@ if ( 'spam' == $_GET['dt'] ) {
+ <?php if ( $comment->comment_author_url ) { ?>
+ <tr>
+ <th scope="row"><?php _e('URL'); ?></th>
+-<td><a href='<?php echo $comment->comment_author_url; ?>'><?php echo $comment->comment_author_url; ?></a></td>
++<td><a href="<?php echo $comment->comment_author_url; ?>"><?php echo $comment->comment_author_url; ?></a></td>
+ </tr>
+ <?php } ?>
+ <tr>
+diff --git a/wp-admin/edit-form-comment.php b/wp-admin/edit-form-comment.php
+index 531db65..40bede5 100644
+--- a/wp-admin/edit-form-comment.php
++++ b/wp-admin/edit-form-comment.php
+@@ -12,7 +12,8 @@
+ $submitbutton_text = __('Edit Comment');
+ $toprow_title = sprintf(__('Editing Comment # %s'), $comment->comment_ID);
+ $form_action = 'editedcomment';
+-$form_extra = "' />\n<input type='hidden' name='comment_ID' value='" . $comment->comment_ID . "' />\n<input type='hidden' name='comment_post_ID' value='" . $comment->comment_post_ID;
++$form_extra = "' />\n<input type='hidden' name='comment_ID' value='" . attribute_escape($comment->comment_ID) . "' />\n<input type='hidden' name='comment_post_ID' value='" . attribute_escape($comment->comment_post_ID);
++$comment->comment_author_email = attribute_escape($comment->comment_author_email);
+ ?>
+ 
+ <form name="post" action="comment.php" method="post" id="post">
+@@ -24,12 +25,6 @@ $form_extra = "' />\n<input type='hidden' name='comment_ID' value='" . $comment-
+ <div id="poststuff" class="metabox-holder">
+ <input type="hidden" name="user_ID" value="<?php echo (int) $user_ID ?>" />
+ <input type="hidden" name="action" value='<?php echo $form_action . $form_extra ?>' />
+-<?php
+-
+-$email = attribute_escape( $comment->comment_author_email );
+-$url = attribute_escape( $comment->comment_author_url );
+-// add_meta_box('submitdiv', __('Save'), 'comment_submit_meta_box', 'comment', 'side', 'core');
+-?>
+ 
+ <div id="side-info-column" class="inner-sidebar">
+ <div id="submitdiv" class="stuffbox" >
+@@ -95,25 +90,24 @@ $date = date_i18n( $datef, strtotime( $comment->comment_date ) );
+ <tr valign="top">
+ 	<td class="first">
+ 	<?php
+-		if ( $email ) {
++		if ( $comment->comment_author_email ) {
+ 			printf( __( 'E-mail (%s):' ), get_comment_author_email_link( __( 'send e-mail' ), '', '' ) );
+ 		} else {
+ 			_e( 'E-mail:' );
+ 		}
+ ?></td>
+-	<td><input type="text" name="newcomment_author_email" size="30" value="<?php echo $email; ?>" tabindex="2" id="email" /></td>
++	<td><input type="text" name="newcomment_author_email" size="30" value="<?php echo $comment->comment_author_email; ?>" tabindex="2" id="email" /></td>
+ </tr>
+ <tr valign="top">
+ 	<td class="first">
+ 	<?php
+-		$url = get_comment_author_url();
+-		if ( ! empty( $url ) && 'http://' != $url ) {
+-			$link = "<a href='$url' rel='external nofollow' target='_blank'>" . __('visit site') . "</a>";
++		if ( ! empty( $comment->comment_author_url ) && 'http://' != $comment->comment_author_url ) {
++			$link = '<a href="' . $comment->comment_author_url . '" rel="external nofollow" target="_blank">' . __('visit site') . '</a>';
+ 			printf( __( 'URL (%s):' ), apply_filters('get_comment_author_link', $link ) );
+ 		} else {
+ 			_e( 'URL:' );
+ 		} ?></td>
+-	<td><input type="text" id="newcomment_author_url" name="newcomment_author_url" size="30" value="<?php echo $url; ?>" tabindex="3" /></td>
++	<td><input type="text" id="newcomment_author_url" name="newcomment_author_url" size="30" value="<?php echo attribute_escape($comment->comment_author_url); ?>" tabindex="3" /></td>
+ </tr>
+ </tbody>
+ </table>
+diff --git a/wp-admin/includes/template.php b/wp-admin/includes/template.php
+index e89ea83..075da6a 100644
+--- a/wp-admin/includes/template.php
++++ b/wp-admin/includes/template.php
+@@ -1960,9 +1960,7 @@ function _wp_comment_row( $comment_id, $mode, $comment_status, $checkbox = true,
+ 	$author_url = get_comment_author_url();
+ 	if ( 'http://' == $author_url )
+ 		$author_url = '';
+-	$author_url_display = $author_url;
+-	$author_url_display = str_replace('http://www.', '', $author_url_display);
+-	$author_url_display = str_replace('http://', '', $author_url_display);
++	$author_url_display = preg_replace('|http://(www\.)?|i', '', $author_url);
+ 	if ( strlen($author_url_display) > 50 )
+ 		$author_url_display = substr($author_url_display, 0, 49) . '...';
+ 
+diff --git a/wp-includes/comment-template.php b/wp-includes/comment-template.php
+index a4a126b..f31f6b5 100644
+--- a/wp-includes/comment-template.php
++++ b/wp-includes/comment-template.php
+@@ -193,7 +193,9 @@ function comment_author_IP() {
+  */
+ function get_comment_author_url() {
+ 	global $comment;
+-	return apply_filters('get_comment_author_url', $comment->comment_author_url);
++	$url = ('http://' == $comment->comment_author_url) ? '' : $comment->comment_author_url;
++	$url = clean_url( $url, array('http', 'https') );
++	return apply_filters('get_comment_author_url', $url);
+ }
+ 
+ /**
+@@ -809,8 +811,28 @@ function comments_template( $file = '/comments.php', $separate_comments = false
+ 		$file = '/comments.php';
+ 
+ 	$req = get_option('require_name_email');
++
++	/**
++	 * Comment author information fetched from the comment cookies.
++	 *
++	 * @uses wp_get_current_commenter()
++	 */
+ 	$commenter = wp_get_current_commenter();
+-	extract($commenter, EXTR_SKIP);
++
++	/**
++	 * The name of the current comment author escaped for use in attributes.
++	 */
++	$comment_author = $commenter['comment_author']; // Escaped by sanitize_comment_cookies()
++
++	/**
++	 * The email address of the current comment author escaped for use in attributes.
++	 */	
++	$comment_author_email = $commenter['comment_author_email'];  // Escaped by sanitize_comment_cookies()
++
++	/**
++	 * The url of the current comment author escaped for use in attributes.
++	 */	
++	$comment_author_url = clean_url($commenter['comment_author_url']);
+ 
+ 	/** @todo Use API instead of SELECTs. */
+ 	if ( $user_ID) {
diff --git a/wordpress-mu.spec b/wordpress-mu.spec
index 53ba0b9..36505eb 100644
--- a/wordpress-mu.spec
+++ b/wordpress-mu.spec
@@ -2,13 +2,14 @@ Summary: WordPress-MU multi-user blogging software
 URL: http://mu.wordpress.org/latest.tar.gz
 Name: wordpress-mu
 Version: 2.7
-Release: 6%{?dist}
+Release: 8%{?dist}
 Group: Applications/Publishing
 License: GPLv2
 Source0: %{name}-%{version}.tar.gz
 Source1: wordpress-mu-httpd-conf
 Source2: README.fedora.wordpress-mu
 Patch0: cve-2009-2334.patch
+Patch1: 2.8.2-commentor-fix.patch
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 Requires: php >= 4.1.0, httpd, php-mysql
 BuildArch: noarch
@@ -20,6 +21,7 @@ one instance to serve multiple users.
 %prep
 %setup -q -n wordpress-mu
 %patch0 -p1 -b .patch1
+%patch1 -p1 -b .patch2
 
 # disable-wordpress-core-update, updates are always installed via rpm
 #
@@ -100,6 +102,9 @@ rm -rf %{buildroot}
 %dir %{_sysconfdir}/wordpress-mu
 
 %changelog
+* Thu Jul 30 2009 Bret McMillan <bretm@koom> - 2.7-8
+- fix backported for 2.8.2 comment author XSS vulnerability
+
 * Fri Jul 10 2009 Bret McMillan <bretm@redhat.com> - 2.7-6
 - Patch for CVE-2009-2334
 

From 1e1d882a0c1a9b5ec185e8040090bcfc1ebdf5db Mon Sep 17 00:00:00 2001
From: Bret Richard McMillan <bretm@fedoraproject.org>
Date: Wed, 12 Aug 2009 15:57:07 +0000
Subject: [PATCH 04/15] update to 2.8.4a, includes security fixes

---
 wordpress-mu.spec | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/wordpress-mu.spec b/wordpress-mu.spec
index 36505eb..a6751de 100644
--- a/wordpress-mu.spec
+++ b/wordpress-mu.spec
@@ -1,15 +1,13 @@
 Summary: WordPress-MU multi-user blogging software
 URL: http://mu.wordpress.org/latest.tar.gz
 Name: wordpress-mu
-Version: 2.7
-Release: 8%{?dist}
+Version: 2.8.4a
+Release: 1%{?dist}
 Group: Applications/Publishing
 License: GPLv2
 Source0: %{name}-%{version}.tar.gz
 Source1: wordpress-mu-httpd-conf
 Source2: README.fedora.wordpress-mu
-Patch0: cve-2009-2334.patch
-Patch1: 2.8.2-commentor-fix.patch
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 Requires: php >= 4.1.0, httpd, php-mysql
 BuildArch: noarch
@@ -20,8 +18,6 @@ one instance to serve multiple users.
 
 %prep
 %setup -q -n wordpress-mu
-%patch0 -p1 -b .patch1
-%patch1 -p1 -b .patch2
 
 # disable-wordpress-core-update, updates are always installed via rpm
 #
@@ -92,6 +88,7 @@ rm -rf %{buildroot}
 %{_datadir}/wordpress-mu/wp-mail.php
 %{_datadir}/wordpress-mu/wp-pass.php
 %{_datadir}/wordpress-mu/wp-rdf.php
+%{_datadir}/wordpress-mu/wp-register.php
 %{_datadir}/wordpress-mu/wp-rss.php
 %{_datadir}/wordpress-mu/wp-rss2.php
 %{_datadir}/wordpress-mu/wp-settings.php
@@ -102,7 +99,10 @@ rm -rf %{buildroot}
 %dir %{_sysconfdir}/wordpress-mu
 
 %changelog
-* Thu Jul 30 2009 Bret McMillan <bretm@koom> - 2.7-8
+* Wed Aug 12 2009 Bret McMillan <bretm@redhat.com> - 2.8.4a-1
+- Update to version 2.8.4a for security fixes
+
+* Thu Jul 30 2009 Bret McMillan <bretm@redhat.com> - 2.7-8
 - fix backported for 2.8.2 comment author XSS vulnerability
 
 * Fri Jul 10 2009 Bret McMillan <bretm@redhat.com> - 2.7-6

From a160f2be947d397a61e79987a3acb20e3c377bca Mon Sep 17 00:00:00 2001
From: Bret Richard McMillan <bretm@fedoraproject.org>
Date: Wed, 12 Aug 2009 15:57:48 +0000
Subject: [PATCH 05/15] update to 2.8.4a sources

---
 .cvsignore | 1 +
 sources    | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.cvsignore b/.cvsignore
index ca82e68..63636b0 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1 +1,2 @@
 wordpress-mu-2.7.tar.gz
+wordpress-mu-2.8.4a.tar.gz
diff --git a/sources b/sources
index 68fdf49..e157a09 100644
--- a/sources
+++ b/sources
@@ -1 +1,2 @@
 b7d119c663833a3fe00d30224530447e  wordpress-mu-2.7.tar.gz
+72dcdfaa60ede87d320b479579028d5e  wordpress-mu-2.8.4a.tar.gz

From bc24c1fd8091d58bcf639c12f158b2463c5ee06f Mon Sep 17 00:00:00 2001
From: Bret Richard McMillan <bretm@fedoraproject.org>
Date: Fri, 6 Nov 2009 21:45:56 +0000
Subject: [PATCH 06/15] updating to 2.8.5.2 for security fixes

---
 .cvsignore        | 3 +--
 sources           | 3 +--
 wordpress-mu.spec | 5 ++++-
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/.cvsignore b/.cvsignore
index 63636b0..785848a 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1,2 +1 @@
-wordpress-mu-2.7.tar.gz
-wordpress-mu-2.8.4a.tar.gz
+wordpress-mu-2.8.5.2.tar.gz
diff --git a/sources b/sources
index e157a09..dbddd58 100644
--- a/sources
+++ b/sources
@@ -1,2 +1 @@
-b7d119c663833a3fe00d30224530447e  wordpress-mu-2.7.tar.gz
-72dcdfaa60ede87d320b479579028d5e  wordpress-mu-2.8.4a.tar.gz
+7d733e276cb5983f58a39365bc97b81e  wordpress-mu-2.8.5.2.tar.gz
diff --git a/wordpress-mu.spec b/wordpress-mu.spec
index a6751de..87ce971 100644
--- a/wordpress-mu.spec
+++ b/wordpress-mu.spec
@@ -1,7 +1,7 @@
 Summary: WordPress-MU multi-user blogging software
 URL: http://mu.wordpress.org/latest.tar.gz
 Name: wordpress-mu
-Version: 2.8.4a
+Version: 2.8.5.2
 Release: 1%{?dist}
 Group: Applications/Publishing
 License: GPLv2
@@ -99,6 +99,9 @@ rm -rf %{buildroot}
 %dir %{_sysconfdir}/wordpress-mu
 
 %changelog
+* Fri Nov  6 2009 Bret McMillan <bretm@redhat.com> - 2.8.5.2-1
+- Update to version 2.8.5.2 for security fixes
+
 * Wed Aug 12 2009 Bret McMillan <bretm@redhat.com> - 2.8.4a-1
 - Update to version 2.8.4a for security fixes
 

From 06e49ca457352ee80e1b27ab14b5547434c512f9 Mon Sep 17 00:00:00 2001
From: Bill Nottingham <notting@fedoraproject.org>
Date: Thu, 26 Nov 2009 01:18:10 +0000
Subject: [PATCH 07/15] Fix typo that causes a failure to update the common
 directory. (releng     #2781)

---
 Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index 70626f2..58736f5 100644
--- a/Makefile
+++ b/Makefile
@@ -1,10 +1,10 @@
 # Makefile for source rpm: wordpress-mu
-# $Id$
+# $Id: Makefile,v 1.1 2008/08/25 19:55:16 kevin Exp $
 NAME := wordpress-mu
 SPECFILE = $(firstword $(wildcard *.spec))
 
 define find-makefile-common
-for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
+for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
 endef
 
 MAKEFILE_COMMON := $(shell $(find-makefile-common))

From 49cc728ac26c93d294b0e6ba1aec381655017f29 Mon Sep 17 00:00:00 2001
From: Bret Richard McMillan <bretm@fedoraproject.org>
Date: Mon, 30 Nov 2009 22:12:42 +0000
Subject: [PATCH 08/15] update to 2.8.6

---
 .cvsignore        | 2 +-
 sources           | 2 +-
 wordpress-mu.spec | 5 ++++-
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/.cvsignore b/.cvsignore
index 785848a..fd7d8a5 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1 +1 @@
-wordpress-mu-2.8.5.2.tar.gz
+wordpress-mu-2.8.6.tar.gz
diff --git a/sources b/sources
index dbddd58..7244037 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-7d733e276cb5983f58a39365bc97b81e  wordpress-mu-2.8.5.2.tar.gz
+dfa27af33afe0c206933e509edd5835c  wordpress-mu-2.8.6.tar.gz
diff --git a/wordpress-mu.spec b/wordpress-mu.spec
index 87ce971..2f2856f 100644
--- a/wordpress-mu.spec
+++ b/wordpress-mu.spec
@@ -1,7 +1,7 @@
 Summary: WordPress-MU multi-user blogging software
 URL: http://mu.wordpress.org/latest.tar.gz
 Name: wordpress-mu
-Version: 2.8.5.2
+Version: 2.8.6
 Release: 1%{?dist}
 Group: Applications/Publishing
 License: GPLv2
@@ -99,6 +99,9 @@ rm -rf %{buildroot}
 %dir %{_sysconfdir}/wordpress-mu
 
 %changelog
+* Mon Nov 30 2009 Bret McMillan <bretm@redhat.com> - 2.8.6-1
+- update to 2.8.6; couple of security fixes, including 1 XSS
+
 * Fri Nov  6 2009 Bret McMillan <bretm@redhat.com> - 2.8.5.2-1
 - Update to version 2.8.5.2 for security fixes
 

From 550f7bb816e3d0de51a47aa96beb5320e8bb1c0f Mon Sep 17 00:00:00 2001
From: Bret Richard McMillan <bretm@fedoraproject.org>
Date: Fri, 29 Jan 2010 16:40:25 +0000
Subject: [PATCH 09/15] updating to 2.9.1.1

---
 .cvsignore        | 2 +-
 sources           | 2 +-
 wordpress-mu.spec | 7 ++++++-
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/.cvsignore b/.cvsignore
index fd7d8a5..6ced768 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1 +1 @@
-wordpress-mu-2.8.6.tar.gz
+wordpress-mu-2.9.1.1.tar.gz
diff --git a/sources b/sources
index 7244037..33adc56 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-dfa27af33afe0c206933e509edd5835c  wordpress-mu-2.8.6.tar.gz
+85ffe0c80032257e99ca65c8fe978d3a  wordpress-mu-2.9.1.1.tar.gz
diff --git a/wordpress-mu.spec b/wordpress-mu.spec
index 2f2856f..59f8447 100644
--- a/wordpress-mu.spec
+++ b/wordpress-mu.spec
@@ -1,7 +1,7 @@
 Summary: WordPress-MU multi-user blogging software
 URL: http://mu.wordpress.org/latest.tar.gz
 Name: wordpress-mu
-Version: 2.8.6
+Version: 2.9.1.1
 Release: 1%{?dist}
 Group: Applications/Publishing
 License: GPLv2
@@ -99,6 +99,11 @@ rm -rf %{buildroot}
 %dir %{_sysconfdir}/wordpress-mu
 
 %changelog
+* Fri Jan 29 2010 Bret McMillan <bretm@redhat.com> - 2.9.1.1-1
+- collected bug fixes and enhancements from wordpress 2.9.x merged into wpmu 2.9.1
+- Plugins options fix: http://trac.mu.wordpress.org/ticket/1193
+- wp_getUserBlogs fix: http://trac.mu.wordpress.org/ticket/1195
+
 * Mon Nov 30 2009 Bret McMillan <bretm@redhat.com> - 2.8.6-1
 - update to 2.8.6; couple of security fixes, including 1 XSS
 

From 40e14d07c17ea2bf31c180aa3cce4bfa749d1b31 Mon Sep 17 00:00:00 2001
From: Jesse Keating <jkeating@fedoraproject.org>
Date: Wed, 17 Feb 2010 03:27:36 +0000
Subject: [PATCH 10/15] Initialize branch F-13 for wordpress-mu

---
 branch | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 branch

diff --git a/branch b/branch
new file mode 100644
index 0000000..baa94ef
--- /dev/null
+++ b/branch
@@ -0,0 +1 @@
+F-13

From 092c0e36400679ef8053f698ac9eb74128beb3ac Mon Sep 17 00:00:00 2001
From: Bret Richard McMillan <bretm@fedoraproject.org>
Date: Mon, 10 May 2010 17:48:34 +0000
Subject: [PATCH 11/15] updating sources to 2.9.2

---
 .cvsignore        | 2 +-
 sources           | 2 +-
 wordpress-mu.spec | 5 ++++-
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/.cvsignore b/.cvsignore
index 6ced768..02d21e0 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1 +1 @@
-wordpress-mu-2.9.1.1.tar.gz
+wordpress-mu-2.9.2.tar.gz
diff --git a/sources b/sources
index 33adc56..d402cca 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-85ffe0c80032257e99ca65c8fe978d3a  wordpress-mu-2.9.1.1.tar.gz
+3dff1dd886414ef80ffddba7a33172bf  wordpress-mu-2.9.2.tar.gz
diff --git a/wordpress-mu.spec b/wordpress-mu.spec
index 59f8447..5e7fbf7 100644
--- a/wordpress-mu.spec
+++ b/wordpress-mu.spec
@@ -1,7 +1,7 @@
 Summary: WordPress-MU multi-user blogging software
 URL: http://mu.wordpress.org/latest.tar.gz
 Name: wordpress-mu
-Version: 2.9.1.1
+Version: 2.9.2
 Release: 1%{?dist}
 Group: Applications/Publishing
 License: GPLv2
@@ -99,6 +99,9 @@ rm -rf %{buildroot}
 %dir %{_sysconfdir}/wordpress-mu
 
 %changelog
+* Mon May 10 2010 Bret McMillan <bretm@redhat.com> - 2.9.2-1
+- updating to 2.9.2
+
 * Fri Jan 29 2010 Bret McMillan <bretm@redhat.com> - 2.9.1.1-1
 - collected bug fixes and enhancements from wordpress 2.9.x merged into wpmu 2.9.1
 - Plugins options fix: http://trac.mu.wordpress.org/ticket/1193

From 0dea7f8c749adccd6e0d4e75071522874368a3fb Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <rel-eng@lists.fedoraproject.org>
Date: Thu, 29 Jul 2010 15:23:57 +0000
Subject: [PATCH 12/15] dist-git conversion

---
 .cvsignore => .gitignore |  0
 Makefile                 | 21 ---------------------
 branch                   |  1 -
 import.log               |  1 -
 4 files changed, 23 deletions(-)
 rename .cvsignore => .gitignore (100%)
 delete mode 100644 Makefile
 delete mode 100644 branch
 delete mode 100644 import.log

diff --git a/.cvsignore b/.gitignore
similarity index 100%
rename from .cvsignore
rename to .gitignore
diff --git a/Makefile b/Makefile
deleted file mode 100644
index 58736f5..0000000
--- a/Makefile
+++ /dev/null
@@ -1,21 +0,0 @@
-# Makefile for source rpm: wordpress-mu
-# $Id: Makefile,v 1.1 2008/08/25 19:55:16 kevin Exp $
-NAME := wordpress-mu
-SPECFILE = $(firstword $(wildcard *.spec))
-
-define find-makefile-common
-for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
-endef
-
-MAKEFILE_COMMON := $(shell $(find-makefile-common))
-
-ifeq ($(MAKEFILE_COMMON),)
-# attept a checkout
-define checkout-makefile-common
-test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
-endef
-
-MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
-endif
-
-include $(MAKEFILE_COMMON)
diff --git a/branch b/branch
deleted file mode 100644
index baa94ef..0000000
--- a/branch
+++ /dev/null
@@ -1 +0,0 @@
-F-13
diff --git a/import.log b/import.log
deleted file mode 100644
index 83b639a..0000000
--- a/import.log
+++ /dev/null
@@ -1 +0,0 @@
-wordpress-mu-2_6_1-1_fc8:HEAD:wordpress-mu-2.6.1-1.fc8.src.rpm:1220452323

From b142cb0ba0a823f0c29372304a3dcb88fd7a7124 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <rel-eng@lists.fedoraproject.org>
Date: Thu, 29 Jul 2010 15:23:59 +0000
Subject: [PATCH 13/15] dist-git conversion

---
 .cvsignore => .gitignore |  0
 Makefile                 | 21 ---------------------
 branch                   |  1 -
 import.log               |  1 -
 4 files changed, 23 deletions(-)
 rename .cvsignore => .gitignore (100%)
 delete mode 100644 Makefile
 delete mode 100644 branch
 delete mode 100644 import.log

diff --git a/.cvsignore b/.gitignore
similarity index 100%
rename from .cvsignore
rename to .gitignore
diff --git a/Makefile b/Makefile
deleted file mode 100644
index 58736f5..0000000
--- a/Makefile
+++ /dev/null
@@ -1,21 +0,0 @@
-# Makefile for source rpm: wordpress-mu
-# $Id: Makefile,v 1.1 2008/08/25 19:55:16 kevin Exp $
-NAME := wordpress-mu
-SPECFILE = $(firstword $(wildcard *.spec))
-
-define find-makefile-common
-for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
-endef
-
-MAKEFILE_COMMON := $(shell $(find-makefile-common))
-
-ifeq ($(MAKEFILE_COMMON),)
-# attept a checkout
-define checkout-makefile-common
-test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
-endef
-
-MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
-endif
-
-include $(MAKEFILE_COMMON)
diff --git a/branch b/branch
deleted file mode 100644
index 42f697a..0000000
--- a/branch
+++ /dev/null
@@ -1 +0,0 @@
-EL-5
diff --git a/import.log b/import.log
deleted file mode 100644
index 83b639a..0000000
--- a/import.log
+++ /dev/null
@@ -1 +0,0 @@
-wordpress-mu-2_6_1-1_fc8:HEAD:wordpress-mu-2.6.1-1.fc8.src.rpm:1220452323

From 97c4082295f4b24b8fc01fd11481a93143a96e60 Mon Sep 17 00:00:00 2001
From: Jon Ciesla <limb@jcomserv.net>
Date: Tue, 11 Jan 2011 11:44:28 -0600
Subject: [PATCH 14/15] Security fixes.

---
 wordpress-mu-2.9.2-r17172.patch | 92 +++++++++++++++++++++++++++++++++
 wordpress-mu.spec               |  7 ++-
 2 files changed, 98 insertions(+), 1 deletion(-)
 create mode 100644 wordpress-mu-2.9.2-r17172.patch

diff --git a/wordpress-mu-2.9.2-r17172.patch b/wordpress-mu-2.9.2-r17172.patch
new file mode 100644
index 0000000..b78b7ae
--- /dev/null
+++ b/wordpress-mu-2.9.2-r17172.patch
@@ -0,0 +1,92 @@
+diff -r -U2 wordpress.orig/wp-includes/formatting.php wordpress/wp-includes/formatting.php
+--- wordpress.orig/wp-includes/formatting.php	2009-11-11 17:10:13.000000000 -0600
++++ wordpress/wp-includes/formatting.php	2011-01-11 10:34:13.970920002 -0600
+@@ -2092,6 +2092,7 @@
+ 	// Replace ampersands and single quotes only when displaying.
+ 	if ( 'display' == $context ) {
+-		$url = preg_replace('/&([^#])(?![a-z]{2,8};)/', '&#038;$1', $url);
+-		$url = str_replace( "'", '&#039;', $url );
++        	$url = wp_kses_normalize_entities( $url );
++        	$url = str_replace( '&amp;', '&#038;', $url );		
++        	$url = str_replace( "'", '&#039;', $url );
+ 	}
+ 
+diff -r -U2 wordpress.orig/wp-includes/kses.php wordpress/wp-includes/kses.php
+--- wordpress.orig/wp-includes/kses.php	2009-07-08 04:53:22.000000000 -0500
++++ wordpress/wp-includes/kses.php	2011-01-11 10:47:04.468920001 -0600
+@@ -534,5 +534,5 @@
+ 				}
+ 
+-			if ( $arreach['name'] == 'style' ) {
++		        if ( strtolower($arreach['name']) == 'style' ) {
+ 				$orig_value = $arreach['value'];
+ 
+@@ -626,5 +626,5 @@
+ 					{
+ 					$thisval = $match[1];
+-					if ( in_array($attrname, $uris) )
++			                if ( in_array(strtolower($attrname), $uris) )
+ 						$thisval = wp_kses_bad_protocol($thisval, $allowed_protocols);
+ 
+@@ -642,5 +642,5 @@
+ 					{
+ 					$thisval = $match[1];
+-					if ( in_array($attrname, $uris) )
++					if ( in_array(strtolower($attrname), $uris) )
+ 						$thisval = wp_kses_bad_protocol($thisval, $allowed_protocols);
+ 
+@@ -658,5 +658,5 @@
+ 					{
+ 					$thisval = $match[1];
+-					if ( in_array($attrname, $uris) )
++					if ( in_array(strtolower($attrname), $uris) )
+ 						$thisval = wp_kses_bad_protocol($thisval, $allowed_protocols);
+ 
+@@ -882,12 +882,7 @@
+  */
+ function wp_kses_bad_protocol_once($string, $allowed_protocols) {
+-	global $_kses_allowed_protocols;
+-	$_kses_allowed_protocols = $allowed_protocols;
+-
+-	$string2 = preg_split('/:|&#58;|&#x3a;/i', $string, 2);
+-	if ( isset($string2[1]) && !preg_match('%/\?%', $string2[0]) )
+-		$string = wp_kses_bad_protocol_once2($string2[0]) . trim($string2[1]);
+-	else
+-		$string = preg_replace_callback('/^((&[^;]*;|[\sA-Za-z0-9])*)'.'(:|&#58;|&#[Xx]3[Aa];)\s*/', 'wp_kses_bad_protocol_once2', $string);
++    $string2 = preg_split( '/:|&#0*58;|&#x0*3a;/i', $string, 2 );
++    if ( isset($string2[1]) && ! preg_match('%/\?%', $string2[0]) )
++        $string = wp_kses_bad_protocol_once2( $string2[0], $allowed_protocols ) . trim( $string2[1] );
+ 
+ 	return $string;
+@@ -903,19 +898,9 @@
+  * @since 1.0.0
+  *
+- * @param mixed $matches string or preg_replace_callback() matches array to check for bad protocols
++ * @param string $string URI scheme to check against the whitelist
++ * @param string $allowed_protocols Allowed protocols
+  * @return string Sanitized content
+  */
+-function wp_kses_bad_protocol_once2($matches) {
+-	global $_kses_allowed_protocols;
+-
+-	if ( is_array($matches) ) {
+-		if ( ! isset($matches[1]) || empty($matches[1]) )
+-			return '';
+-
+-		$string = $matches[1];
+-	} else {
+-		$string = $matches;
+-	}
+-
++function wp_kses_bad_protocol_once2( $string, $allowed_protocols ) {
+ 	$string2 = wp_kses_decode_entities($string);
+ 	$string2 = preg_replace('/\s/', '', $string2);
+@@ -926,6 +911,6 @@
+ 
+ 	$allowed = false;
+-	foreach ( (array) $_kses_allowed_protocols as $one_protocol)
+-		if (strtolower($one_protocol) == $string2) {
++	foreach ( (array) $allowed_protocols as $one_protocol )
++        	if ( strtolower($one_protocol) == $string2 ) {
+ 			$allowed = true;
+ 			break;
diff --git a/wordpress-mu.spec b/wordpress-mu.spec
index 9a072c5..553378b 100644
--- a/wordpress-mu.spec
+++ b/wordpress-mu.spec
@@ -2,13 +2,14 @@ Summary: WordPress-MU multi-user blogging software
 URL: http://mu.wordpress.org/latest.tar.gz
 Name: wordpress-mu
 Version: 2.9.2
-Release: 2%{?dist}
+Release: 3%{?dist}
 Group: Applications/Publishing
 License: GPLv2
 Source0: %{name}-%{version}.tar.gz
 Source1: wordpress-mu-httpd-conf
 Source2: README.fedora.wordpress-mu
 Patch0:  wordpress-mu-2.9.2-r16625.patch
+Patch1:  wordpress-mu-2.9.2-r17172.patch
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 Requires: php >= 4.1.0, webserver, php-mysql
 BuildArch: noarch
@@ -21,6 +22,7 @@ one instance to serve multiple users.
 %setup -q -n wordpress-mu
 
 %patch0 -p0 -b .16625
+%patch1 -p1 -b .17172
 
 # disable-wordpress-core-update, updates are always installed via rpm
 #
@@ -102,6 +104,9 @@ rm -rf %{buildroot}
 %dir %{_sysconfdir}/wordpress-mu
 
 %changelog
+* Tue Jan 11 2011 Jon Ciesla <limb@jcomserv.net> - 2.9.2-3
+- Patches for security flaws, BZ 668192.
+
 * Thu Dec 23 2010 Jon Ciesla <limb@jcomserv.net> - 2.9.2-2
 - Change Requires from httpd to webserver, BZ 523480.
 - Patch for security vulnerability, BZ 659319.

From 703c54b536c3974c19db6df017be913ccb841956 Mon Sep 17 00:00:00 2001
From: Till Maas <opensource@till.name>
Date: Tue, 16 Sep 2014 21:48:08 +0200
Subject: [PATCH 15/15] Deprecated by upstream as of wordpress 3.0.x. 
 Obsoleted by wordpress package, which now includes a README on migrating from
 -mu.

---
 .gitignore                      |   1 -
 2.8.2-commentor-fix.patch       | 146 ---------------------------
 README.fedora.wordpress-mu      |  20 ----
 cve-2009-2334.patch             | 113 ---------------------
 dead.package                    |   2 +
 sources                         |   1 -
 wordpress-mu-2.9.2-r16625.patch |   9 --
 wordpress-mu-2.9.2-r17172.patch |  92 -----------------
 wordpress-mu-httpd-conf         |  25 -----
 wordpress-mu.spec               | 168 --------------------------------
 10 files changed, 2 insertions(+), 575 deletions(-)
 delete mode 100644 .gitignore
 delete mode 100644 2.8.2-commentor-fix.patch
 delete mode 100644 README.fedora.wordpress-mu
 delete mode 100644 cve-2009-2334.patch
 create mode 100644 dead.package
 delete mode 100644 sources
 delete mode 100644 wordpress-mu-2.9.2-r16625.patch
 delete mode 100644 wordpress-mu-2.9.2-r17172.patch
 delete mode 100644 wordpress-mu-httpd-conf
 delete mode 100644 wordpress-mu.spec

diff --git a/.gitignore b/.gitignore
deleted file mode 100644
index 02d21e0..0000000
--- a/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-wordpress-mu-2.9.2.tar.gz
diff --git a/2.8.2-commentor-fix.patch b/2.8.2-commentor-fix.patch
deleted file mode 100644
index 4e6ba4b..0000000
--- a/2.8.2-commentor-fix.patch
+++ /dev/null
@@ -1,146 +0,0 @@
-commit e8f2fc7acb6da2fc30a154ca6431449f0ea0d527
-Author: Bret McMillan <bretm@redhat.com>
-Date:   Thu Jul 30 11:39:44 2009 -0400
-
-    backport of fixes for WordPress 2.8.2 XSS vulnerability
-
-diff --git a/wp-admin/comment.php b/wp-admin/comment.php
-index 00ea590..d92a717 100644
---- a/wp-admin/comment.php
-+++ b/wp-admin/comment.php
-@@ -22,7 +22,7 @@ if ( isset( $_POST['deletecomment'] ) )
-  *
-  * @param string $msg Error Message. Assumed to contain HTML and be sanitized.
-  */
--function comment_footer_die( $msg ) {  //
-+function comment_footer_die( $msg ) {
- 	echo "<div class='wrap'><p>$msg</p></div>";
- 	include('admin-footer.php');
- 	die;
-@@ -119,7 +119,7 @@ if ( 'spam' == $_GET['dt'] ) {
- <?php if ( $comment->comment_author_url ) { ?>
- <tr>
- <th scope="row"><?php _e('URL'); ?></th>
--<td><a href='<?php echo $comment->comment_author_url; ?>'><?php echo $comment->comment_author_url; ?></a></td>
-+<td><a href="<?php echo $comment->comment_author_url; ?>"><?php echo $comment->comment_author_url; ?></a></td>
- </tr>
- <?php } ?>
- <tr>
-diff --git a/wp-admin/edit-form-comment.php b/wp-admin/edit-form-comment.php
-index 531db65..40bede5 100644
---- a/wp-admin/edit-form-comment.php
-+++ b/wp-admin/edit-form-comment.php
-@@ -12,7 +12,8 @@
- $submitbutton_text = __('Edit Comment');
- $toprow_title = sprintf(__('Editing Comment # %s'), $comment->comment_ID);
- $form_action = 'editedcomment';
--$form_extra = "' />\n<input type='hidden' name='comment_ID' value='" . $comment->comment_ID . "' />\n<input type='hidden' name='comment_post_ID' value='" . $comment->comment_post_ID;
-+$form_extra = "' />\n<input type='hidden' name='comment_ID' value='" . attribute_escape($comment->comment_ID) . "' />\n<input type='hidden' name='comment_post_ID' value='" . attribute_escape($comment->comment_post_ID);
-+$comment->comment_author_email = attribute_escape($comment->comment_author_email);
- ?>
- 
- <form name="post" action="comment.php" method="post" id="post">
-@@ -24,12 +25,6 @@ $form_extra = "' />\n<input type='hidden' name='comment_ID' value='" . $comment-
- <div id="poststuff" class="metabox-holder">
- <input type="hidden" name="user_ID" value="<?php echo (int) $user_ID ?>" />
- <input type="hidden" name="action" value='<?php echo $form_action . $form_extra ?>' />
--<?php
--
--$email = attribute_escape( $comment->comment_author_email );
--$url = attribute_escape( $comment->comment_author_url );
--// add_meta_box('submitdiv', __('Save'), 'comment_submit_meta_box', 'comment', 'side', 'core');
--?>
- 
- <div id="side-info-column" class="inner-sidebar">
- <div id="submitdiv" class="stuffbox" >
-@@ -95,25 +90,24 @@ $date = date_i18n( $datef, strtotime( $comment->comment_date ) );
- <tr valign="top">
- 	<td class="first">
- 	<?php
--		if ( $email ) {
-+		if ( $comment->comment_author_email ) {
- 			printf( __( 'E-mail (%s):' ), get_comment_author_email_link( __( 'send e-mail' ), '', '' ) );
- 		} else {
- 			_e( 'E-mail:' );
- 		}
- ?></td>
--	<td><input type="text" name="newcomment_author_email" size="30" value="<?php echo $email; ?>" tabindex="2" id="email" /></td>
-+	<td><input type="text" name="newcomment_author_email" size="30" value="<?php echo $comment->comment_author_email; ?>" tabindex="2" id="email" /></td>
- </tr>
- <tr valign="top">
- 	<td class="first">
- 	<?php
--		$url = get_comment_author_url();
--		if ( ! empty( $url ) && 'http://' != $url ) {
--			$link = "<a href='$url' rel='external nofollow' target='_blank'>" . __('visit site') . "</a>";
-+		if ( ! empty( $comment->comment_author_url ) && 'http://' != $comment->comment_author_url ) {
-+			$link = '<a href="' . $comment->comment_author_url . '" rel="external nofollow" target="_blank">' . __('visit site') . '</a>';
- 			printf( __( 'URL (%s):' ), apply_filters('get_comment_author_link', $link ) );
- 		} else {
- 			_e( 'URL:' );
- 		} ?></td>
--	<td><input type="text" id="newcomment_author_url" name="newcomment_author_url" size="30" value="<?php echo $url; ?>" tabindex="3" /></td>
-+	<td><input type="text" id="newcomment_author_url" name="newcomment_author_url" size="30" value="<?php echo attribute_escape($comment->comment_author_url); ?>" tabindex="3" /></td>
- </tr>
- </tbody>
- </table>
-diff --git a/wp-admin/includes/template.php b/wp-admin/includes/template.php
-index e89ea83..075da6a 100644
---- a/wp-admin/includes/template.php
-+++ b/wp-admin/includes/template.php
-@@ -1960,9 +1960,7 @@ function _wp_comment_row( $comment_id, $mode, $comment_status, $checkbox = true,
- 	$author_url = get_comment_author_url();
- 	if ( 'http://' == $author_url )
- 		$author_url = '';
--	$author_url_display = $author_url;
--	$author_url_display = str_replace('http://www.', '', $author_url_display);
--	$author_url_display = str_replace('http://', '', $author_url_display);
-+	$author_url_display = preg_replace('|http://(www\.)?|i', '', $author_url);
- 	if ( strlen($author_url_display) > 50 )
- 		$author_url_display = substr($author_url_display, 0, 49) . '...';
- 
-diff --git a/wp-includes/comment-template.php b/wp-includes/comment-template.php
-index a4a126b..f31f6b5 100644
---- a/wp-includes/comment-template.php
-+++ b/wp-includes/comment-template.php
-@@ -193,7 +193,9 @@ function comment_author_IP() {
-  */
- function get_comment_author_url() {
- 	global $comment;
--	return apply_filters('get_comment_author_url', $comment->comment_author_url);
-+	$url = ('http://' == $comment->comment_author_url) ? '' : $comment->comment_author_url;
-+	$url = clean_url( $url, array('http', 'https') );
-+	return apply_filters('get_comment_author_url', $url);
- }
- 
- /**
-@@ -809,8 +811,28 @@ function comments_template( $file = '/comments.php', $separate_comments = false
- 		$file = '/comments.php';
- 
- 	$req = get_option('require_name_email');
-+
-+	/**
-+	 * Comment author information fetched from the comment cookies.
-+	 *
-+	 * @uses wp_get_current_commenter()
-+	 */
- 	$commenter = wp_get_current_commenter();
--	extract($commenter, EXTR_SKIP);
-+
-+	/**
-+	 * The name of the current comment author escaped for use in attributes.
-+	 */
-+	$comment_author = $commenter['comment_author']; // Escaped by sanitize_comment_cookies()
-+
-+	/**
-+	 * The email address of the current comment author escaped for use in attributes.
-+	 */	
-+	$comment_author_email = $commenter['comment_author_email'];  // Escaped by sanitize_comment_cookies()
-+
-+	/**
-+	 * The url of the current comment author escaped for use in attributes.
-+	 */	
-+	$comment_author_url = clean_url($commenter['comment_author_url']);
- 
- 	/** @todo Use API instead of SELECTs. */
- 	if ( $user_ID) {
diff --git a/README.fedora.wordpress-mu b/README.fedora.wordpress-mu
deleted file mode 100644
index 2fba019..0000000
--- a/README.fedora.wordpress-mu
+++ /dev/null
@@ -1,20 +0,0 @@
-Alias /wordpress-mu /usr/share/wordpress-mu
-
-<Directory /usr/share/wordpress-mu>
-  AllowOverride Options
-  RewriteEngine On
-
-  RewriteBase /wordpress-mu/
-
-  #uploaded files
-  RewriteRule ^(.*/)?files/$ index.php [L]
-  RewriteRule ^(.*/)?files/(.*) wp-content/blogs.php?file=$2 [L]
-
-  RewriteCond %{REQUEST_FILENAME} -f [OR]
-  RewriteCond %{REQUEST_FILENAME} -d
-  RewriteRule . - [L]
-  RewriteRule  ^([_0-9a-zA-Z-]+/)?(wp-.*) $2 [L]
-  RewriteRule  ^([_0-9a-zA-Z-]+/)?(.*\.php)$ $2 [L]
-  RewriteRule . index.php [L]
-</Directory>
-
diff --git a/cve-2009-2334.patch b/cve-2009-2334.patch
deleted file mode 100644
index 1fe7abf..0000000
--- a/cve-2009-2334.patch
+++ /dev/null
@@ -1,113 +0,0 @@
-diff --git a/wp-admin/includes/plugin.php b/wp-admin/includes/plugin.php
-index 796c4c9..1dd38ce 100644
---- a/wp-admin/includes/plugin.php
-+++ b/wp-admin/includes/plugin.php
-@@ -541,7 +541,7 @@ function uninstall_plugin($plugin) {
- //
- 
- function add_menu_page( $page_title, $menu_title, $access_level, $file, $function = '', $icon_url = '' ) {
--	global $menu, $admin_page_hooks;
-+	global $menu, $admin_page_hooks, $_registered_pages;
- 
- 	$file = plugin_basename( $file );
- 
-@@ -556,11 +556,13 @@ function add_menu_page( $page_title, $menu_title, $access_level, $file, $functio
- 
- 	$menu[] = array ( $menu_title, $access_level, $file, $page_title, 'menu-top ' . $hookname, $hookname, $icon_url );
- 
-+	$_registered_pages[$hookname] = true;
-+
- 	return $hookname;
- }
- 
- function add_object_page( $page_title, $menu_title, $access_level, $file, $function = '', $icon_url = '') {
--	global $menu, $admin_page_hooks, $_wp_last_object_menu;
-+	global $menu, $admin_page_hooks, $_wp_last_object_menu, $_registered_pages;
- 
- 	$file = plugin_basename( $file );
- 
-@@ -577,11 +579,13 @@ function add_object_page( $page_title, $menu_title, $access_level, $file, $funct
- 
- 	$menu[$_wp_last_object_menu] = array ( $menu_title, $access_level, $file, $page_title, 'menu-top ' . $hookname, $hookname, $icon_url );
- 
-+	$_registered_pages[$hookname] = true;
-+
- 	return $hookname;
- }
- 
- function add_utility_page( $page_title, $menu_title, $access_level, $file, $function = '', $icon_url = '') {
--	global $menu, $admin_page_hooks, $_wp_last_utility_menu;
-+	global $menu, $admin_page_hooks, $_wp_last_utility_menu, $_registered_pages;
- 
- 	$file = plugin_basename( $file );
- 
-@@ -598,6 +602,8 @@ function add_utility_page( $page_title, $menu_title, $access_level, $file, $func
- 
- 	$menu[$_wp_last_utility_menu] = array ( $menu_title, $access_level, $file, $page_title, 'menu-top ' . $hookname, $hookname, $icon_url );
- 
-+	$_registered_pages[$hookname] = true;
-+
- 	return $hookname;
- }
- 
-@@ -606,6 +612,7 @@ function add_submenu_page( $parent, $page_title, $menu_title, $access_level, $fi
- 	global $menu;
- 	global $_wp_real_parent_file;
- 	global $_wp_submenu_nopriv;
-+	global $_registered_pages;
- 
- 	$file = plugin_basename( $file );
- 
-@@ -635,6 +642,8 @@ function add_submenu_page( $parent, $page_title, $menu_title, $access_level, $fi
- 	if (!empty ( $function ) && !empty ( $hookname ))
- 		add_action( $hookname, $function );
- 
-+	$_registered_pages[$hookname] = true;
-+
- 	return $hookname;
- }
- 
-@@ -859,14 +868,21 @@ function user_can_access_admin_page() {
- 	global $_wp_menu_nopriv;
- 	global $_wp_submenu_nopriv;
- 	global $plugin_page;
-+        global $_registered_pages;
- 
- 	$parent = get_admin_page_parent();
- 
--	if ( isset( $_wp_submenu_nopriv[$parent][$pagenow] ) )
-+        if ( !isset( $plugin_page ) && isset( $_wp_submenu_nopriv[$parent][$pagenow] ) )
- 		return false;
- 
--	if ( isset( $plugin_page ) && isset( $_wp_submenu_nopriv[$parent][$plugin_page] ) )
--		return false;
-+        if ( isset( $plugin_page ) ) {
-+                if ( isset( $_wp_submenu_nopriv[$parent][$plugin_page] ) )
-+                       return false;
-+
-+                $hookname = get_plugin_page_hookname($plugin_page, $parent);
-+                if ( !isset($_registered_pages[$hookname]) )
-+                        return false;
-+        }
- 
- 	if ( empty( $parent) ) {
- 		if ( isset( $_wp_menu_nopriv[$pagenow] ) )
-@@ -875,6 +891,8 @@ function user_can_access_admin_page() {
- 			return false;
- 		if ( isset( $plugin_page ) && isset( $_wp_submenu_nopriv[$pagenow][$plugin_page] ) )
- 			return false;
-+		if ( isset( $plugin_page ) && isset( $_wp_menu_nopriv[$plugin_page] ) )
-+			return false;
- 		foreach (array_keys( $_wp_submenu_nopriv ) as $key ) {
- 			if ( isset( $_wp_submenu_nopriv[$key][$pagenow] ) )
- 				return false;
-@@ -884,6 +902,9 @@ function user_can_access_admin_page() {
- 		return true;
- 	}
- 
-+	if ( isset( $plugin_page ) && ( $plugin_page == $parent ) && isset( $_wp_menu_nopriv[$plugin_page] ) )
-+		return false;
-+
- 	if ( isset( $submenu[$parent] ) ) {
- 		foreach ( $submenu[$parent] as $submenu_array ) {
- 			if ( isset( $plugin_page ) && ( $submenu_array[2] == $plugin_page ) ) {
diff --git a/dead.package b/dead.package
new file mode 100644
index 0000000..9caa2aa
--- /dev/null
+++ b/dead.package
@@ -0,0 +1,2 @@
+Deprecated by upstream as of wordpress 3.0.x.  Obsoleted by wordpress
+package, which now includes a README on migrating from -mu.
diff --git a/sources b/sources
deleted file mode 100644
index d402cca..0000000
--- a/sources
+++ /dev/null
@@ -1 +0,0 @@
-3dff1dd886414ef80ffddba7a33172bf  wordpress-mu-2.9.2.tar.gz
diff --git a/wordpress-mu-2.9.2-r16625.patch b/wordpress-mu-2.9.2-r16625.patch
deleted file mode 100644
index 38cff4b..0000000
--- a/wordpress-mu-2.9.2-r16625.patch
+++ /dev/null
@@ -1,9 +0,0 @@
---- wp-includes/comment.php~	2009-12-21 11:46:30.000000000 -0600
-+++ wp-includes/comment.php	2010-12-23 09:35:38.596027997 -0600
-@@ -1590,5 +1590,5 @@
- 				$pinged[] = $tb_ping;
- 			} else {
--				$wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET to_ping = TRIM(REPLACE(to_ping, '$tb_ping', '')) WHERE ID = %d", $post_id) );
-+				$wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET to_ping = TRIM(REPLACE(to_ping, %s, '')) WHERE ID = %d", $tb_ping, $post_id) );
- 			}
- 		}
diff --git a/wordpress-mu-2.9.2-r17172.patch b/wordpress-mu-2.9.2-r17172.patch
deleted file mode 100644
index b78b7ae..0000000
--- a/wordpress-mu-2.9.2-r17172.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-diff -r -U2 wordpress.orig/wp-includes/formatting.php wordpress/wp-includes/formatting.php
---- wordpress.orig/wp-includes/formatting.php	2009-11-11 17:10:13.000000000 -0600
-+++ wordpress/wp-includes/formatting.php	2011-01-11 10:34:13.970920002 -0600
-@@ -2092,6 +2092,7 @@
- 	// Replace ampersands and single quotes only when displaying.
- 	if ( 'display' == $context ) {
--		$url = preg_replace('/&([^#])(?![a-z]{2,8};)/', '&#038;$1', $url);
--		$url = str_replace( "'", '&#039;', $url );
-+        	$url = wp_kses_normalize_entities( $url );
-+        	$url = str_replace( '&amp;', '&#038;', $url );		
-+        	$url = str_replace( "'", '&#039;', $url );
- 	}
- 
-diff -r -U2 wordpress.orig/wp-includes/kses.php wordpress/wp-includes/kses.php
---- wordpress.orig/wp-includes/kses.php	2009-07-08 04:53:22.000000000 -0500
-+++ wordpress/wp-includes/kses.php	2011-01-11 10:47:04.468920001 -0600
-@@ -534,5 +534,5 @@
- 				}
- 
--			if ( $arreach['name'] == 'style' ) {
-+		        if ( strtolower($arreach['name']) == 'style' ) {
- 				$orig_value = $arreach['value'];
- 
-@@ -626,5 +626,5 @@
- 					{
- 					$thisval = $match[1];
--					if ( in_array($attrname, $uris) )
-+			                if ( in_array(strtolower($attrname), $uris) )
- 						$thisval = wp_kses_bad_protocol($thisval, $allowed_protocols);
- 
-@@ -642,5 +642,5 @@
- 					{
- 					$thisval = $match[1];
--					if ( in_array($attrname, $uris) )
-+					if ( in_array(strtolower($attrname), $uris) )
- 						$thisval = wp_kses_bad_protocol($thisval, $allowed_protocols);
- 
-@@ -658,5 +658,5 @@
- 					{
- 					$thisval = $match[1];
--					if ( in_array($attrname, $uris) )
-+					if ( in_array(strtolower($attrname), $uris) )
- 						$thisval = wp_kses_bad_protocol($thisval, $allowed_protocols);
- 
-@@ -882,12 +882,7 @@
-  */
- function wp_kses_bad_protocol_once($string, $allowed_protocols) {
--	global $_kses_allowed_protocols;
--	$_kses_allowed_protocols = $allowed_protocols;
--
--	$string2 = preg_split('/:|&#58;|&#x3a;/i', $string, 2);
--	if ( isset($string2[1]) && !preg_match('%/\?%', $string2[0]) )
--		$string = wp_kses_bad_protocol_once2($string2[0]) . trim($string2[1]);
--	else
--		$string = preg_replace_callback('/^((&[^;]*;|[\sA-Za-z0-9])*)'.'(:|&#58;|&#[Xx]3[Aa];)\s*/', 'wp_kses_bad_protocol_once2', $string);
-+    $string2 = preg_split( '/:|&#0*58;|&#x0*3a;/i', $string, 2 );
-+    if ( isset($string2[1]) && ! preg_match('%/\?%', $string2[0]) )
-+        $string = wp_kses_bad_protocol_once2( $string2[0], $allowed_protocols ) . trim( $string2[1] );
- 
- 	return $string;
-@@ -903,19 +898,9 @@
-  * @since 1.0.0
-  *
-- * @param mixed $matches string or preg_replace_callback() matches array to check for bad protocols
-+ * @param string $string URI scheme to check against the whitelist
-+ * @param string $allowed_protocols Allowed protocols
-  * @return string Sanitized content
-  */
--function wp_kses_bad_protocol_once2($matches) {
--	global $_kses_allowed_protocols;
--
--	if ( is_array($matches) ) {
--		if ( ! isset($matches[1]) || empty($matches[1]) )
--			return '';
--
--		$string = $matches[1];
--	} else {
--		$string = $matches;
--	}
--
-+function wp_kses_bad_protocol_once2( $string, $allowed_protocols ) {
- 	$string2 = wp_kses_decode_entities($string);
- 	$string2 = preg_replace('/\s/', '', $string2);
-@@ -926,6 +911,6 @@
- 
- 	$allowed = false;
--	foreach ( (array) $_kses_allowed_protocols as $one_protocol)
--		if (strtolower($one_protocol) == $string2) {
-+	foreach ( (array) $allowed_protocols as $one_protocol )
-+        	if ( strtolower($one_protocol) == $string2 ) {
- 			$allowed = true;
- 			break;
diff --git a/wordpress-mu-httpd-conf b/wordpress-mu-httpd-conf
deleted file mode 100644
index 49685e8..0000000
--- a/wordpress-mu-httpd-conf
+++ /dev/null
@@ -1,25 +0,0 @@
-Alias /wordpress-mu /usr/share/wordpress-mu
-
-<Directory /usr/share/wordpress-mu>
-  AllowOverride Options
-  RewriteEngine On
-
-  RewriteBase /wordpress-mu/
-
-  #uploaded files
-  RewriteRule ^(.*/)?files/$ index.php [L]
-  RewriteCond %{REQUEST_URI} !.*wp-content/plugins.*
-  RewriteRule ^(.*/)?files/(.*) wp-content/blogs.php?file=$2 [L]
-
-  # add a trailing slash to /wp-admin
-  RewriteCond %{REQUEST_URI} ^.*/wp-admin$
-  RewriteRule ^(.+)$ $1/ [R=301,L]
-
-  RewriteCond %{REQUEST_FILENAME} -f [OR]
-  RewriteCond %{REQUEST_FILENAME} -d
-  RewriteRule . - [L]
-  RewriteRule  ^([_0-9a-zA-Z-]+/)?(wp-.*) $2 [L]
-  RewriteRule  ^([_0-9a-zA-Z-]+/)?(.*\.php)$ $2 [L]
-  RewriteRule . index.php [L]
-</Directory>
-
diff --git a/wordpress-mu.spec b/wordpress-mu.spec
deleted file mode 100644
index 553378b..0000000
--- a/wordpress-mu.spec
+++ /dev/null
@@ -1,168 +0,0 @@
-Summary: WordPress-MU multi-user blogging software
-URL: http://mu.wordpress.org/latest.tar.gz
-Name: wordpress-mu
-Version: 2.9.2
-Release: 3%{?dist}
-Group: Applications/Publishing
-License: GPLv2
-Source0: %{name}-%{version}.tar.gz
-Source1: wordpress-mu-httpd-conf
-Source2: README.fedora.wordpress-mu
-Patch0:  wordpress-mu-2.9.2-r16625.patch
-Patch1:  wordpress-mu-2.9.2-r17172.patch
-BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
-Requires: php >= 4.1.0, webserver, php-mysql
-BuildArch: noarch
-
-%description
-WordPress-MU is a derivative of the WordPress blogging codebase, to allow
-one instance to serve multiple users.
-
-%prep
-%setup -q -n wordpress-mu
-
-%patch0 -p0 -b .16625
-%patch1 -p1 -b .17172
-
-# disable-wordpress-core-update, updates are always installed via rpm
-#
-# the sed script from wordpress.spec doesn't work due to if/else statement in upstream wordpress-mu's update.php
-# sed -i -e "s,add_action,#add_action,g" wp-includes/update.php
-
-echo "<?php // update script removed, updates via RPMs for Fedora ?>" > wp-includes/update.php
-
-%build
-
-
-%install
-rm -rf %{buildroot}
-
-mkdir -p %{buildroot}%{_datadir}/wordpress-mu
-mkdir -p %{buildroot}%{_sysconfdir}/wordpress-mu
-install -m 0644 -D -p %{SOURCE1} %{buildroot}%{_sysconfdir}/httpd/conf.d/wordpress-mu.conf
-install -m 0644 -D -p %{SOURCE2} %{buildroot}%{_docdir}/%{name}-%{version}/README.fedora
-
-cp -pr * %{buildroot}%{_datadir}/wordpress-mu
-
-# fix weird upstream perms...
-chmod 0644 %{buildroot}%{_datadir}/wordpress-mu/wp-includes/js/tinymce/plugins/spellchecker/css/content.css
-chmod 0664 %{buildroot}%{_datadir}/wordpress-mu/wp-includes/js/tinymce/plugins/spellchecker/editor_plugin.js
-chmod 0664 %{buildroot}%{_datadir}/wordpress-mu/wp-includes/js/tinymce/plugins/spellchecker/config.php
-
-
-# since we're using /etc/httpd/conf.d, don't do the funky .htaccess stuff
-# that the installer wants
-echo "# please see /etc/httpd/conf.d/wordpress-mu.conf" > %{buildroot}%{_datadir}/wordpress-mu/htaccess.dist
-
-
-# Remove empty files to make rpmlint happy
-find %{buildroot} -empty -exec rm -f {} \;
-# These are docs, remove them from here, docify them later
-rm -f %{buildroot}%{_datadir}/wordpress-mu/{license.txt,README.txt}
-# remove these as well, detritus
-rm -f %{buildroot}%{_datadir}/wordpress-mu/{wordpress-mu-httpd-conf,README.fedora}
-
-
-%clean
-rm -rf %{buildroot}
-
-%files
-%defattr(-,root,root,-)
-%config(noreplace) %{_sysconfdir}/httpd/conf.d/wordpress-mu.conf
-%dir %{_datadir}/wordpress-mu
-%{_datadir}/wordpress-mu/htaccess.dist
-%{_datadir}/wordpress-mu/wp-admin
-%{_datadir}/wordpress-mu/wp-content
-%{_datadir}/wordpress-mu/wp-includes
-%{_datadir}/wordpress-mu/index.php
-%doc license.txt
-%doc README.txt
-%{_datadir}/wordpress-mu/index-install.php
-%{_datadir}/wordpress-mu/wp-activate.php
-%{_datadir}/wordpress-mu/wp-atom.php
-%{_datadir}/wordpress-mu/wp-app.php
-%{_datadir}/wordpress-mu/wp-blog-header.php
-%{_datadir}/wordpress-mu/wp-comments-post.php
-%{_datadir}/wordpress-mu/wp-commentsrss2.php
-%{_datadir}/wordpress-mu/wp-config-sample.php
-%{_datadir}/wordpress-mu/wp-cron.php
-%{_datadir}/wordpress-mu/wp-feed.php
-%{_datadir}/wordpress-mu/wp-load.php
-%{_datadir}/wordpress-mu/wp-links-opml.php
-%{_datadir}/wordpress-mu/wp-login.php
-%{_datadir}/wordpress-mu/wp-mail.php
-%{_datadir}/wordpress-mu/wp-pass.php
-%{_datadir}/wordpress-mu/wp-rdf.php
-%{_datadir}/wordpress-mu/wp-register.php
-%{_datadir}/wordpress-mu/wp-rss.php
-%{_datadir}/wordpress-mu/wp-rss2.php
-%{_datadir}/wordpress-mu/wp-settings.php
-%{_datadir}/wordpress-mu/wpmu-settings.php
-%{_datadir}/wordpress-mu/wp-signup.php
-%{_datadir}/wordpress-mu/wp-trackback.php
-%{_datadir}/wordpress-mu/xmlrpc.php
-%dir %{_sysconfdir}/wordpress-mu
-
-%changelog
-* Tue Jan 11 2011 Jon Ciesla <limb@jcomserv.net> - 2.9.2-3
-- Patches for security flaws, BZ 668192.
-
-* Thu Dec 23 2010 Jon Ciesla <limb@jcomserv.net> - 2.9.2-2
-- Change Requires from httpd to webserver, BZ 523480.
-- Patch for security vulnerability, BZ 659319.
-
-* Mon May 10 2010 Bret McMillan <bretm@redhat.com> - 2.9.2-1
-- updating to 2.9.2
-
-* Fri Jan 29 2010 Bret McMillan <bretm@redhat.com> - 2.9.1.1-1
-- collected bug fixes and enhancements from wordpress 2.9.x merged into wpmu 2.9.1
-- Plugins options fix: http://trac.mu.wordpress.org/ticket/1193
-- wp_getUserBlogs fix: http://trac.mu.wordpress.org/ticket/1195
-
-* Mon Nov 30 2009 Bret McMillan <bretm@redhat.com> - 2.8.6-1
-- update to 2.8.6; couple of security fixes, including 1 XSS
-
-* Fri Nov  6 2009 Bret McMillan <bretm@redhat.com> - 2.8.5.2-1
-- Update to version 2.8.5.2 for security fixes
-
-* Wed Aug 12 2009 Bret McMillan <bretm@redhat.com> - 2.8.4a-1
-- Update to version 2.8.4a for security fixes
-
-* Thu Jul 30 2009 Bret McMillan <bretm@redhat.com> - 2.7-8
-- fix backported for 2.8.2 comment author XSS vulnerability
-
-* Fri Jul 10 2009 Bret McMillan <bretm@redhat.com> - 2.7-6
-- Patch for CVE-2009-2334
-
-* Wed Feb 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.7-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
-
-* Thu Feb 12 2009 Bret McMillan <bretm@redhat.com> - 2.7-4
-- Update to version 2.7
-- Alter source prep so I can still use upstream's tarball
-- favicon.ico removed from manifest
-
-* Mon Dec  1 2008 Bret McMillan <bretm@redhat.com> - 2.6.5-1
-- Update to 2.6.5
-- http://wordpress.org/development/2008/11/wordpress-265/
-- http://ocaoimh.ie/2008/11/25/wordpress-mu-265/
-- Fixes 1 XSS security issue, 3 bugs
-
-* Wed Sep  3 2008 Bret McMillan <bretm@redhat.com> - 2.6.1-1
-- update to 2.6.1
-
-* Tue Jul 29 2008 Bret McMillan <bretm@redhat.com> - 2.6-7
-- added build section to the spec file
-
-* Wed Jul 29 2008 Bret McMillan <bretm@redhat.com> - 2.6-6
-- rebasing to wpmu 2.6
-
-* Fri May 30 2008 Bret McMillan <bretm@redhat.com> - 1.5.1-2
-- trying to clean up how we're dealing with htaccess.dist
-
-* Mon May 26 2008 Bret McMillan <bretm@redhat.com> - 1.5.1-1
-- update to 1.5.1; getting ready for Fedora submission
-
-* Fri Apr 25 2008 Bret McMillan <bretm@redhat.com> - 1.3.3-1
-- initial version; copying heuristics from the base fedora wordpress pkg
-