- never bundle ca-bundle.crt (EL-5)

- provide nginx configuration (fedora)
- drop mandatory dependency on httpd (suggested) #1336091
- protect php files in uploads directory

wordpress-httpd-conf

@@ -1,5 +1,8 @@
 Alias /wordpress /usr/share/wordpress
 
+# Access is only allowed via local access
+# Change this once configured
+
 <Directory /usr/share/wordpress>
   AllowOverride Options
   <IfModule mod_authz_core.c>
@@ -15,7 +18,16 @@ Alias /wordpress /usr/share/wordpress
  </IfModule>
 </Directory>
 
+<Directory /usr/share/wordpress/wp-content/uploads>
+  # Deny access to any php file in the uploads directory
+  <FilesMatch "\.(php)$">
+    Order Deny,Allow
+    Deny from all
+  </FilesMatch>
+</Directory>
+
 <Directory /usr/share/wordpress/wp-content/plugins/akismet>
+  # Deny access to any php file in the akismet directory
   <FilesMatch "\.(php|txt)$">
     Order Deny,Allow
     Deny from all

wordpress-nginx-conf

@@ -0,0 +1,35 @@
+# Wordpress
+
+location = /wordpress {
+    alias /usr/share/wordpress/;
+}
+
+location /wordpress/ {
+    root /usr/share;
+    index index.php;
+
+    location ~ ^/wordpress/wp-content/uploads/(.+)\.php$ {
+        # Deny access to any php file in the uploads directory
+        deny all;
+    }
+    location ~ ^/wordpress/wp-content/plugins/akismet/(.+)\.php$ {
+        # Deny access to any php file in the akismet directory
+        deny all;
+    }
+
+    # Access is only allowed via local access
+    # Change this once configured
+    location ~ ^/wordpress/(.+\.php)$ {
+        allow 127.0.0.1;
+        allow ::1;
+        deny all;
+
+        try_files $uri =404;
+        fastcgi_intercept_errors on;
+        include        fastcgi_params;
+        fastcgi_param  SERVER_NAME      $host;
+        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
+        fastcgi_pass   php-fpm;
+    }
+}
+

wordpress.spec

@@ -8,11 +8,12 @@
 %{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}-%{version}}
 %global wp_content %{_datadir}/wordpress/wp-content
 
-%if 0%{?rhel} == 5
-%global with_cacert 0
+%if 0%{?fedora} >= 21
+%global with_nginx 1
 %else
-%global with_cacert 1
+%global with_nginx 0
 %endif
+
 # https://bugzilla.redhat.com/1147817 php53-getid3 review
 %if 0%{?fedora} >= 17 || 0%{?rhel} >= 6
 %global with_getid3 1
@@ -26,13 +27,14 @@ URL:        http://www.wordpress.org
 Name:       wordpress
 Version:    4.5.2
 Group:      Applications/Publishing
-Release:    1%{?dist}
+Release:    2%{?dist}
 License:    GPLv2
 
 Source0:    http://wordpress.org/%{name}-%{version}%{?prever:-%{prever}}.tar.gz
 Source1:    wordpress-httpd-conf
 Source2:    README.fedora.wordpress
 Source3:    README.fedora.wordpress-mu
+Source4:    wordpress-nginx-conf
 
 # Patch out copyrighted text of Hello, Dolly
 # (and replace it with Free Software Song)
@@ -68,7 +70,16 @@ Requires: php53-simplepie >= 1.3.1
 Requires: php53-getid3
 %endif
 %else
+%if %{with_nginx}
+Requires: webserver
+Requires: php(httpd)
+Suggests: httpd
+# For directory ownership
+Requires: httpd-filesystem
+Requires: nginx-filesystem
+%else
 Requires: php >= 5.2.4
+%endif
 Requires: php-simplepie >= 1.3.1
 %if %{with_getid3}
 Requires: php-getid3
@@ -104,9 +115,8 @@ Requires: php-zlib
 # Unbundled libraries
 Requires: php-PHPMailer
 Requires: httpd
-%if %{with_cacert}
-Requires: ca-certificates
-%endif
+# ca-certificates (excepted on EL-5)
+Requires: %{_sysconfdir}/pki/tls/certs/ca-bundle.crt
 Provides: wordpress-mu = %{version}-%{release}
 Obsoletes: wordpress-mu < 2.9.3
 
@@ -191,6 +201,10 @@ sed -i -e 's/\r//' license.txt
 # Apache configuration
 install -m 0644 -D -p %{SOURCE1} ${RPM_BUILD_ROOT}%{_sysconfdir}/httpd/conf.d/wordpress.conf
 
+%if %{with_nginx}
+install -m 0644 -D -p %{SOURCE4} ${RPM_BUILD_ROOT}%{_sysconfdir}/nginx/default.d/wordpress.conf
+%endif
+
 # Application
 mkdir -p ${RPM_BUILD_ROOT}%{_datadir}/wordpress
 cp -pr * ${RPM_BUILD_ROOT}%{_datadir}/wordpress
@@ -234,11 +248,9 @@ rm -r ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/ID3
 %endif
 
 # Remove bundled ca-bundle.crt
-%if %{with_cacert}
 rm ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/certificates/ca-bundle.crt
-ln -s /etc/pki/tls/certs/ca-bundle.crt \
+ln -s %{_sysconfdir}/pki/tls/certs/ca-bundle.crt \
    ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/certificates/ca-bundle.crt
-%endif
 
 # Remove backup copies of patches
 find ${RPM_BUILD_ROOT} \( -name \*.dolly -o -name \*.rhbz522897 -o -name \*.orig \) \
@@ -264,6 +276,9 @@ rm -rf ${RPM_BUILD_ROOT}
 %files
 %defattr(-,root,root,-)
 %config(noreplace) %{_sysconfdir}/httpd/conf.d/wordpress.conf
+%if %{with_nginx}
+%config(noreplace) %{_sysconfdir}/nginx/default.d/wordpress.conf
+%endif
 %dir %{_datadir}/wordpress
 %{_datadir}/wordpress/wp-admin
 %{_datadir}/wordpress/wp-includes
@@ -288,6 +303,12 @@ rm -rf ${RPM_BUILD_ROOT}
 
 
 %changelog
+* Sat May 14 2016 Remi Collet <remi@fedoraproject.org> - 4.5.2-2
+- never bundle ca-bundle.crt (EL-5)
+- provide nginx configuration (fedora)
+- drop mandatory dependency on httpd (suggested) #1336091
+- protect php files in uploads directory
+
 * Tue May 10 2016 Remi Collet <remi@fedoraproject.org> - 4.5.2-1
 - WordPress 4.5.2 Security Release