v7.1

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>

.cvsignore

@@ -1 +0,0 @@
-wordpress-2.8.4.tar.gz

.gitignore

@@ -0,0 +1,2 @@
+clog
+/wordpress-*.tar.gz

Makefile

@@ -1,21 +0,0 @@
-# Makefile for source rpm: wordpress
-# $Id$
-NAME := wordpress
-SPECFILE = $(firstword $(wildcard *.spec))
-
-define find-makefile-common
-for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
-endef
-
-MAKEFILE_COMMON := $(shell $(find-makefile-common))
-
-ifeq ($(MAKEFILE_COMMON),)
-# attept a checkout
-define checkout-makefile-common
-test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
-endef
-
-MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
-endif
-
-include $(MAKEFILE_COMMON)

README.fedora.wordpress

@@ -1,3 +1,5 @@
+-------------------------------------------------------------------------------
+
 Wordpress is a database driven blogging program designed to make it exceedingly
 easy to publish an online blog, sometimes also called a weblog or journal.
 
@@ -43,3 +45,42 @@ Once that's done and the database server and web server have been started,
 open a web browser to http://localhost/wordpress/wp-admin/install.php and 
 follow the instructions given to you on the pages you see to set up the 
 database tables and begin publishing your blog.
+
+-------------------------------------------------------------------------------
+
+Wordpress ships with Flash and Silverlight plugins for the 'plupload' file
+uploader and the 'mediaelement' media player embedder. The idea is to try and
+be able to provide a multi-file uploader and an embedded video player when
+HTML5 is not available (or does not support the video format in question).
+These plugins are provided as pre-built binaries and there is no mechanism
+for building them from source during Wordpress compilation. As the inclusion
+of pre-built binaries is against Fedora policy - see
+https://fedoraproject.org/wiki/Packaging:Guidelines#No_inclusion_of_pre-built_binaries_or_libraries
+ - these plugins have been removed from the Fedora package. As a consequence:
+
+a) any Wordpress element or plugin that uses the 'plupload' will only present
+an HTML5-based multi-file uploader if HTML5 is supported by the user's browser
+or an HMTL4-based single-file uploader in HTML5 is not supported. No Flash
+or Silverlight-based multi-file uploader will be provided.
+
+b) If you try to embed media into a Wordpress post using the [video] and
+[audio] short tags, the media player will be visible if the reader is using
+a browser that has HTML5 support for the media format in question; if not, the
+'Download Media' link will be offered. No Flash or Silverlight-based player
+element will be included.
+
+-------------------------------------------------------------------------------
+
+Optional dependencies:
+
+You may wish to install the following packages:
+
+	php-pecl-imagick: optimize image transformation
+	php-pecl-ssh2: for file transfert using ssh
+
+An opcode cache is also recommended:
+	php 5.5: php-opcache
+	php 5.4: php-pecl-zendopcache
+	php 5.3: php-pecl-apc
+
+-------------------------------------------------------------------------------

README.fedora.wordpress-mu

@@ -0,0 +1,5 @@
+As of wordpress 3.0.x, upstream has deprecated wordpress-mu.  This 
+functionality has been included in mainline wordpress.  For 
+information on migrating from wordpress-mu, visit 
+http://codex.wordpress.org/Migrating_Multiple_Blogs_into_WordPress_3.0_Multisite
+

sources

@@ -1 +1 @@
-0e8b296d4e2d4189b349f1d0f727bd98  wordpress-2.8.4.tar.gz
+SHA512 (wordpress-7.1.tar.gz) = 4bb95bddeb0d30778b9d744e42f7e21507ed3070fda3e34dd41918073618181e350cf77ea8dfaacc48c59a00f50273b4a1b7a6e4c43d2a81ccfd35f27df342bc

wordpress-5.1-tinymce_noflash.patch

@@ -0,0 +1,35 @@
+diff -up wordpress/wp-includes/js/tinymce/plugins/media/plugin.js.orig wordpress/wp-includes/js/tinymce/plugins/media/plugin.js
+--- wordpress/wp-includes/js/tinymce/plugins/media/plugin.js.orig	2019-02-21 14:59:28.793415420 +0100
++++ wordpress/wp-includes/js/tinymce/plugins/media/plugin.js	2019-02-21 15:00:14.319647286 +0100
+@@ -166,7 +166,6 @@ var media = (function () {
+         mp4: 'video/mp4',
+         webm: 'video/webm',
+         ogg: 'video/ogg',
+-        swf: 'application/x-shockwave-flash'
+       };
+       var fileEnd = url.toLowerCase().split('.').pop();
+       var mime = mimes[fileEnd];
+@@ -424,14 +423,6 @@ var media = (function () {
+       var allowFullscreen = data.allowFullscreen ? ' allowFullscreen="1"' : '';
+       return '<iframe src="' + data.source1 + '" width="' + data.width + '" height="' + data.height + '"' + allowFullscreen + '></iframe>';
+     };
+-    var getFlashHtml = function (data) {
+-      var html = '<object data="' + data.source1 + '" width="' + data.width + '" height="' + data.height + '" type="application/x-shockwave-flash">';
+-      if (data.poster) {
+-        html += '<img src="' + data.poster + '" width="' + data.width + '" height="' + data.height + '" />';
+-      }
+-      html += '</object>';
+-      return html;
+-    };
+     var getAudioHtml = function (data, audioTemplateCallback) {
+       if (audioTemplateCallback) {
+         return audioTemplateCallback(data);
+@@ -494,8 +485,6 @@ var media = (function () {
+         });
+         if (data.type === 'iframe') {
+           return getIframeHtml(data);
+-        } else if (data.source1mime === 'application/x-shockwave-flash') {
+-          return getFlashHtml(data);
+         } else if (data.source1mime.indexOf('audio') !== -1) {
+           return getAudioHtml(data, audioTemplateCallback);
+         } else if (data.type === 'script') {

wordpress-5.4-config.patch

@@ -0,0 +1,35 @@
+diff -up wordpress/wp-config.php.rpm wordpress/wp-config.php
+--- wordpress/wp-config.php.rpm	2020-10-20 15:05:26.351765085 +0200
++++ wordpress/wp-config.php	2020-10-20 15:05:48.663684089 +0200
+@@ -66,6 +66,22 @@ define( 'NONCE_SALT',       'put your un
+ $table_prefix = 'wp_';
+ 
+ /**
++ * See http://make.wordpress.org/core/2013/10/25/the-definitive-guide-to-disabling-auto-updates-in-wordpress-3-7
++ */
++
++/* Disable all file change, as RPM base installation are read-only */
++define('DISALLOW_FILE_MODS', true);
++
++/* Please ensure that this is either 'direct', 'ssh2', 'ftpext', 'ftpsockets' or false */
++define('FS_METHOD', 'direct');
++
++/* Disable automatic updater, in case you want to allow
++   above FILE_MODS for plugins, themes, ... */
++define('AUTOMATIC_UPDATER_DISABLED', true);
++
++/* Core update is always disabled, WP_AUTO_UPDATE_CORE value is ignore */
++
++/**
+  * For developers: WordPress debugging mode.
+  *
+  * Change this to true to enable the display of notices during development.
+@@ -83,7 +99,7 @@ define( 'WP_DEBUG', false );
+ 
+ /** Absolute path to the WordPress directory. */
+ if ( ! defined( 'ABSPATH' ) ) {
+-	define( 'ABSPATH', __DIR__ . '/' );
++	define('ABSPATH', '/usr/share/wordpress');
+ }
+ 
+ /** Sets up WordPress vars and included files. */

wordpress-5.6-mediaelement_no_swf.patch

@@ -0,0 +1,38 @@
+diff -up wordpress/wp-includes/js/mediaelement/mediaelement-and-player.js.no wordpress/wp-includes/js/mediaelement/mediaelement-and-player.js
+--- wordpress/wp-includes/js/mediaelement/mediaelement-and-player.js.no	2020-09-29 17:53:06.000000000 +0200
++++ wordpress/wp-includes/js/mediaelement/mediaelement-and-player.js	2020-12-09 09:44:27.954254919 +0100
+@@ -6135,6 +6135,7 @@ if (hasFlash) {
+ 		}
+ 	});
+ 
++/* swf files removed from RPM
+ 	var FlashMediaElementVideoRenderer = {
+ 		name: 'flash_video',
+ 		options: {
+@@ -6219,6 +6220,7 @@ if (hasFlash) {
+ 		create: FlashMediaElementRenderer.create
+ 	};
+ 	_renderer.renderer.add(FlashMediaElementAudioOggRenderer);
++*/
+ }
+ 
+ },{"2":2,"25":25,"27":27,"28":28,"3":3,"5":5,"7":7,"8":8}],21:[function(_dereq_,module,exports){
+diff -up wordpress/wp-includes/js/mediaelement/mediaelement.js.no wordpress/wp-includes/js/mediaelement/mediaelement.js
+--- wordpress/wp-includes/js/mediaelement/mediaelement.js.no	2020-09-29 17:53:06.000000000 +0200
++++ wordpress/wp-includes/js/mediaelement/mediaelement.js	2020-12-09 09:44:38.532227178 +0100
+@@ -1842,6 +1842,7 @@ if (hasFlash) {
+ 		}
+ 	});
+ 
++/* swf files removed from RPM
+ 	var FlashMediaElementVideoRenderer = {
+ 		name: 'flash_video',
+ 		options: {
+@@ -1926,6 +1927,7 @@ if (hasFlash) {
+ 		create: FlashMediaElementRenderer.create
+ 	};
+ 	_renderer.renderer.add(FlashMediaElementAudioOggRenderer);
++*/
+ }
+ 
+ },{"16":16,"18":18,"19":19,"2":2,"3":3,"5":5,"7":7,"8":8}],12:[function(_dereq_,module,exports){

wordpress-6.8-hello.patch

@@ -0,0 +1,60 @@
+diff -up wordpress/wp-content/plugins/hello.php.dolly wordpress/wp-content/plugins/hello.php
+--- wordpress/wp-content/plugins/hello.php.dolly	2025-04-16 08:21:31.710644174 +0200
++++ wordpress/wp-content/plugins/hello.php	2025-04-16 08:23:15.011000365 +0200
+@@ -6,7 +6,7 @@
+ /*
+ Plugin Name: Hello Dolly
+ Plugin URI: http://wordpress.org/plugins/hello-dolly/
+-Description: This is not just a plugin, it symbolizes the hope and enthusiasm of an entire generation summed up in two words sung most famously by Louis Armstrong: Hello, Dolly. When activated you will randomly see a lyric from <cite>Hello, Dolly</cite> in the upper right of your admin screen on every page.
++Description: This is not just a plugin, it symbolizes the hope and enthusiasm of an entire generation summed up in two words sung most famously by Richard M. Stallman: Free Software. When activated you will randomly see a lyric from the <cite>Free Software Song</cite> in the upper right of your admin screen on every page.
+ Author: Matt Mullenweg
+ Version: 1.7.2
+ Author URI: http://ma.tt/
+@@ -18,34 +18,19 @@ if ( ! defined( 'ABSPATH' ) ) {
+ }
+ 
+ function hello_dolly_get_lyric() {
+-	/** These are the lyrics to Hello Dolly */
+-	$lyrics = "Hello, Dolly
+-Well, hello, Dolly
+-It's so nice to have you back where you belong
+-You're lookin' swell, Dolly
+-I can tell, Dolly
+-You're still glowin', you're still crowin'
+-You're still goin' strong
+-I feel the room swayin'
+-While the band's playin'
+-One of our old favorite songs from way back when
+-So, take her wrap, fellas
+-Dolly, never go away again
+-Hello, Dolly
+-Well, hello, Dolly
+-It's so nice to have you back where you belong
+-You're lookin' swell, Dolly
+-I can tell, Dolly
+-You're still glowin', you're still crowin'
+-You're still goin' strong
+-I feel the room swayin'
+-While the band's playin'
+-One of our old favorite songs from way back when
+-So, golly, gee, fellas
+-Have a little faith in me, fellas
+-Dolly, never go away
+-Promise, you'll never go away
+-Dolly'll never go away again";
++	// These are the lyrics to the Free Software Song
++	$lyrics = "Join us now and share the software;
++You'll be free, hackers, you'll be free.
++Hoarders may get piles of money,
++That is true, hackers, that is true.
++But they cannot help their neighbors;
++That ain't good, hackers, that ain't good.
++When we have enough free software
++At our call, hackers, at our call,
++We'll kick out those dirty licenses
++Ever more, hackers, ever more.
++Join us now and share the software;
++You'll be free, hackers, you'll be free.";
+ 
+ 	// Here we split it into lines.
+ 	$lyrics = explode( "\n", $lyrics );

wordpress-7.1-noupdate.patch

@@ -0,0 +1,91 @@
+diff -up wordpress/wp-admin/includes/admin-filters.php.orig wordpress/wp-admin/includes/admin-filters.php
+--- wordpress/wp-admin/includes/admin-filters.php.orig	2026-03-09 00:49:37.395081000 +0100
++++ wordpress/wp-admin/includes/admin-filters.php	2026-08-25 07:30:05.010828032 +0200
+@@ -130,7 +130,6 @@ add_action( 'personal_options_update', '
+ add_action( 'load-plugins.php', 'wp_plugin_update_rows', 20 ); // After wp_update_plugins() is called.
+ add_action( 'load-themes.php', 'wp_theme_update_rows', 20 ); // After wp_update_themes() is called.
+ 
+-add_action( 'admin_notices', 'update_nag', 3 );
+ add_action( 'admin_notices', 'deactivated_plugins_notice', 5 );
+ add_action( 'admin_notices', 'paused_plugins_notice', 5 );
+ add_action( 'admin_notices', 'paused_themes_notice', 5 );
+diff -up wordpress/wp-admin/includes/class-core-upgrader.php.orig wordpress/wp-admin/includes/class-core-upgrader.php
+--- wordpress/wp-admin/includes/class-core-upgrader.php.orig	2026-02-13 19:34:41.944764000 +0100
++++ wordpress/wp-admin/includes/class-core-upgrader.php	2026-08-25 07:30:05.010951923 +0200
+@@ -277,6 +277,9 @@ class Core_Upgrader extends WP_Upgrader
+ 	 * @return bool True if we should update to the offered version, otherwise false.
+ 	 */
+ 	public static function should_update_to_version( $offered_ver ) {
++		// RPM: nether allow core update
++		return false;
++
+ 		require ABSPATH . WPINC . '/version.php'; // $wp_version; // x.y.z
+ 
+ 		$current_branch = implode( '.', array_slice( preg_split( '/[.-]/', $wp_version ), 0, 2 ) ); // x.y
+diff -up wordpress/wp-admin/includes/class-wp-automatic-updater.php.orig wordpress/wp-admin/includes/class-wp-automatic-updater.php
+--- wordpress/wp-admin/includes/class-wp-automatic-updater.php.orig	2026-07-29 10:01:50.858475000 +0200
++++ wordpress/wp-admin/includes/class-wp-automatic-updater.php	2026-08-25 07:30:05.011078018 +0200
+@@ -41,7 +41,7 @@ class WP_Automatic_Updater {
+ 		}
+ 
+ 		// More fine grained control can be done through the WP_AUTO_UPDATE_CORE constant and filters.
+-		$disabled = defined( 'AUTOMATIC_UPDATER_DISABLED' ) && AUTOMATIC_UPDATER_DISABLED;
++		$disabled = !defined( 'AUTOMATIC_UPDATER_DISABLED' ) || AUTOMATIC_UPDATER_DISABLED;
+ 
+ 		/**
+ 		 * Filters whether to entirely disable background updates.
+diff -up wordpress/wp-admin/includes/file.php.orig wordpress/wp-admin/includes/file.php
+--- wordpress/wp-admin/includes/file.php.orig	2026-07-29 10:01:50.858475000 +0200
++++ wordpress/wp-admin/includes/file.php	2026-08-25 07:30:05.011274367 +0200
+@@ -2270,7 +2270,7 @@ function WP_Filesystem( $args = false, $
+  */
+ function get_filesystem_method( $args = array(), $context = '', $allow_relaxed_file_ownership = false ) {
+ 	// Please ensure that this is either 'direct', 'ssh2', 'ftpext', or 'ftpsockets'.
+-	$method = defined( 'FS_METHOD' ) ? FS_METHOD : false;
++	$method = defined( 'FS_METHOD' ) ? FS_METHOD : 'direct';
+ 
+ 	if ( ! $context ) {
+ 		$context = WP_CONTENT_DIR;
+diff -up wordpress/wp-admin/includes/update.php.orig wordpress/wp-admin/includes/update.php
+--- wordpress/wp-admin/includes/update.php.orig	2026-07-30 16:55:49.613388000 +0200
++++ wordpress/wp-admin/includes/update.php	2026-08-25 07:31:37.114050011 +0200
+@@ -382,12 +382,7 @@ function update_right_now_message() {
+ 		$cur = get_preferred_from_update_core();
+ 
+ 		if ( isset( $cur->response ) && 'upgrade' === $cur->response ) {
+-			$msg .= sprintf(
+-				'<a href="%s" class="button" aria-describedby="wp-version">%s</a>',
+-				network_admin_url( 'update-core.php' ),
+-				/* translators: %s: WordPress version number, or 'Latest' string. */
+-				sprintf( __( 'Update to %s' ), $cur->current ? $cur->current : __( 'Latest' ) )
+-			);
++			$msg .= '';
+ 		}
+ 	}
+ 
+diff -up wordpress/wp-includes/load.php.orig wordpress/wp-includes/load.php
+--- wordpress/wp-includes/load.php.orig	2026-08-07 21:13:51.810460000 +0200
++++ wordpress/wp-includes/load.php	2026-08-25 07:30:05.011640399 +0200
+@@ -1835,7 +1835,7 @@ function wp_is_file_mod_allowed( $contex
+ 	 * @param bool   $file_mod_allowed Whether file modifications are allowed.
+ 	 * @param string $context          The usage context.
+ 	 */
+-	return apply_filters( 'file_mod_allowed', ! defined( 'DISALLOW_FILE_MODS' ) || ! DISALLOW_FILE_MODS, $context );
++	return apply_filters( 'file_mod_allowed', defined( 'DISALLOW_FILE_MODS' ) && ! DISALLOW_FILE_MODS, $context );
+ }
+ 
+ /**
+diff -up wordpress/wp-includes/update.php.orig wordpress/wp-includes/update.php
+--- wordpress/wp-includes/update.php.orig	2026-07-06 23:09:52.376708000 +0200
++++ wordpress/wp-includes/update.php	2026-08-25 07:30:05.011769619 +0200
+@@ -1087,10 +1087,6 @@ function _maybe_update_themes() {
+  * @since 3.1.0
+  */
+ function wp_schedule_update_checks() {
+-	if ( ! wp_next_scheduled( 'wp_version_check' ) && ! wp_installing() ) {
+-		wp_schedule_event( time(), 'twicedaily', 'wp_version_check' );
+-	}
+-
+ 	if ( ! wp_next_scheduled( 'wp_update_plugins' ) && ! wp_installing() ) {
+ 		wp_schedule_event( time(), 'twicedaily', 'wp_update_plugins' );
+ 	}

wordpress-7.1-remove-jshint-refs.patch

@@ -0,0 +1,11 @@
+diff -up wordpress/wp-includes/script-loader.php.orig wordpress/wp-includes/script-loader.php
+--- wordpress/wp-includes/script-loader.php.orig	2026-08-25 07:26:03.212320361 +0200
++++ wordpress/wp-includes/script-loader.php	2026-08-25 07:26:08.488274508 +0200
+@@ -1205,7 +1205,6 @@ function wp_default_scripts( $scripts )
+ 	$scripts->add( 'wp-codemirror', '/wp-includes/js/codemirror/codemirror.min.js', array(), '5.65.20' );
+ 	$scripts->add( 'csslint', '/wp-includes/js/codemirror/csslint.js', array(), '1.0.5' );
+ 	$scripts->add( 'esprima', '/wp-includes/js/codemirror/esprima.js', array(), '4.0.1' ); // Deprecated.
+-	$scripts->add( 'jshint', '/wp-includes/js/codemirror/fakejshint.js', array( 'esprima' ), '2.9.5' ); // Deprecated.
+ 	$scripts->add( 'jsonlint', '/wp-includes/js/codemirror/jsonlint.js', array(), '1.6.3' );
+ 	$scripts->add( 'htmlhint', '/wp-includes/js/codemirror/htmlhint.js', array(), '1.9.2' );
+ 	$scripts->add( 'htmlhint-kses', '/wp-includes/js/codemirror/htmlhint-kses.js', array( 'htmlhint' ) );

wordpress-httpd-conf

@@ -1,5 +1,23 @@
 Alias /wordpress /usr/share/wordpress
 
+# Access is only allowed via local access
+# Change this once configured
+
 <Directory /usr/share/wordpress>
   AllowOverride Options
+    Require local
+</Directory>
+
+<Directory /usr/share/wordpress/wp-content/uploads>
+  # Deny access to any php file in the uploads directory
+  <FilesMatch "\.(php|phar)$">
+    Require all denied
+  </FilesMatch>
+</Directory>
+
+<Directory /usr/share/wordpress/wp-content/plugins/akismet>
+  # Deny access to any php file in the akismet directory
+  <FilesMatch "\.(php|txt)$">
+    Require all denied
+  </FilesMatch>
 </Directory>

wordpress-minify.php

@@ -0,0 +1,16 @@
+<?php
+require '/usr/share/php/Patchwork/autoload-jsqueeze.php';
+
+$in = file_get_contents($_SERVER['argv'][1]);
+if (!$in) exit(1);
+$jsqueeze = new \Patchwork\JSqueeze();
+$out = $jsqueeze->squeeze($in);
+if ($out) {
+    printf("+ minify from %s to %s: %2d%% of %6d\n", 
+        basename($_SERVER['argv'][1]), basename($_SERVER['argv'][2]),
+        round(strlen($out)*100/strlen($in)), strlen($in));
+    file_put_contents($_SERVER['argv'][2], $out);
+} else {
+    exit(2);
+}
+

wordpress-nginx-conf

@@ -0,0 +1,35 @@
+# Wordpress
+
+location = /wordpress {
+    alias /usr/share/wordpress/;
+}
+
+location /wordpress/ {
+    root /usr/share;
+    index index.php;
+
+    location ~ ^/wordpress/wp-content/uploads/(.+)\.php$ {
+        # Deny access to any php file in the uploads directory
+        deny all;
+    }
+    location ~ ^/wordpress/wp-content/plugins/akismet/(.+)\.php$ {
+        # Deny access to any php file in the akismet directory
+        deny all;
+    }
+
+    # Access is only allowed via local access
+    # Change this once configured
+    location ~ ^/wordpress/(.+\.php)$ {
+        allow 127.0.0.1;
+        allow ::1;
+        deny all;
+
+        try_files $uri =404;
+        fastcgi_intercept_errors on;
+        include        fastcgi_params;
+        fastcgi_param  SERVER_NAME      $host;
+        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
+        fastcgi_pass   php-fpm;
+    }
+}
+