WordPress 4.7.3 Security and Maintenance Release

(cherry picked from commit 093664f076)
(cherry picked from commit d12ec50539)

.gitignore

@@ -1,29 +1,38 @@
-wordpress-3.0.1.tar.gz
-/wordpress-3.0.2.tar.gz
-/wordpress-3.0.3.tar.gz
-/wordpress-3.0.4.tar.gz
-/wordpress-3.1.tar.gz
-/wordpress-3.1.1.tar.gz
-/wordpress-3.1.2.tar.gz
-/wordpress-3.1.3.tar.gz
-/wordpress-3.2-RC1.zip
-/wordpress-3.2-RC3.zip
-/wordpress-3.2.tar.gz
-/wordpress-3.2.1.tar.gz
-/wordpress-3.3-beta2.tar.gz
-/wordpress-3.3-beta3.tar.gz
-/wordpress-3.3-beta4.tar.gz
-/wordpress-3.3-RC1.tar.gz
-/wordpress-3.3-RC2.tar.gz
-/wordpress-3.3.tar.gz
-/wordpress-3.3.1.tar.gz
-/wordpress-3.4-beta1.tar.gz
-/wordpress-3.4-beta2.tar.gz
-/wordpress-3.4-beta3.tar.gz
-/wordpress-3.4-beta4.tar.gz
-/wordpress-3.4-RC1.tar.gz
-/wordpress-3.4-RC2.tar.gz
-/wordpress-3.4-RC3.tar.gz
-/wordpress-3.4.tar.gz
-/wordpress-3.4.1.tar.gz
-/wordpress-3.4.2.tar.gz
+*spec~
+clog
+/wordpress-3.7.tar.gz
+/wordpress-3.7.1.tar.gz
+/wordpress-3.8.tar.gz
+/wordpress-3.8.1.tar.gz
+/wordpress-3.8.2.tar.gz
+/wordpress-3.8.3.tar.gz
+/wordpress-3.9.tar.gz
+/wordpress-3.9.1.tar.gz
+/wordpress-3.9.2.tar.gz
+/wordpress-4.0.tar.gz
+/wordpress-4.0.1.tar.gz
+/wordpress-4.1.tar.gz
+/wordpress-4.1.1.tar.gz
+/wordpress-4.1.2.tar.gz
+/wordpress-4.2.tar.gz
+/wordpress-4.2.1.tar.gz
+/wordpress-4.2.2.tar.gz
+/wordpress-4.2.3.tar.gz
+/wordpress-4.2.4.tar.gz
+/wordpress-4.3.tar.gz
+/wordpress-4.3.1.tar.gz
+/wordpress-4.4.tar.gz
+/wordpress-4.4.1.tar.gz
+/wordpress-4.4.2.tar.gz
+/wordpress-4.5-RC1.tar.gz
+/wordpress-4.5.tar.gz
+/wordpress-4.5.1.tar.gz
+/wordpress-4.5.2.tar.gz
+/wordpress-4.5.3.tar.gz
+/wordpress-debian_patches_hello.patch
+/wordpress-4.6.tar.gz
+/wordpress-4.6.1.tar.gz
+/wordpress-4.7.tar.gz
+/wordpress-4.7.1.tar.gz
+/wordpress-4.7.2.tar.gz
+/wordpress-4.7.3.tar.gz

README.fedora.wordpress

@@ -1,3 +1,5 @@
+-------------------------------------------------------------------------------
+
 Wordpress is a database driven blogging program designed to make it exceedingly
 easy to publish an online blog, sometimes also called a weblog or journal.
 
@@ -43,3 +45,42 @@ Once that's done and the database server and web server have been started,
 open a web browser to http://localhost/wordpress/wp-admin/install.php and 
 follow the instructions given to you on the pages you see to set up the 
 database tables and begin publishing your blog.
+
+-------------------------------------------------------------------------------
+
+Wordpress ships with Flash and Silverlight plugins for the 'plupload' file
+uploader and the 'mediaelement' media player embedder. The idea is to try and
+be able to provide a multi-file uploader and an embedded video player when
+HTML5 is not available (or does not support the video format in question).
+These plugins are provided as pre-built binaries and there is no mechanism
+for building them from source during Wordpress compilation. As the inclusion
+of pre-built binaries is against Fedora policy - see
+https://fedoraproject.org/wiki/Packaging:Guidelines#No_inclusion_of_pre-built_binaries_or_libraries
+ - these plugins have been removed from the Fedora package. As a consequence:
+
+a) any Wordpress element or plugin that uses the 'plupload' will only present
+an HTML5-based multi-file uploader if HTML5 is supported by the user's browser
+or an HMTL4-based single-file uploader in HTML5 is not supported. No Flash
+or Silverlight-based multi-file uploader will be provided.
+
+b) If you try to embed media into a Wordpress post using the [video] and
+[audio] short tags, the media player will be visible if the reader is using
+a browser that has HTML5 support for the media format in question; if not, the
+'Download Media' link will be offered. No Flash or Silverlight-based player
+element will be included.
+
+-------------------------------------------------------------------------------
+
+Optional dependencies:
+
+You may wish to install the following packages:
+
+	php-pecl-imagick: optimize image transformation
+	php-pecl-ssh2: for file transfert using ssh
+
+An opcode cache is also recommended:
+	php 5.5: php-opcache
+	php 5.4: php-pecl-zendopcache
+	php 5.3: php-pecl-apc
+
+-------------------------------------------------------------------------------

sources

@@ -1 +1 @@
-dfc56cee27eec8fb79070f033ecd4b25  wordpress-3.4.2.tar.gz
+SHA512 (wordpress-4.7.3.tar.gz) = 071df65c3a43557faf351838a661a83e26d8de37c8633dc17a59d773cc91caef640a625b0719606df1fc563fd18af71ba1da22a5b6f345339e73761754484dc5

wordpress-4.0-config.patch

@@ -0,0 +1,32 @@
+diff -up wordpress/wp-config.php.orig wordpress/wp-config.php
+--- wordpress/wp-config.php.orig	2014-09-08 13:12:36.525908423 +0200
++++ wordpress/wp-config.php	2014-09-08 13:14:33.583402525 +0200
+@@ -66,6 +66,19 @@ define('NONCE_SALT',       'put your uni
+ $table_prefix  = 'wp_';
+ 
+ /**
++ * See http://make.wordpress.org/core/2013/10/25/the-definitive-guide-to-disabling-auto-updates-in-wordpress-3-7
++ */
++
++/* Disable all file change, as RPM base installation are read-only */
++define('DISALLOW_FILE_MODS', true);
++
++/* Disable automatic updater, in case you want to allow
++   above FILE_MODS for plugins, themes, ... */
++define('AUTOMATIC_UPDATER_DISABLED', true);
++
++/* Core update is always disabled, WP_AUTO_UPDATE_CORE value is ignore */
++
++/**
+  * For developers: WordPress debugging mode.
+  *
+  * Change this to true to enable the display of notices during development.
+@@ -83,7 +96,7 @@ define('WP_DEBUG', false);
+ 
+ /** Absolute path to the WordPress directory. */
+ if ( !defined('ABSPATH') )
+-	define('ABSPATH', dirname(__FILE__) . '/');
++	define('ABSPATH', '/usr/share/wordpress');
+ 
+ /** Sets up WordPress vars and included files. */
+ require_once(ABSPATH . 'wp-settings.php');

wordpress-4.0-tinymce_noflash.patch

@@ -0,0 +1,23 @@
+diff -up wordpress/wp-includes/js/tinymce/plugins/media/plugin.js.rpm wordpress/wp-includes/js/tinymce/plugins/media/plugin.js
+--- wordpress/wp-includes/js/tinymce/plugins/media/plugin.js.rpm	2014-08-22 01:53:18.000000000 +0200
++++ wordpress/wp-includes/js/tinymce/plugins/media/plugin.js	2014-09-08 13:10:15.717314458 +0200
+@@ -46,10 +46,6 @@ tinymce.PluginManager.add('media', funct
+ 			return 'video/ogg';
+ 		}
+ 
+-		if (url.indexOf('.swf') != -1) {
+-			return 'application/x-shockwave-flash';
+-		}
+-
+ 		return '';
+ 	}
+ 
+@@ -247,7 +243,7 @@ tinymce.PluginManager.add('media', funct
+ 		data.source1mime = guessMime(data.source1);
+ 		data.source2mime = guessMime(data.source2);
+ 		data.poster = editor.convertURL(data.poster, "poster");
+-		data.flashPlayerUrl = editor.convertURL(url + '/moxieplayer.swf', "movie");
++		data.flashPlayerUrl = false;
+ 
+ 		tinymce.each(urlPatterns, function(pattern) {
+ 			var match, i, url;

wordpress-4.4-no_swfupload.patch

@@ -0,0 +1,18 @@
+--- wordpress/wp-includes/script-loader.php.orig	2015-12-09 16:51:44.740328793 +0100
++++ wordpress/wp-includes/script-loader.php	2015-12-09 16:53:00.870701835 +0100
+@@ -300,15 +300,6 @@ function wp_default_scripts( &$scripts )
+ 	$scripts->add( 'wp-plupload', "/wp-includes/js/plupload/wp-plupload$suffix.js", array( 'plupload', 'jquery', 'json2', 'media-models' ), false, 1 );
+ 	did_action( 'init' ) && $scripts->localize( 'wp-plupload', 'pluploadL10n', $uploader_l10n );
+ 
+-	// keep 'swfupload' for back-compat.
+-	$scripts->add( 'swfupload', '/wp-includes/js/swfupload/swfupload.js', array(), '2201-20110113');
+-	$scripts->add( 'swfupload-swfobject', '/wp-includes/js/swfupload/plugins/swfupload.swfobject.js', array('swfupload', 'swfobject'), '2201a');
+-	$scripts->add( 'swfupload-queue', '/wp-includes/js/swfupload/plugins/swfupload.queue.js', array('swfupload'), '2201');
+-	$scripts->add( 'swfupload-speed', '/wp-includes/js/swfupload/plugins/swfupload.speed.js', array('swfupload'), '2201');
+-	$scripts->add( 'swfupload-all', false, array('swfupload', 'swfupload-swfobject', 'swfupload-queue'), '2201');
+-	$scripts->add( 'swfupload-handlers', "/wp-includes/js/swfupload/handlers$suffix.js", array('swfupload-all', 'jquery'), '2201-20110524');
+-	did_action( 'init' ) && $scripts->localize( 'swfupload-handlers', 'swfuploadL10n', $uploader_l10n );
+-
+ 	$scripts->add( 'comment-reply', "/wp-includes/js/comment-reply$suffix.js", array(), false, 1 );
+ 
+ 	$scripts->add( 'json2', "/wp-includes/js/json2$suffix.js", array(), '2015-05-03' );

wordpress-4.4-systemlibs.patch

@@ -0,0 +1,20 @@
+--- wordpress/wp-admin/includes/media.php.orig	2015-12-09 17:01:52.453306607 +0100
++++ wordpress/wp-admin/includes/media.php	2015-12-09 17:05:31.477379833 +0100
+@@ -2989,7 +2989,7 @@ function wp_read_video_metadata( $file )
+ 	}
+ 
+ 	if ( ! class_exists( 'getID3', false ) ) {
+-		require( ABSPATH . WPINC . '/ID3/getid3.php' );
++		require( '/usr/share/php/getid3/getid3.php' );
+ 	}
+ 	$id3 = new getID3();
+ 	$data = $id3->analyze( $file );
+@@ -3050,7 +3050,7 @@ function wp_read_audio_metadata( $file )
+ 	}
+ 
+ 	if ( ! class_exists( 'getID3', false ) ) {
+-		require( ABSPATH . WPINC . '/ID3/getid3.php' );
++		require( '/usr/share/php/getid3/getid3.php' );
+ 	}
+ 	$id3 = new getID3();
+ 	$data = $id3->analyze( $file );

wordpress-4.6-noupdate.patch

@@ -0,0 +1,103 @@
+diff -up wordpress/wp-admin/includes/admin-filters.php.rpm wordpress/wp-admin/includes/admin-filters.php
+--- wordpress/wp-admin/includes/admin-filters.php.rpm	2016-09-03 07:50:51.812312381 +0200
++++ wordpress/wp-admin/includes/admin-filters.php	2016-09-03 07:51:39.070577518 +0200
+@@ -106,7 +106,6 @@ add_action( 'profile_update', 'default_p
+ add_action( 'load-plugins.php', 'wp_plugin_update_rows', 20 ); // After wp_update_plugins() is called.
+ add_action( 'load-themes.php', 'wp_theme_update_rows', 20 ); // After wp_update_themes() is called.
+ 
+-add_action( 'admin_notices', 'update_nag',      3  );
+ add_action( 'admin_notices', 'maintenance_nag', 10 );
+ 
+ add_filter( 'update_footer', 'core_update_footer' );
+diff -up wordpress/wp-admin/includes/class-core-upgrader.php.rpm wordpress/wp-admin/includes/class-core-upgrader.php
+--- wordpress/wp-admin/includes/class-core-upgrader.php.rpm	2016-09-03 07:59:45.832367671 +0200
++++ wordpress/wp-admin/includes/class-core-upgrader.php	2016-09-03 07:59:50.160392833 +0200
+@@ -236,6 +236,9 @@ class Core_Upgrader extends WP_Upgrader
+ 	 * @return bool True if we should update to the offered version, otherwise false.
+ 	 */
+ 	public static function should_update_to_version( $offered_ver ) {
++		// RPM: nether allow core update
++		return false;
++
+ 		include( ABSPATH . WPINC . '/version.php' ); // $wp_version; // x.y.z
+ 
+ 		$current_branch = implode( '.', array_slice( preg_split( '/[.-]/', $wp_version  ), 0, 2 ) ); // x.y
+diff -up wordpress/wp-admin/includes/class-wp-automatic-updater.php.rpm wordpress/wp-admin/includes/class-wp-automatic-updater.php
+--- wordpress/wp-admin/includes/class-wp-automatic-updater.php.rpm	2016-09-03 08:00:15.810540773 +0200
++++ wordpress/wp-admin/includes/class-wp-automatic-updater.php	2016-09-03 08:00:28.915616106 +0200
+@@ -31,7 +31,7 @@ class WP_Automatic_Updater {
+ 	 */
+ 	public function is_disabled() {
+ 		// Background updates are disabled if you don't want file changes.
+-		if ( defined( 'DISALLOW_FILE_MODS' ) && DISALLOW_FILE_MODS )
++		if ( !defined( 'DISALLOW_FILE_MODS' ) || DISALLOW_FILE_MODS )
+ 			return true;
+ 
+ 		if ( wp_installing() )
+diff -up wordpress/wp-admin/includes/translation-install.php.rpm wordpress/wp-admin/includes/translation-install.php
+--- wordpress/wp-admin/includes/translation-install.php.rpm	2016-05-22 20:01:30.000000000 +0200
++++ wordpress/wp-admin/includes/translation-install.php	2016-09-03 07:50:51.813312387 +0200
+@@ -181,7 +181,7 @@ function wp_download_language_pack( $dow
+ 		return $download;
+ 	}
+ 
+-	if ( defined( 'DISALLOW_FILE_MODS' ) && DISALLOW_FILE_MODS ) {
++	if ( !defined( 'DISALLOW_FILE_MODS' ) || DISALLOW_FILE_MODS ) {
+ 		return false;
+ 	}
+ 
+@@ -224,7 +224,7 @@ function wp_download_language_pack( $dow
+  * @return bool Returns true on success, false on failure.
+  */
+ function wp_can_install_language_pack() {
+-	if ( defined( 'DISALLOW_FILE_MODS' ) && DISALLOW_FILE_MODS ) {
++	if ( !defined( 'DISALLOW_FILE_MODS' ) || DISALLOW_FILE_MODS ) {
+ 		return false;
+ 	}
+ 
+diff -up wordpress/wp-admin/includes/update.php.rpm wordpress/wp-admin/includes/update.php
+--- wordpress/wp-admin/includes/update.php.rpm	2016-08-10 21:06:31.000000000 +0200
++++ wordpress/wp-admin/includes/update.php	2016-09-03 07:50:51.812312381 +0200
+@@ -271,7 +271,7 @@ function update_right_now_message() {
+ 		$cur = get_preferred_from_update_core();
+ 
+ 		if ( isset( $cur->response ) && $cur->response == 'upgrade' )
+-			$msg .= '<a href="' . network_admin_url( 'update-core.php' ) . '" class="button" aria-describedby="wp-version">' . sprintf( __( 'Update to %s' ), $cur->current ? $cur->current : __( 'Latest' ) ) . '</a> ';
++			$msg .= '';
+ 	}
+ 
+ 	/* translators: 1: version number, 2: theme name */
+diff -up wordpress/wp-includes/capabilities.php.rpm wordpress/wp-includes/capabilities.php
+--- wordpress/wp-includes/capabilities.php.rpm	2016-06-30 03:02:29.000000000 +0200
++++ wordpress/wp-includes/capabilities.php	2016-09-03 07:50:51.812312381 +0200
+@@ -330,7 +330,7 @@ function map_meta_cap( $cap, $user_id )
+ 		// Disallow the file editors.
+ 		if ( defined( 'DISALLOW_FILE_EDIT' ) && DISALLOW_FILE_EDIT )
+ 			$caps[] = 'do_not_allow';
+-		elseif ( defined( 'DISALLOW_FILE_MODS' ) && DISALLOW_FILE_MODS )
++		elseif ( !defined( 'DISALLOW_FILE_MODS' ) || DISALLOW_FILE_MODS )
+ 			$caps[] = 'do_not_allow';
+ 		elseif ( is_multisite() && ! is_super_admin( $user_id ) )
+ 			$caps[] = 'do_not_allow';
+@@ -348,7 +348,7 @@ function map_meta_cap( $cap, $user_id )
+ 	case 'update_core':
+ 		// Disallow anything that creates, deletes, or updates core, plugin, or theme files.
+ 		// Files in uploads are excepted.
+-		if ( defined( 'DISALLOW_FILE_MODS' ) && DISALLOW_FILE_MODS ) {
++		if ( !defined( 'DISALLOW_FILE_MODS' ) || DISALLOW_FILE_MODS ) {
+ 			$caps[] = 'do_not_allow';
+ 		} elseif ( is_multisite() && ! is_super_admin( $user_id ) ) {
+ 			$caps[] = 'do_not_allow';
+diff -up wordpress/wp-includes/update.php.rpm wordpress/wp-includes/update.php
+--- wordpress/wp-includes/update.php.rpm	2016-05-25 21:36:28.000000000 +0200
++++ wordpress/wp-includes/update.php	2016-09-03 07:50:51.813312387 +0200
+@@ -653,9 +653,6 @@ function _maybe_update_themes() {
+  * @since 3.1.0
+  */
+ function wp_schedule_update_checks() {
+-	if ( ! wp_next_scheduled( 'wp_version_check' ) && ! wp_installing() )
+-		wp_schedule_event(time(), 'twicedaily', 'wp_version_check');
+-
+ 	if ( ! wp_next_scheduled( 'wp_update_plugins' ) && ! wp_installing() )
+ 		wp_schedule_event(time(), 'twicedaily', 'wp_update_plugins');
+ 

wordpress-FSF-address.patch

@@ -1,12 +0,0 @@
-diff -up wordpress/wp-includes/kses.php.FSFaddr wordpress/wp-includes/kses.php
---- wordpress/wp-includes/kses.php.FSFaddr	2011-05-25 23:54:34.347025847 +0200
-+++ wordpress/wp-includes/kses.php	2011-05-25 23:56:18.403727954 +0200
-@@ -15,7 +15,7 @@
-  *
-  * You should have received a copy of the GNU General Public License along
-  * with this program; if not, write to the Free Software Foundation, Inc.,
-- * 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA  or visit
-+ * 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-  * http://www.gnu.org/licenses/gpl.html
-  *
-  * [kses strips evil scripts!]

wordpress-debian_patches_hello.patch

@@ -1,9 +1,9 @@
---- wordpress/wp-content/plugins/hello.php~	2010-11-10 06:43:04.000000000 -0600
-+++ wordpress/wp-content/plugins/hello.php	2011-02-23 10:10:52.152777012 -0600
+--- wordpress/wp-content/plugins/hello.php	2013-05-22 14:08:40.000000000 -0700
++++ wordpress/wp-content/plugins/hello.php.new	2013-08-22 23:46:04.594788007 -0700
 @@ -6,42 +6,26 @@
  /*
  Plugin Name: Hello Dolly
- Plugin URI: http://wordpress.org/extend/plugins/hello-dolly/
+ Plugin URI: http://wordpress.org/plugins/hello-dolly/
 -Description: This is not just a plugin, it symbolizes the hope and enthusiasm of an entire generation summed up in two words sung most famously by Louis Armstrong: Hello, Dolly. When activated you will randomly see a lyric from <cite>Hello, Dolly</cite> in the upper right of your admin screen on every page.
 +Description: This is not just a plugin, it symbolizes the hope and enthusiasm of an entire generation summed up in two words sung most famously by Richard M. Stallman: Free Software. When activated you will randomly see a lyric from the <cite>Free Software Song</cite> in the upper right of your admin screen on every page.
  Author: Matt Mullenweg

wordpress-httpd-conf

@@ -1,5 +1,35 @@
 Alias /wordpress /usr/share/wordpress
 
+# Access is only allowed via local access
+# Change this once configured
+
 <Directory /usr/share/wordpress>
   AllowOverride Options
+  <IfModule mod_authz_core.c>
+    # Apache 2.4
+    Require local
+  </IfModule>
+  <IfModule !mod_authz_core.c>
+    # Apache 2.2
+    Order Deny,Allow
+    Deny from All
+    Allow from 127.0.0.1
+    Allow from ::1
+ </IfModule>
+</Directory>
+
+<Directory /usr/share/wordpress/wp-content/uploads>
+  # Deny access to any php file in the uploads directory
+  <FilesMatch "\.(php)$">
+    Order Deny,Allow
+    Deny from all
+  </FilesMatch>
+</Directory>
+
+<Directory /usr/share/wordpress/wp-content/plugins/akismet>
+  # Deny access to any php file in the akismet directory
+  <FilesMatch "\.(php|txt)$">
+    Order Deny,Allow
+    Deny from all
+  </FilesMatch>
 </Directory>

wordpress-nginx-conf

@@ -0,0 +1,35 @@
+# Wordpress
+
+location = /wordpress {
+    alias /usr/share/wordpress/;
+}
+
+location /wordpress/ {
+    root /usr/share;
+    index index.php;
+
+    location ~ ^/wordpress/wp-content/uploads/(.+)\.php$ {
+        # Deny access to any php file in the uploads directory
+        deny all;
+    }
+    location ~ ^/wordpress/wp-content/plugins/akismet/(.+)\.php$ {
+        # Deny access to any php file in the akismet directory
+        deny all;
+    }
+
+    # Access is only allowed via local access
+    # Change this once configured
+    location ~ ^/wordpress/(.+\.php)$ {
+        allow 127.0.0.1;
+        allow ::1;
+        deny all;
+
+        try_files $uri =404;
+        fastcgi_intercept_errors on;
+        include        fastcgi_params;
+        fastcgi_param  SERVER_NAME      $host;
+        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
+        fastcgi_pass   php-fpm;
+    }
+}
+

wordpress.spec

@@ -1,59 +1,222 @@
+# Fedora spec file for wordpress
+#
+# License: MIT
+# http://opensource.org/licenses/MIT
+#
+# Please preserve changelog entries
+#
+%{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}-%{version}}
 %global wp_content %{_datadir}/wordpress/wp-content
-#%#global betatag -RC3
 
-Summary: Blog tool and publishing platform
-URL: http://www.wordpress.org
-Name: wordpress
-Version: 3.4.2
-Group: Applications/Publishing
-#Release: 0.2.%{betatag}%{?dist}
-Release: 2%{?dist}
-License: GPLv2
-Source0: http://wordpress.org/%{name}-%{version}%{?betatag}.tar.gz
-Source1: wordpress-httpd-conf
-Source2: README.fedora.wordpress
-Source3: README.fedora.wordpress-mu
+%if 0%{?fedora} >= 21
+%global with_nginx 1
+%else
+%global with_nginx 0
+%endif
+
+# https://bugzilla.redhat.com/1147817 php53-getid3 review
+%if 0%{?fedora} >= 17 || 0%{?rhel} >= 6
+%global with_getid3 1
+%else
+%global with_getid3 0
+%endif
+#global prever RC1
+
+Summary:    Blog tool and publishing platform
+URL:        http://www.wordpress.org
+Name:       wordpress
+Version:    4.7.3
+Group:      Applications/Publishing
+Release:    1%{?dist}
+License:    GPLv2
+
+Source0:    http://wordpress.org/%{name}-%{version}%{?prever:-%{prever}}.tar.gz
+Source1:    wordpress-httpd-conf
+Source2:    README.fedora.wordpress
+Source3:    README.fedora.wordpress-mu
+Source4:    wordpress-nginx-conf
+
 # Patch out copyrighted text of Hello, Dolly
 # (and replace it with Free Software Song)
 Patch0: wordpress-debian_patches_hello.patch
 # Move wp-content to /var/www/wordpress/
+# This patch doesn’t work well, see bugzilla.redhat.com/522897
 Patch1: wordpress-move-wp-content.patch
+# Drop swfupload: not built from source, not reasonably possible to do
+Patch2: wordpress-4.4-no_swfupload.patch
+# Adjust tinymce's media plugin not to use its SWF plugin. This changes
+# 'p.getParam("flash_video_player_url",u.convertUrl(u.url+"/moxieplayer.swf"))'
+# to 'false'
+Patch3: wordpress-4.0-tinymce_noflash.patch
+# RPM configuration:
+# Path to installation
+# Disable auto-updater
+Patch5: wordpress-4.0-config.patch
+# RPM are readonly
+# disable version check and updated
+# change DISALLOW_FILE_MODS default value to true
+# ignore WP_AUTO_UPDATE_CORE (always false)
+Patch6: wordpress-4.6-noupdate.patch
+# Use system libraries
+Patch7: wordpress-4.4-systemlibs.patch
+
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
-Requires: php >= 5.2.4, webserver, php-mysql, php-gettext, php-simplepie
+BuildArch: noarch
+
+%if 0%{?rhel} == 5
+Requires: php53 >= 5.2.4
+Requires: php53-simplepie >= 1.3.1
+%if %{with_getid3}
+Requires: php53-getid3
+%endif
+Requires: php53-mysql
+
+%else
+%if %{with_nginx}
+Requires: webserver
+Requires: php(httpd)
+Suggests: httpd
+# For directory ownership
+Requires: httpd-filesystem
+Requires: nginx-filesystem
+
+%else
+Requires: php >= 5.2.4
+%endif
+Requires: php-simplepie >= 1.3.1
+%if %{with_getid3}
+Requires: php-getid3
+%endif
+Requires: php-ctype
+Requires: php-filter
+Requires: php-mysqli
+%endif
+
+# From phpcompatinfo report for version 4.5.3
+Requires: php-curl
+Requires: php-date
+Requires: php-dom
+Requires: php-exif
+Requires: php-fileinfo
+Requires: php-ftp
+Requires: php-gd
+Requires: php-gettext
+Requires: php-hash
+Requires: php-iconv
+Requires: php-json
+Requires: php-libxml
+Requires: php-mbstring
+Requires: php-openssl
+Requires: php-pcre
+Requires: php-posix
+Requires: php-simplexml
+Requires: php-sockets
+Requires: php-spl
+Requires: php-tokenizer
+Requires: php-xml
+Requires: php-zip
+Requires: php-zlib
+# Unbundled libraries
+Requires: php-PHPMailer
+Requires: httpd
+# ca-certificates (excepted on EL-5)
+Requires: %{_sysconfdir}/pki/tls/certs/ca-bundle.crt
 Provides: wordpress-mu = %{version}-%{release}
 Obsoletes: wordpress-mu < 2.9.3
-BuildArch: noarch
 
 %description
 Wordpress is an online publishing / weblog package that makes it very easy,
 almost trivial, to get information out to people on the web.
 
+Important information in %{_pkgdocdir}/README.fedora
+
+
 %prep
 %setup -q -n wordpress
 
+# Drop pre-compiled binary lumps: Flash and Silverlight
+# This means that Flash video fallbacks in Wordpress' media support
+# and the tinymce plugin, the plupload Flash and Silverlight
+# uploaders, and swfupload are not available.
+# To re-introduce these they would have to be built from the
+# ActionScript source as part of this package build, they cannot be
+# shipped pre-compiled. Removing plupload.flash.js and
+# plupload.silverlight.js causes plupload only to try and use the html4
+# or html5 uploaders; if you just wipe the binaries but leave the
+# .js files, it will try and use the Flash or Silverlight uploaders
+# and draw a non-functional button. - AdamW, 2013/08
+# https://fedoraproject.org/wiki/Packaging:Guidelines#No_inclusion_of_pre-built_binaries_or_libraries
+
+rm wp-includes/js/mediaelement/silverlightmediaelement.xap
+rm wp-includes/js/mediaelement/flashmediaelement.swf
+rm wp-includes/js/tinymce/plugins/media/moxieplayer.swf
+rm wp-includes/js/plupload/plupload.silverlight.xap
+rm wp-includes/js/plupload/plupload.flash.swf
+
+# swfupload can just die in its entirety
+rm -rf wp-includes/js/swfupload
+
+# remove .htaccess, protected by httpd config file
+rm wp-content/plugins/akismet/.htaccess
+
 %patch0 -p1 -b .dolly
-#%patch1 -p1 -b .rhbz522897
+#patch1 -p1 -b .rhbz522897
+%patch2 -p1
+%patch3 -p1
+# Adjust mediaelement not to use its SWF and Silverlight plugins. This
+# changes 'plugins:["flash,"silverlight","youtube","vimeo"]' to
+# 'plugins:["youtube","vimeo"]'
+sed -s 's/"flash","silverlight",//' -i wp-includes/js/mediaelement/mediaelement-and-player.min.js
+%if %{with_getid3}
+%patch7 -p1
+%endif
+
+# We patch a .js file, used patched file instead of unpatch minified one
+ln -sf plugin.js wp-includes/js/tinymce/plugins/media/plugin.min.js
+
+# Re-Generated the archive
+arc=wp-includes/js/tinymce/wp-tinymce.js
+gunzip -dc $arc.gz | \
+  grep "^// Source" | \
+  while read a b c
+do
+  if [ -f $c ]; then
+    echo -e "\n$a $b $c"
+    cat $c
+  else
+    exit 1
+  fi
+done >$arc
+gzip --force $arc
+ls -l $arc.gz
+
+# Create RPM configuration
+sed -e 's/\r//' wp-config-sample.php >wp-config.php
+%patch5 -p1
+%patch6 -p1
 
-# disable wp_version_check, updates are always installed via rpm
-sed -i -e "s,\(.*\)'wp_version_check'\(.*\),#\1'wp_version_check'\2,g" \
-	wp-includes/update.php
-# disable update_nag() function
-sed -i -e "s,\(.*\)'update_nag'\(.*\),#\1'update_nag'\2,g; \
-	s,\(.*\)\$msg .=\(.*\),\1\$msg .= '';,g;" \
-	wp-admin/includes/update.php
 # fix file encoding
 sed -i -e 's/\r//' license.txt
 
+
 %build
 
 %install
-mkdir -p ${RPM_BUILD_ROOT}%{_datadir}/wordpress
-mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/wordpress
+# Apache configuration
 install -m 0644 -D -p %{SOURCE1} ${RPM_BUILD_ROOT}%{_sysconfdir}/httpd/conf.d/wordpress.conf
+
+%if %{with_nginx}
+install -m 0644 -D -p %{SOURCE4} ${RPM_BUILD_ROOT}%{_sysconfdir}/nginx/default.d/wordpress.conf
+%endif
+
+# Application
+mkdir -p ${RPM_BUILD_ROOT}%{_datadir}/wordpress
 cp -pr * ${RPM_BUILD_ROOT}%{_datadir}/wordpress
-cat wp-config-sample.php | sed -e "s|dirname(__FILE__).'/'|'/usr/share/wordpress/'|g" > \
-	${RPM_BUILD_ROOT}%{_sysconfdir}/wordpress/wp-config.php
+
+# Configuration
+install -m 0644 -D wp-config.php ${RPM_BUILD_ROOT}%{_sysconfdir}/wordpress/wp-config.php
 /bin/ln -sf ../../../etc/wordpress/wp-config.php ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-config.php
+
 /bin/cp %{SOURCE2} ./README.fedora
 /bin/cp %{SOURCE3} ./README.fedora-multiuser
 
@@ -65,15 +228,36 @@ find ${RPM_BUILD_ROOT} -type f -empty -exec rm -vf {} \;
 # These are docs, remove them from here, docify them later
 rm -f ${RPM_BUILD_ROOT}%{_datadir}/wordpress/{license.txt,readme.html}
 
-# Remove bundled php-gettext and link to system copy
-rm -f ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/gettext.php
-
 # Remove bundled php-simplepie and link to system copy
-rm -f ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/class-simplepie.php
-ln -sf /usr/share/php/php-simplepie/simplepie.inc ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/class-simplepie.php
+rm    ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/class-simplepie.php
+rm -r ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/SimplePie
+%if 0%{?rhel} == 5
+ln -s /usr/share/php/php53-simplepie/autoloader.php \
+%else
+ln -s /usr/share/php/php-simplepie/autoloader.php \
+%endif
+       ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/class-simplepie.php
+
+# Remove bundled PHPMailer and link to system one
+# Note POP3 is not from PHPMailer but from SquirrelMail
+for fic in phpmailer smtp; do
+  rm     ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/class-$fic.php
+  ln -sf /usr/share/php/PHPMailer/class.$fic.php \
+         ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/class-$fic.php
+done
+
+%if %{with_getid3}
+# Remove bundled php-getid3
+rm -r ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/ID3
+%endif
+
+# Remove bundled ca-bundle.crt
+rm ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/certificates/ca-bundle.crt
+ln -s %{_sysconfdir}/pki/tls/certs/ca-bundle.crt \
+   ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/certificates/ca-bundle.crt
 
 # Remove backup copies of patches
-find ${RPM_BUILD_ROOT} \( -name \*.dolly -o -name \*.rhbz522897 -o -name \*.FSFaddr \) \
+find ${RPM_BUILD_ROOT} \( -name \*.dolly -o -name \*.rhbz522897 -o -name \*.orig \) \
     -print -delete
 
 ## Move wp-content directory to /var/www location
@@ -89,34 +273,200 @@ find ${RPM_BUILD_ROOT} \( -name \*.dolly -o -name \*.rhbz522897 -o -name \*.FSFa
 #/sbin/restorecon -R %{_localstatedir}/www/wordpress/
 #fi
 
+
 %clean
 rm -rf ${RPM_BUILD_ROOT}
 
 %files
 %defattr(-,root,root,-)
 %config(noreplace) %{_sysconfdir}/httpd/conf.d/wordpress.conf
+%if %{with_nginx}
+%config(noreplace) %{_sysconfdir}/nginx/default.d/wordpress.conf
+%endif
 %dir %{_datadir}/wordpress
 %{_datadir}/wordpress/wp-admin
 %{_datadir}/wordpress/wp-includes
 %{_datadir}/wordpress/index.php
 %dir %{wp_content}/
 %{wp_content}/index.php
-%dir %attr(0775,apache,ftp) %{wp_content}/plugins
-%dir %attr(0775,apache,ftp) %{wp_content}/themes
-%dir %attr(0775,apache,ftp) %{wp_content}/upgrade
-%dir %attr(0775,apache,ftp) %{wp_content}/uploads
+%dir %attr(2775,apache,ftp) %{wp_content}/plugins
+%dir %attr(2775,apache,ftp) %{wp_content}/themes
+%dir %attr(2775,apache,ftp) %{wp_content}/upgrade
+%dir %attr(2775,apache,ftp) %{wp_content}/uploads
 %{wp_content}/plugins/*
 %{wp_content}/themes/*
-%doc license.txt
+%{!?_licensedir:%global license %%doc}
+%license license.txt
 %doc readme.html
 %doc README.fedora
 %doc README.fedora-multiuser
 %{_datadir}/wordpress/wp-*.php
-%config(noreplace) %{_sysconfdir}/wordpress/wp-config.php
+%attr(750,root,apache) %dir               %{_sysconfdir}/wordpress
+%attr(640,root,apache) %config(noreplace) %{_sysconfdir}/wordpress/wp-config.php
 %{_datadir}/wordpress/xmlrpc.php
-%dir %{_sysconfdir}/wordpress
+
 
 %changelog
+* Tue Mar  7 2017 Remi Collet <remi@fedoraproject.org> - 4.7.3-1
+- WordPress 4.7.3 Security and Maintenance Release
+
+* Fri Jan 27 2017 Remi Collet <remi@fedoraproject.org> - 4.7.2-1
+- WordPress 4.7.2 Security Release
+
+* Thu Jan 12 2017 Remi Collet <remi@fedoraproject.org> - 4.7.1-1
+- WordPress 4.7.1 Security and Maintenance Release
+
+* Wed Dec  7 2016 Remi Collet <remi@fedoraproject.org> - 4.7.0-1
+- WordPress 4.7 “Vaughan”
+
+* Thu Sep  8 2016 Remi Collet <remi@fedoraproject.org> - 4.6.1-1
+- WordPress 4.6.1 Security and Maintenance Release
+
+* Sat Sep  3 2016 Remi Collet <remi@fedoraproject.org> - 4.6-2
+- WordPress 4.6 “Pepper”
+- fix directory permissions #1305687
+
+* Wed Jun 22 2016 Remi Collet <remi@fedoraproject.org> - 4.5.3-1
+- WordPress 4.5.3 Maintenance and Security Release
+- never bundle ca-bundle.crt (EL-5)
+- provide nginx configuration (fedora)
+- drop mandatory dependency on httpd (suggested) #1336091
+- protect php files in uploads directory
+
+* Tue May 10 2016 Remi Collet <remi@fedoraproject.org> - 4.5.2-1
+- WordPress 4.5.2 Security Release
+
+* Wed Apr 27 2016 Remi Collet <remi@fedoraproject.org> - 4.5.1-1
+- WordPress 4.5.1 Maintenance Release
+
+* Wed Apr 13 2016 Remi Collet <remi@fedoraproject.org> - 4.5-1
+- WordPress 4.5 “Coleman”
+
+* Wed Feb  3 2016 Remi Collet <remi@fedoraproject.org> - 4.4.2-1
+- WordPress 4.4.2 Security and Maintenance Release
+
+* Thu Jan  7 2016 Remi Collet <remi@fedoraproject.org> - 4.4.1-1
+- WordPress 4.4.1 Security and Maintenance Release
+
+* Wed Dec  9 2015 Remi Collet <remi@fedoraproject.org> - 4.4-1
+- WordPress 4.4 “Clifford”
+
+* Wed Sep 16 2015 Remi Collet <remi@fedoraproject.org> - 4.3.1-1
+- WordPress 4.3.1 Security and Maintenance Release
+
+* Wed Aug 26 2015 Remi Collet <remi@fedoraproject.org> - 4.3-1
+- WordPress 4.3 “Billie”
+
+* Tue Aug  4 2015 Remi Collet <remi@fedoraproject.org> - 4.2.4-1
+- WordPress 4.2.4 Security and Maintenance Release
+
+* Fri Jul 24 2015 Remi Collet <remi@fedoraproject.org> - 4.2.3-1
+- WordPress 4.2.3 Security and Maintenance Release
+
+* Thu May  7 2015 Remi Collet <remi@fedoraproject.org> - 4.2.2-1
+- WordPress 4.2.2 Security and Maintenance Release
+
+* Tue Apr 28 2015 Remi Collet <remi@fedoraproject.org> - 4.2.1-1
+- WordPress 4.2.1 Security Release
+- WordPress 4.2 “Powell”
+
+* Fri Apr 24 2015 Remi Collet <remi@fedoraproject.org> - 4.1.3-1
+- WordPress 4.1.3 Maintenance Release
+
+* Thu Apr 23 2015 Remi Collet <remi@fedoraproject.org> - 4.1.2-1
+- WordPress 4.1.2 Security Release
+
+* Thu Feb 19 2015 Remi Collet <remi@fedoraproject.org> - 4.1.1-1
+- WordPress 4.1.1 Maintenance Release
+
+* Mon Dec 22 2014 Remi Collet <remi@fedoraproject.org> - 4.1-1
+- WordPress 4.1 “Dinah”
+
+* Fri Nov 21 2014 Remi Collet <remi@fedoraproject.org> - 4.0.1-1
+- WordPress 4.0.1 Security Release
+- use system php-getid3 when available #1145574
+
+* Mon Sep  8 2014 Remi Collet <remi@fedoraproject.org> - 4.0-1
+- WordPress 4.0 “Benny”
+
+* Fri Aug  8 2014 Remi Collet <remi@fedoraproject.org> - 3.9.2-3
+- config dir only readable by apache group, better fix for #1124582
+- fix license handling
+
+* Thu Aug  7 2014 Remi Collet <remi@fedoraproject.org> - 3.9.2-2
+- update to 3.9.2 Security Release #1127547
+- config file only readable by apache user (httpd or php-fpm) #1124582
+
+* Fri May  9 2014 Remi Collet <remi@fedoraproject.org> - 3.9.1-1
+- update to 3.9.1 Maintenance Release
+
+* Wed May  7 2014 Remi Collet <remi@fedoraproject.org> - 3.9-1
+- update to 3.9 “Smith”
+
+* Tue Apr 15 2014 Remi Collet <remi@fedoraproject.org> - 3.8.3-1
+- update to 3.8.3 Maintenance Release
+  http://wordpress.org/news/2014/04/wordpress-3-8-3/
+
+* Wed Apr  9 2014 Remi Collet <remi@fedoraproject.org> - 3.8.2-1
+- update to 3.8.2 Security Release
+- fix privilege escalation issue  CVE-2014-0165
+- fix authentication bypass issue CVE-2014-0166
+
+* Sat Jan 25 2014 Remi Collet <remi@fedoraproject.org> - 3.8.1-3
+- ignore WP_AUTO_UPDATE_CORE (always false)
+
+* Fri Jan 24 2014 Remi Collet <remi@fedoraproject.org> - 3.8.1-2
+- comment provided configuration about auto-updater
+- disable auto-updater on default configuration #1057521
+- switch some sed to patch (more robust)
+
+* Thu Jan 23 2014 Adam Williamson <awilliam@redhat.com> - 3.8.1-1
+- new upstream release 3.8.1 (bugfixes)
+
+* Mon Dec 16 2013 Remi Collet <rcollet@redhat.com> - 3.8-1
+- update to 3.8 “Parker” #1043104
+- link to README.fedora in package description
+- add note about optional packages #1037516
+- add php dependencies: ereg, ftp, gd, xml
+- del php dependencies: pdo, reflection
+
+* Wed Oct 30 2013 Remi Collet <rcollet@redhat.com> - 3.7.1-1
+- update to 3.7.1 (bugfixes)
+
+* Fri Oct 25 2013 Remi Collet <rcollet@redhat.com> - 3.7-1
+- update to 3.7
+- requires ca-certificates for ca-bundle.crt
+- drop pre-compiled Flash and Silverlight binaries - #1000267
+
+* Mon Jun 24 2013 Remi Collet <rcollet@redhat.com> - 3.5.2-1
+- version 3.5.2, various bug and security fixes:
+  CVE-2013-2173 CVE-2013-2199 CVE-2013-2200 CVE-2013-2201
+  CVE-2013-2202 CVE-2013-2203 CVE-2013-2204
+
+* Tue Feb 12 2013 Remi Collet <rcollet@redhat.com> - 3.5.1-2
+- provides POP3 class #905867
+  POP3 is not from PHPMailer, but from SquirrelMail
+
+* Wed Jan 30 2013 Remi Collet <rcollet@redhat.com> - 3.5.1-1.1
+- fix simplepie links (for all branches)
+
+* Wed Jan 30 2013 Remi Collet <rcollet@redhat.com> - 3.5.1-1
+- version 3.5.1, various bug and security fixes:
+  CVE-2013-0235, CVE-2013-0236 and CVE-2013-0237
+- drop -f option from rm to break build if
+  upstream archive content change
+- protect akismet content (from upstream .htaccess)
+
+* Wed Jan  2 2013 Remi Collet <rcollet@redhat.com> - 3.5-3
+- fix links to system PHPMailer library
+
+* Wed Dec 12 2012 Matěj Cepl <mcepl@redhat.com> - 3.5-1
+- New upstream release.
+
+* Mon Oct 29 2012 Remi Collet <rcollet@redhat.com> - 3.5-0.3.beta2
+- use system PHPMailer
+- requires needed php extensions
+
 * Thu Sep 06 2012 Matej Cepl <mcepl@redhat.com> - 3.4.2-2
 - Upstream security update.