Merge branch 'f14' into f13

Conflicts:
	.gitignore

.gitignore

@@ -1,2 +1 @@
-wordpress-mu-2.9.1.1.tar.gz
-/wordpress-mu-2.9.2.tar.gz
+wordpress-mu-2.9.2.tar.gz

README.fedora.wordpress-mu

@@ -0,0 +1,20 @@
+Alias /wordpress-mu /usr/share/wordpress-mu
+
+<Directory /usr/share/wordpress-mu>
+  AllowOverride Options
+  RewriteEngine On
+
+  RewriteBase /wordpress-mu/
+
+  #uploaded files
+  RewriteRule ^(.*/)?files/$ index.php [L]
+  RewriteRule ^(.*/)?files/(.*) wp-content/blogs.php?file=$2 [L]
+
+  RewriteCond %{REQUEST_FILENAME} -f [OR]
+  RewriteCond %{REQUEST_FILENAME} -d
+  RewriteRule . - [L]
+  RewriteRule  ^([_0-9a-zA-Z-]+/)?(wp-.*) $2 [L]
+  RewriteRule  ^([_0-9a-zA-Z-]+/)?(.*\.php)$ $2 [L]
+  RewriteRule . index.php [L]
+</Directory>
+

dead.package

@@ -1,2 +0,0 @@
-Deprecated by upstream as of wordpress 3.0.x.  Obsoleted by wordpress
-package, which now includes a README on migrating from -mu.

sources

@@ -0,0 +1 @@
+3dff1dd886414ef80ffddba7a33172bf  wordpress-mu-2.9.2.tar.gz

wordpress-mu-2.9.2-r16625.patch

@@ -0,0 +1,9 @@
+--- wp-includes/comment.php~	2009-12-21 11:46:30.000000000 -0600
++++ wp-includes/comment.php	2010-12-23 09:35:38.596027997 -0600
+@@ -1590,5 +1590,5 @@
+ 				$pinged[] = $tb_ping;
+ 			} else {
+-				$wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET to_ping = TRIM(REPLACE(to_ping, '$tb_ping', '')) WHERE ID = %d", $post_id) );
++				$wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET to_ping = TRIM(REPLACE(to_ping, %s, '')) WHERE ID = %d", $tb_ping, $post_id) );
+ 			}
+ 		}

wordpress-mu-2.9.2-r17172.patch

@@ -0,0 +1,92 @@
+diff -r -U2 wordpress.orig/wp-includes/formatting.php wordpress/wp-includes/formatting.php
+--- wordpress.orig/wp-includes/formatting.php	2009-11-11 17:10:13.000000000 -0600
++++ wordpress/wp-includes/formatting.php	2011-01-11 10:34:13.970920002 -0600
+@@ -2092,6 +2092,7 @@
+ 	// Replace ampersands and single quotes only when displaying.
+ 	if ( 'display' == $context ) {
+-		$url = preg_replace('/&([^#])(?![a-z]{2,8};)/', '&$1', $url);
+-		$url = str_replace( "'", ''', $url );
++        	$url = wp_kses_normalize_entities( $url );
++        	$url = str_replace( '&', '&', $url );		
++        	$url = str_replace( "'", ''', $url );
+ 	}
+ 
+diff -r -U2 wordpress.orig/wp-includes/kses.php wordpress/wp-includes/kses.php
+--- wordpress.orig/wp-includes/kses.php	2009-07-08 04:53:22.000000000 -0500
++++ wordpress/wp-includes/kses.php	2011-01-11 10:47:04.468920001 -0600
+@@ -534,5 +534,5 @@
+ 				}
+ 
+-			if ( $arreach['name'] == 'style' ) {
++		        if ( strtolower($arreach['name']) == 'style' ) {
+ 				$orig_value = $arreach['value'];
+ 
+@@ -626,5 +626,5 @@
+ 					{
+ 					$thisval = $match[1];
+-					if ( in_array($attrname, $uris) )
++			                if ( in_array(strtolower($attrname), $uris) )
+ 						$thisval = wp_kses_bad_protocol($thisval, $allowed_protocols);
+ 
+@@ -642,5 +642,5 @@
+ 					{
+ 					$thisval = $match[1];
+-					if ( in_array($attrname, $uris) )
++					if ( in_array(strtolower($attrname), $uris) )
+ 						$thisval = wp_kses_bad_protocol($thisval, $allowed_protocols);
+ 
+@@ -658,5 +658,5 @@
+ 					{
+ 					$thisval = $match[1];
+-					if ( in_array($attrname, $uris) )
++					if ( in_array(strtolower($attrname), $uris) )
+ 						$thisval = wp_kses_bad_protocol($thisval, $allowed_protocols);
+ 
+@@ -882,12 +882,7 @@
+  */
+ function wp_kses_bad_protocol_once($string, $allowed_protocols) {
+-	global $_kses_allowed_protocols;
+-	$_kses_allowed_protocols = $allowed_protocols;
+-
+-	$string2 = preg_split('/:|:|:/i', $string, 2);
+-	if ( isset($string2[1]) && !preg_match('%/\?%', $string2[0]) )
+-		$string = wp_kses_bad_protocol_once2($string2[0]) . trim($string2[1]);
+-	else
+-		$string = preg_replace_callback('/^((&[^;]*;|[\sA-Za-z0-9])*)'.'(:|:|&#[Xx]3[Aa];)\s*/', 'wp_kses_bad_protocol_once2', $string);
++    $string2 = preg_split( '/:|&#0*58;|&#x0*3a;/i', $string, 2 );
++    if ( isset($string2[1]) && ! preg_match('%/\?%', $string2[0]) )
++        $string = wp_kses_bad_protocol_once2( $string2[0], $allowed_protocols ) . trim( $string2[1] );
+ 
+ 	return $string;
+@@ -903,19 +898,9 @@
+  * @since 1.0.0
+  *
+- * @param mixed $matches string or preg_replace_callback() matches array to check for bad protocols
++ * @param string $string URI scheme to check against the whitelist
++ * @param string $allowed_protocols Allowed protocols
+  * @return string Sanitized content
+  */
+-function wp_kses_bad_protocol_once2($matches) {
+-	global $_kses_allowed_protocols;
+-
+-	if ( is_array($matches) ) {
+-		if ( ! isset($matches[1]) || empty($matches[1]) )
+-			return '';
+-
+-		$string = $matches[1];
+-	} else {
+-		$string = $matches;
+-	}
+-
++function wp_kses_bad_protocol_once2( $string, $allowed_protocols ) {
+ 	$string2 = wp_kses_decode_entities($string);
+ 	$string2 = preg_replace('/\s/', '', $string2);
+@@ -926,6 +911,6 @@
+ 
+ 	$allowed = false;
+-	foreach ( (array) $_kses_allowed_protocols as $one_protocol)
+-		if (strtolower($one_protocol) == $string2) {
++	foreach ( (array) $allowed_protocols as $one_protocol )
++        	if ( strtolower($one_protocol) == $string2 ) {
+ 			$allowed = true;
+ 			break;

wordpress-mu-httpd-conf

@@ -0,0 +1,25 @@
+Alias /wordpress-mu /usr/share/wordpress-mu
+
+<Directory /usr/share/wordpress-mu>
+  AllowOverride Options
+  RewriteEngine On
+
+  RewriteBase /wordpress-mu/
+
+  #uploaded files
+  RewriteRule ^(.*/)?files/$ index.php [L]
+  RewriteCond %{REQUEST_URI} !.*wp-content/plugins.*
+  RewriteRule ^(.*/)?files/(.*) wp-content/blogs.php?file=$2 [L]
+
+  # add a trailing slash to /wp-admin
+  RewriteCond %{REQUEST_URI} ^.*/wp-admin$
+  RewriteRule ^(.+)$ $1/ [R=301,L]
+
+  RewriteCond %{REQUEST_FILENAME} -f [OR]
+  RewriteCond %{REQUEST_FILENAME} -d
+  RewriteRule . - [L]
+  RewriteRule  ^([_0-9a-zA-Z-]+/)?(wp-.*) $2 [L]
+  RewriteRule  ^([_0-9a-zA-Z-]+/)?(.*\.php)$ $2 [L]
+  RewriteRule . index.php [L]
+</Directory>
+

wordpress-mu.spec

@@ -0,0 +1,168 @@
+Summary: WordPress-MU multi-user blogging software
+URL: http://mu.wordpress.org/latest.tar.gz
+Name: wordpress-mu
+Version: 2.9.2
+Release: 3%{?dist}
+Group: Applications/Publishing
+License: GPLv2
+Source0: %{name}-%{version}.tar.gz
+Source1: wordpress-mu-httpd-conf
+Source2: README.fedora.wordpress-mu
+Patch0:  wordpress-mu-2.9.2-r16625.patch
+Patch1:  wordpress-mu-2.9.2-r17172.patch
+BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
+Requires: php >= 4.1.0, webserver, php-mysql
+BuildArch: noarch
+
+%description
+WordPress-MU is a derivative of the WordPress blogging codebase, to allow
+one instance to serve multiple users.
+
+%prep
+%setup -q -n wordpress-mu
+
+%patch0 -p0 -b .16625
+%patch1 -p1 -b .17172
+
+# disable-wordpress-core-update, updates are always installed via rpm
+#
+# the sed script from wordpress.spec doesn't work due to if/else statement in upstream wordpress-mu's update.php
+# sed -i -e "s,add_action,#add_action,g" wp-includes/update.php
+
+echo "<?php // update script removed, updates via RPMs for Fedora ?>" > wp-includes/update.php
+
+%build
+
+
+%install
+rm -rf %{buildroot}
+
+mkdir -p %{buildroot}%{_datadir}/wordpress-mu
+mkdir -p %{buildroot}%{_sysconfdir}/wordpress-mu
+install -m 0644 -D -p %{SOURCE1} %{buildroot}%{_sysconfdir}/httpd/conf.d/wordpress-mu.conf
+install -m 0644 -D -p %{SOURCE2} %{buildroot}%{_docdir}/%{name}-%{version}/README.fedora
+
+cp -pr * %{buildroot}%{_datadir}/wordpress-mu
+
+# fix weird upstream perms...
+chmod 0644 %{buildroot}%{_datadir}/wordpress-mu/wp-includes/js/tinymce/plugins/spellchecker/css/content.css
+chmod 0664 %{buildroot}%{_datadir}/wordpress-mu/wp-includes/js/tinymce/plugins/spellchecker/editor_plugin.js
+chmod 0664 %{buildroot}%{_datadir}/wordpress-mu/wp-includes/js/tinymce/plugins/spellchecker/config.php
+
+
+# since we're using /etc/httpd/conf.d, don't do the funky .htaccess stuff
+# that the installer wants
+echo "# please see /etc/httpd/conf.d/wordpress-mu.conf" > %{buildroot}%{_datadir}/wordpress-mu/htaccess.dist
+
+
+# Remove empty files to make rpmlint happy
+find %{buildroot} -empty -exec rm -f {} \;
+# These are docs, remove them from here, docify them later
+rm -f %{buildroot}%{_datadir}/wordpress-mu/{license.txt,README.txt}
+# remove these as well, detritus
+rm -f %{buildroot}%{_datadir}/wordpress-mu/{wordpress-mu-httpd-conf,README.fedora}
+
+
+%clean
+rm -rf %{buildroot}
+
+%files
+%defattr(-,root,root,-)
+%config(noreplace) %{_sysconfdir}/httpd/conf.d/wordpress-mu.conf
+%dir %{_datadir}/wordpress-mu
+%{_datadir}/wordpress-mu/htaccess.dist
+%{_datadir}/wordpress-mu/wp-admin
+%{_datadir}/wordpress-mu/wp-content
+%{_datadir}/wordpress-mu/wp-includes
+%{_datadir}/wordpress-mu/index.php
+%doc license.txt
+%doc README.txt
+%{_datadir}/wordpress-mu/index-install.php
+%{_datadir}/wordpress-mu/wp-activate.php
+%{_datadir}/wordpress-mu/wp-atom.php
+%{_datadir}/wordpress-mu/wp-app.php
+%{_datadir}/wordpress-mu/wp-blog-header.php
+%{_datadir}/wordpress-mu/wp-comments-post.php
+%{_datadir}/wordpress-mu/wp-commentsrss2.php
+%{_datadir}/wordpress-mu/wp-config-sample.php
+%{_datadir}/wordpress-mu/wp-cron.php
+%{_datadir}/wordpress-mu/wp-feed.php
+%{_datadir}/wordpress-mu/wp-load.php
+%{_datadir}/wordpress-mu/wp-links-opml.php
+%{_datadir}/wordpress-mu/wp-login.php
+%{_datadir}/wordpress-mu/wp-mail.php
+%{_datadir}/wordpress-mu/wp-pass.php
+%{_datadir}/wordpress-mu/wp-rdf.php
+%{_datadir}/wordpress-mu/wp-register.php
+%{_datadir}/wordpress-mu/wp-rss.php
+%{_datadir}/wordpress-mu/wp-rss2.php
+%{_datadir}/wordpress-mu/wp-settings.php
+%{_datadir}/wordpress-mu/wpmu-settings.php
+%{_datadir}/wordpress-mu/wp-signup.php
+%{_datadir}/wordpress-mu/wp-trackback.php
+%{_datadir}/wordpress-mu/xmlrpc.php
+%dir %{_sysconfdir}/wordpress-mu
+
+%changelog
+* Tue Jan 11 2011 Jon Ciesla <limb@jcomserv.net> - 2.9.2-3
+- Patches for security flaws, BZ 668192.
+
+* Thu Dec 23 2010 Jon Ciesla <limb@jcomserv.net> - 2.9.2-2
+- Change Requires from httpd to webserver, BZ 523480.
+- Patch for security vulnerability, BZ 659319.
+
+* Mon May 10 2010 Bret McMillan <bretm@redhat.com> - 2.9.2-1
+- updating to 2.9.2
+
+* Fri Jan 29 2010 Bret McMillan <bretm@redhat.com> - 2.9.1.1-1
+- collected bug fixes and enhancements from wordpress 2.9.x merged into wpmu 2.9.1
+- Plugins options fix: http://trac.mu.wordpress.org/ticket/1193
+- wp_getUserBlogs fix: http://trac.mu.wordpress.org/ticket/1195
+
+* Mon Nov 30 2009 Bret McMillan <bretm@redhat.com> - 2.8.6-1
+- update to 2.8.6; couple of security fixes, including 1 XSS
+
+* Fri Nov  6 2009 Bret McMillan <bretm@redhat.com> - 2.8.5.2-1
+- Update to version 2.8.5.2 for security fixes
+
+* Wed Aug 12 2009 Bret McMillan <bretm@redhat.com> - 2.8.4a-1
+- Update to version 2.8.4a for security fixes
+
+* Thu Jul 30 2009 Bret McMillan <bretm@redhat.com> - 2.7-8
+- fix backported for 2.8.2 comment author XSS vulnerability
+
+* Fri Jul 10 2009 Bret McMillan <bretm@redhat.com> - 2.7-6
+- Patch for CVE-2009-2334
+
+* Wed Feb 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.7-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
+
+* Thu Feb 12 2009 Bret McMillan <bretm@redhat.com> - 2.7-4
+- Update to version 2.7
+- Alter source prep so I can still use upstream's tarball
+- favicon.ico removed from manifest
+
+* Mon Dec  1 2008 Bret McMillan <bretm@redhat.com> - 2.6.5-1
+- Update to 2.6.5
+- http://wordpress.org/development/2008/11/wordpress-265/
+- http://ocaoimh.ie/2008/11/25/wordpress-mu-265/
+- Fixes 1 XSS security issue, 3 bugs
+
+* Wed Sep  3 2008 Bret McMillan <bretm@redhat.com> - 2.6.1-1
+- update to 2.6.1
+
+* Tue Jul 29 2008 Bret McMillan <bretm@redhat.com> - 2.6-7
+- added build section to the spec file
+
+* Wed Jul 29 2008 Bret McMillan <bretm@redhat.com> - 2.6-6
+- rebasing to wpmu 2.6
+
+* Fri May 30 2008 Bret McMillan <bretm@redhat.com> - 1.5.1-2
+- trying to clean up how we're dealing with htaccess.dist
+
+* Mon May 26 2008 Bret McMillan <bretm@redhat.com> - 1.5.1-1
+- update to 1.5.1; getting ready for Fedora submission
+
+* Fri Apr 25 2008 Bret McMillan <bretm@redhat.com> - 1.3.3-1
+- initial version; copying heuristics from the base fedora wordpress pkg
+