diff --git a/.gitignore b/.gitignore index 5bac55a..02d21e0 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1 @@ -wordpress-mu-2.9.1.1.tar.gz -/wordpress-mu-2.9.2.tar.gz +wordpress-mu-2.9.2.tar.gz diff --git a/README.fedora.wordpress-mu b/README.fedora.wordpress-mu new file mode 100644 index 0000000..2fba019 --- /dev/null +++ b/README.fedora.wordpress-mu @@ -0,0 +1,20 @@ +Alias /wordpress-mu /usr/share/wordpress-mu + + + AllowOverride Options + RewriteEngine On + + RewriteBase /wordpress-mu/ + + #uploaded files + RewriteRule ^(.*/)?files/$ index.php [L] + RewriteRule ^(.*/)?files/(.*) wp-content/blogs.php?file=$2 [L] + + RewriteCond %{REQUEST_FILENAME} -f [OR] + RewriteCond %{REQUEST_FILENAME} -d + RewriteRule . - [L] + RewriteRule ^([_0-9a-zA-Z-]+/)?(wp-.*) $2 [L] + RewriteRule ^([_0-9a-zA-Z-]+/)?(.*\.php)$ $2 [L] + RewriteRule . index.php [L] + + diff --git a/dead.package b/dead.package deleted file mode 100644 index 9caa2aa..0000000 --- a/dead.package +++ /dev/null @@ -1,2 +0,0 @@ -Deprecated by upstream as of wordpress 3.0.x. Obsoleted by wordpress -package, which now includes a README on migrating from -mu. diff --git a/sources b/sources new file mode 100644 index 0000000..d402cca --- /dev/null +++ b/sources @@ -0,0 +1 @@ +3dff1dd886414ef80ffddba7a33172bf wordpress-mu-2.9.2.tar.gz diff --git a/wordpress-mu-2.9.2-r16625.patch b/wordpress-mu-2.9.2-r16625.patch new file mode 100644 index 0000000..38cff4b --- /dev/null +++ b/wordpress-mu-2.9.2-r16625.patch @@ -0,0 +1,9 @@ +--- wp-includes/comment.php~ 2009-12-21 11:46:30.000000000 -0600 ++++ wp-includes/comment.php 2010-12-23 09:35:38.596027997 -0600 +@@ -1590,5 +1590,5 @@ + $pinged[] = $tb_ping; + } else { +- $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET to_ping = TRIM(REPLACE(to_ping, '$tb_ping', '')) WHERE ID = %d", $post_id) ); ++ $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET to_ping = TRIM(REPLACE(to_ping, %s, '')) WHERE ID = %d", $tb_ping, $post_id) ); + } + } diff --git a/wordpress-mu-2.9.2-r17172.patch b/wordpress-mu-2.9.2-r17172.patch new file mode 100644 index 0000000..b78b7ae --- /dev/null +++ b/wordpress-mu-2.9.2-r17172.patch @@ -0,0 +1,92 @@ +diff -r -U2 wordpress.orig/wp-includes/formatting.php wordpress/wp-includes/formatting.php +--- wordpress.orig/wp-includes/formatting.php 2009-11-11 17:10:13.000000000 -0600 ++++ wordpress/wp-includes/formatting.php 2011-01-11 10:34:13.970920002 -0600 +@@ -2092,6 +2092,7 @@ + // Replace ampersands and single quotes only when displaying. + if ( 'display' == $context ) { +- $url = preg_replace('/&([^#])(?![a-z]{2,8};)/', '&$1', $url); +- $url = str_replace( "'", ''', $url ); ++ $url = wp_kses_normalize_entities( $url ); ++ $url = str_replace( '&', '&', $url ); ++ $url = str_replace( "'", ''', $url ); + } + +diff -r -U2 wordpress.orig/wp-includes/kses.php wordpress/wp-includes/kses.php +--- wordpress.orig/wp-includes/kses.php 2009-07-08 04:53:22.000000000 -0500 ++++ wordpress/wp-includes/kses.php 2011-01-11 10:47:04.468920001 -0600 +@@ -534,5 +534,5 @@ + } + +- if ( $arreach['name'] == 'style' ) { ++ if ( strtolower($arreach['name']) == 'style' ) { + $orig_value = $arreach['value']; + +@@ -626,5 +626,5 @@ + { + $thisval = $match[1]; +- if ( in_array($attrname, $uris) ) ++ if ( in_array(strtolower($attrname), $uris) ) + $thisval = wp_kses_bad_protocol($thisval, $allowed_protocols); + +@@ -642,5 +642,5 @@ + { + $thisval = $match[1]; +- if ( in_array($attrname, $uris) ) ++ if ( in_array(strtolower($attrname), $uris) ) + $thisval = wp_kses_bad_protocol($thisval, $allowed_protocols); + +@@ -658,5 +658,5 @@ + { + $thisval = $match[1]; +- if ( in_array($attrname, $uris) ) ++ if ( in_array(strtolower($attrname), $uris) ) + $thisval = wp_kses_bad_protocol($thisval, $allowed_protocols); + +@@ -882,12 +882,7 @@ + */ + function wp_kses_bad_protocol_once($string, $allowed_protocols) { +- global $_kses_allowed_protocols; +- $_kses_allowed_protocols = $allowed_protocols; +- +- $string2 = preg_split('/:|:|:/i', $string, 2); +- if ( isset($string2[1]) && !preg_match('%/\?%', $string2[0]) ) +- $string = wp_kses_bad_protocol_once2($string2[0]) . trim($string2[1]); +- else +- $string = preg_replace_callback('/^((&[^;]*;|[\sA-Za-z0-9])*)'.'(:|:|&#[Xx]3[Aa];)\s*/', 'wp_kses_bad_protocol_once2', $string); ++ $string2 = preg_split( '/:|�*58;|�*3a;/i', $string, 2 ); ++ if ( isset($string2[1]) && ! preg_match('%/\?%', $string2[0]) ) ++ $string = wp_kses_bad_protocol_once2( $string2[0], $allowed_protocols ) . trim( $string2[1] ); + + return $string; +@@ -903,19 +898,9 @@ + * @since 1.0.0 + * +- * @param mixed $matches string or preg_replace_callback() matches array to check for bad protocols ++ * @param string $string URI scheme to check against the whitelist ++ * @param string $allowed_protocols Allowed protocols + * @return string Sanitized content + */ +-function wp_kses_bad_protocol_once2($matches) { +- global $_kses_allowed_protocols; +- +- if ( is_array($matches) ) { +- if ( ! isset($matches[1]) || empty($matches[1]) ) +- return ''; +- +- $string = $matches[1]; +- } else { +- $string = $matches; +- } +- ++function wp_kses_bad_protocol_once2( $string, $allowed_protocols ) { + $string2 = wp_kses_decode_entities($string); + $string2 = preg_replace('/\s/', '', $string2); +@@ -926,6 +911,6 @@ + + $allowed = false; +- foreach ( (array) $_kses_allowed_protocols as $one_protocol) +- if (strtolower($one_protocol) == $string2) { ++ foreach ( (array) $allowed_protocols as $one_protocol ) ++ if ( strtolower($one_protocol) == $string2 ) { + $allowed = true; + break; diff --git a/wordpress-mu-httpd-conf b/wordpress-mu-httpd-conf new file mode 100644 index 0000000..49685e8 --- /dev/null +++ b/wordpress-mu-httpd-conf @@ -0,0 +1,25 @@ +Alias /wordpress-mu /usr/share/wordpress-mu + + + AllowOverride Options + RewriteEngine On + + RewriteBase /wordpress-mu/ + + #uploaded files + RewriteRule ^(.*/)?files/$ index.php [L] + RewriteCond %{REQUEST_URI} !.*wp-content/plugins.* + RewriteRule ^(.*/)?files/(.*) wp-content/blogs.php?file=$2 [L] + + # add a trailing slash to /wp-admin + RewriteCond %{REQUEST_URI} ^.*/wp-admin$ + RewriteRule ^(.+)$ $1/ [R=301,L] + + RewriteCond %{REQUEST_FILENAME} -f [OR] + RewriteCond %{REQUEST_FILENAME} -d + RewriteRule . - [L] + RewriteRule ^([_0-9a-zA-Z-]+/)?(wp-.*) $2 [L] + RewriteRule ^([_0-9a-zA-Z-]+/)?(.*\.php)$ $2 [L] + RewriteRule . index.php [L] + + diff --git a/wordpress-mu.spec b/wordpress-mu.spec new file mode 100644 index 0000000..553378b --- /dev/null +++ b/wordpress-mu.spec @@ -0,0 +1,168 @@ +Summary: WordPress-MU multi-user blogging software +URL: http://mu.wordpress.org/latest.tar.gz +Name: wordpress-mu +Version: 2.9.2 +Release: 3%{?dist} +Group: Applications/Publishing +License: GPLv2 +Source0: %{name}-%{version}.tar.gz +Source1: wordpress-mu-httpd-conf +Source2: README.fedora.wordpress-mu +Patch0: wordpress-mu-2.9.2-r16625.patch +Patch1: wordpress-mu-2.9.2-r17172.patch +BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) +Requires: php >= 4.1.0, webserver, php-mysql +BuildArch: noarch + +%description +WordPress-MU is a derivative of the WordPress blogging codebase, to allow +one instance to serve multiple users. + +%prep +%setup -q -n wordpress-mu + +%patch0 -p0 -b .16625 +%patch1 -p1 -b .17172 + +# disable-wordpress-core-update, updates are always installed via rpm +# +# the sed script from wordpress.spec doesn't work due to if/else statement in upstream wordpress-mu's update.php +# sed -i -e "s,add_action,#add_action,g" wp-includes/update.php + +echo "" > wp-includes/update.php + +%build + + +%install +rm -rf %{buildroot} + +mkdir -p %{buildroot}%{_datadir}/wordpress-mu +mkdir -p %{buildroot}%{_sysconfdir}/wordpress-mu +install -m 0644 -D -p %{SOURCE1} %{buildroot}%{_sysconfdir}/httpd/conf.d/wordpress-mu.conf +install -m 0644 -D -p %{SOURCE2} %{buildroot}%{_docdir}/%{name}-%{version}/README.fedora + +cp -pr * %{buildroot}%{_datadir}/wordpress-mu + +# fix weird upstream perms... +chmod 0644 %{buildroot}%{_datadir}/wordpress-mu/wp-includes/js/tinymce/plugins/spellchecker/css/content.css +chmod 0664 %{buildroot}%{_datadir}/wordpress-mu/wp-includes/js/tinymce/plugins/spellchecker/editor_plugin.js +chmod 0664 %{buildroot}%{_datadir}/wordpress-mu/wp-includes/js/tinymce/plugins/spellchecker/config.php + + +# since we're using /etc/httpd/conf.d, don't do the funky .htaccess stuff +# that the installer wants +echo "# please see /etc/httpd/conf.d/wordpress-mu.conf" > %{buildroot}%{_datadir}/wordpress-mu/htaccess.dist + + +# Remove empty files to make rpmlint happy +find %{buildroot} -empty -exec rm -f {} \; +# These are docs, remove them from here, docify them later +rm -f %{buildroot}%{_datadir}/wordpress-mu/{license.txt,README.txt} +# remove these as well, detritus +rm -f %{buildroot}%{_datadir}/wordpress-mu/{wordpress-mu-httpd-conf,README.fedora} + + +%clean +rm -rf %{buildroot} + +%files +%defattr(-,root,root,-) +%config(noreplace) %{_sysconfdir}/httpd/conf.d/wordpress-mu.conf +%dir %{_datadir}/wordpress-mu +%{_datadir}/wordpress-mu/htaccess.dist +%{_datadir}/wordpress-mu/wp-admin +%{_datadir}/wordpress-mu/wp-content +%{_datadir}/wordpress-mu/wp-includes +%{_datadir}/wordpress-mu/index.php +%doc license.txt +%doc README.txt +%{_datadir}/wordpress-mu/index-install.php +%{_datadir}/wordpress-mu/wp-activate.php +%{_datadir}/wordpress-mu/wp-atom.php +%{_datadir}/wordpress-mu/wp-app.php +%{_datadir}/wordpress-mu/wp-blog-header.php +%{_datadir}/wordpress-mu/wp-comments-post.php +%{_datadir}/wordpress-mu/wp-commentsrss2.php +%{_datadir}/wordpress-mu/wp-config-sample.php +%{_datadir}/wordpress-mu/wp-cron.php +%{_datadir}/wordpress-mu/wp-feed.php +%{_datadir}/wordpress-mu/wp-load.php +%{_datadir}/wordpress-mu/wp-links-opml.php +%{_datadir}/wordpress-mu/wp-login.php +%{_datadir}/wordpress-mu/wp-mail.php +%{_datadir}/wordpress-mu/wp-pass.php +%{_datadir}/wordpress-mu/wp-rdf.php +%{_datadir}/wordpress-mu/wp-register.php +%{_datadir}/wordpress-mu/wp-rss.php +%{_datadir}/wordpress-mu/wp-rss2.php +%{_datadir}/wordpress-mu/wp-settings.php +%{_datadir}/wordpress-mu/wpmu-settings.php +%{_datadir}/wordpress-mu/wp-signup.php +%{_datadir}/wordpress-mu/wp-trackback.php +%{_datadir}/wordpress-mu/xmlrpc.php +%dir %{_sysconfdir}/wordpress-mu + +%changelog +* Tue Jan 11 2011 Jon Ciesla - 2.9.2-3 +- Patches for security flaws, BZ 668192. + +* Thu Dec 23 2010 Jon Ciesla - 2.9.2-2 +- Change Requires from httpd to webserver, BZ 523480. +- Patch for security vulnerability, BZ 659319. + +* Mon May 10 2010 Bret McMillan - 2.9.2-1 +- updating to 2.9.2 + +* Fri Jan 29 2010 Bret McMillan - 2.9.1.1-1 +- collected bug fixes and enhancements from wordpress 2.9.x merged into wpmu 2.9.1 +- Plugins options fix: http://trac.mu.wordpress.org/ticket/1193 +- wp_getUserBlogs fix: http://trac.mu.wordpress.org/ticket/1195 + +* Mon Nov 30 2009 Bret McMillan - 2.8.6-1 +- update to 2.8.6; couple of security fixes, including 1 XSS + +* Fri Nov 6 2009 Bret McMillan - 2.8.5.2-1 +- Update to version 2.8.5.2 for security fixes + +* Wed Aug 12 2009 Bret McMillan - 2.8.4a-1 +- Update to version 2.8.4a for security fixes + +* Thu Jul 30 2009 Bret McMillan - 2.7-8 +- fix backported for 2.8.2 comment author XSS vulnerability + +* Fri Jul 10 2009 Bret McMillan - 2.7-6 +- Patch for CVE-2009-2334 + +* Wed Feb 25 2009 Fedora Release Engineering - 2.7-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild + +* Thu Feb 12 2009 Bret McMillan - 2.7-4 +- Update to version 2.7 +- Alter source prep so I can still use upstream's tarball +- favicon.ico removed from manifest + +* Mon Dec 1 2008 Bret McMillan - 2.6.5-1 +- Update to 2.6.5 +- http://wordpress.org/development/2008/11/wordpress-265/ +- http://ocaoimh.ie/2008/11/25/wordpress-mu-265/ +- Fixes 1 XSS security issue, 3 bugs + +* Wed Sep 3 2008 Bret McMillan - 2.6.1-1 +- update to 2.6.1 + +* Tue Jul 29 2008 Bret McMillan - 2.6-7 +- added build section to the spec file + +* Wed Jul 29 2008 Bret McMillan - 2.6-6 +- rebasing to wpmu 2.6 + +* Fri May 30 2008 Bret McMillan - 1.5.1-2 +- trying to clean up how we're dealing with htaccess.dist + +* Mon May 26 2008 Bret McMillan - 1.5.1-1 +- update to 1.5.1; getting ready for Fedora submission + +* Fri Apr 25 2008 Bret McMillan - 1.3.3-1 +- initial version; copying heuristics from the base fedora wordpress pkg +