WordPress 5.1.18 Security Release

(cherry picked from commit 6005fbcc0c)

.gitignore

@@ -1,42 +1,2 @@
-*spec~
 clog
-wordpress-3.0.1.tar.gz
+/wordpress-*.tar.gz
-/wordpress-3.0.2.tar.gz
-/wordpress-3.0.3.tar.gz
-/wordpress-3.0.4.tar.gz
-/wordpress-3.1.tar.gz
-/wordpress-3.1.1.tar.gz
-/wordpress-3.1.2.tar.gz
-/wordpress-3.1.3.tar.gz
-/wordpress-3.2-RC1.zip
-/wordpress-3.2-RC3.zip
-/wordpress-3.2.tar.gz
-/wordpress-3.2.1.tar.gz
-/wordpress-3.3-beta2.tar.gz
-/wordpress-3.3-beta3.tar.gz
-/wordpress-3.3-beta4.tar.gz
-/wordpress-3.3-RC1.tar.gz
-/wordpress-3.3-RC2.tar.gz
-/wordpress-3.3.tar.gz
-/wordpress-3.3.1.tar.gz
-/wordpress-3.4-beta1.tar.gz
-/wordpress-3.4-beta2.tar.gz
-/wordpress-3.4-beta3.tar.gz
-/wordpress-3.4-beta4.tar.gz
-/wordpress-3.4-RC1.tar.gz
-/wordpress-3.4-RC2.tar.gz
-/wordpress-3.4-RC3.tar.gz
-/wordpress-3.4.tar.gz
-/wordpress-3.4.1.tar.gz
-/wordpress-3.4.2.tar.gz
-/wordpress-3.5-beta-1.tar.gz
-/wordpress-3.5-beta2.tar.gz
-/wordpress-3.5-beta3.tar.gz
-/wordpress-3.5-RC1.tar.gz
-/wordpress-3.5-RC2.tar.gz
-/wordpress-3.5-RC3.tar.gz
-/wordpress-3.5.tar.gz
-/wordpress-3.5.1.tar.gz
-/wordpress-3.5.2.tar.gz
-/wordpress-3.6.tar.gz
-

README.fedora.wordpress

@@ -1,3 +1,5 @@
+-------------------------------------------------------------------------------
+
 Wordpress is a database driven blogging program designed to make it exceedingly
 easy to publish an online blog, sometimes also called a weblog or journal.
 
@@ -44,6 +46,8 @@ open a web browser to http://localhost/wordpress/wp-admin/install.php and
 follow the instructions given to you on the pages you see to set up the 
 database tables and begin publishing your blog.
 
+-------------------------------------------------------------------------------
+
 Wordpress ships with Flash and Silverlight plugins for the 'plupload' file
 uploader and the 'mediaelement' media player embedder. The idea is to try and
 be able to provide a multi-file uploader and an embedded video player when
@@ -64,3 +68,19 @@ b) If you try to embed media into a Wordpress post using the [video] and
 a browser that has HTML5 support for the media format in question; if not, the
 'Download Media' link will be offered. No Flash or Silverlight-based player
 element will be included.
+
+-------------------------------------------------------------------------------
+
+Optional dependencies:
+
+You may wish to install the following packages:
+
+	php-pecl-imagick: optimize image transformation
+	php-pecl-ssh2: for file transfert using ssh
+
+An opcode cache is also recommended:
+	php 5.5: php-opcache
+	php 5.4: php-pecl-zendopcache
+	php 5.3: php-pecl-apc
+
+-------------------------------------------------------------------------------

sources

@@ -1 +1 @@
-ddbe1549dc27a260d28b47ad32eadd34  wordpress-3.6.tar.gz
+SHA512 (wordpress-5.1.18.tar.gz) = 4dff8a76fed07d7c547dc5b43d49d0c3175939fe25808af78d8d35d03ea4f9e5f4a604ac21451f993f64abdaa6de5ccfbae35f9e94eb3d3e82919fac9c801900

wordpress-3.6-mediaelement-noflash_silverlight.patch

@@ -1,11 +0,0 @@
---- wordpress/wp-includes/js/mediaelement/mediaelement-and-player.min.js	2013-08-01 06:47:23.000000000 -0700
-+++ wordpress/wp-includes/js/mediaelement/mediaelement-and-player.min.js.new	2013-08-23 16:02:01.491295485 -0700
-@@ -37,7 +37,7 @@
- this.attributes},removeAttribute:function(a){delete this.attributes[a]},getAttribute:function(a){if(this.hasAttribute(a))return this.attributes[a];return""},setAttribute:function(a,b){this.attributes[a]=b},remove:function(){mejs.Utility.removeSwf(this.pluginElement.id);mejs.MediaPluginBridge.unregisterPluginElement(this.pluginElement.id)}};
- mejs.MediaPluginBridge={pluginMediaElements:{},htmlMediaElements:{},registerPluginElement:function(a,b,c){this.pluginMediaElements[a]=b;this.htmlMediaElements[a]=c},unregisterPluginElement:function(a){delete this.pluginMediaElements[a];delete this.htmlMediaElements[a]},initPlugin:function(a){var b=this.pluginMediaElements[a],c=this.htmlMediaElements[a];if(b){switch(b.pluginType){case "flash":b.pluginElement=b.pluginApi=document.getElementById(a);break;case "silverlight":b.pluginElement=document.getElementById(b.id);
- b.pluginApi=b.pluginElement.Content.MediaElementJS}b.pluginApi!=null&&b.success&&b.success(b,c)}},fireEvent:function(a,b,c){var d,e;if(a=this.pluginMediaElements[a]){b={type:b,target:a};for(d in c){a[d]=c[d];b[d]=c[d]}e=c.bufferedTime||0;b.target.buffered=b.buffered={start:function(){return 0},end:function(){return e},length:1};a.dispatchEvent(b.type,b)}}};
--mejs.MediaElementDefaults={mode:"auto",plugins:["flash","silverlight","youtube","vimeo"],enablePluginDebug:false,httpsBasicAuthSite:false,type:"",pluginPath:mejs.Utility.getScriptPath(["mediaelement.js","mediaelement.min.js","mediaelement-and-player.js","mediaelement-and-player.min.js"]),flashName:"flashmediaelement.swf",flashStreamer:"",enablePluginSmoothing:false,enablePseudoStreaming:false,pseudoStreamingStartQueryParam:"start",silverlightName:"silverlightmediaelement.xap",defaultVideoWidth:480,
-+mejs.MediaElementDefaults={mode:"auto",plugins:["youtube","vimeo"],enablePluginDebug:false,httpsBasicAuthSite:false,type:"",pluginPath:mejs.Utility.getScriptPath(["mediaelement.js","mediaelement.min.js","mediaelement-and-player.js","mediaelement-and-player.min.js"]),flashName:"flashmediaelement.swf",flashStreamer:"",enablePluginSmoothing:false,enablePseudoStreaming:false,pseudoStreamingStartQueryParam:"start",silverlightName:"silverlightmediaelement.xap",defaultVideoWidth:480,
- defaultVideoHeight:270,pluginWidth:-1,pluginHeight:-1,pluginVars:[],timerRate:250,startVolume:0.8,success:function(){},error:function(){}};mejs.MediaElement=function(a,b){return mejs.HtmlMediaElementShim.create(a,b)};
- mejs.HtmlMediaElementShim={create:function(a,b){var c=mejs.MediaElementDefaults,d=typeof a=="string"?document.getElementById(a):a,e=d.tagName.toLowerCase(),f=e==="audio"||e==="video",g=f?d.getAttribute("src"):d.getAttribute("href");e=d.getAttribute("poster");var h=d.getAttribute("autoplay"),l=d.getAttribute("preload"),j=d.getAttribute("controls"),k;for(k in b)c[k]=b[k];g=typeof g=="undefined"||g===null||g==""?null:g;e=typeof e=="undefined"||e===null?"":e;l=typeof l=="undefined"||l===null||l==="false"?
- "none":l;h=!(typeof h=="undefined"||h===null||h==="false");j=!(typeof j=="undefined"||j===null||j==="false");k=this.determinePlayback(d,c,mejs.MediaFeatures.supportsMediaTag,f,g);k.url=k.url!==null?mejs.Utility.absolutizeUrl(k.url):"";if(k.method=="native"){if(mejs.MediaFeatures.isBustedAndroid){d.src=k.url;d.addEventListener("click",function(){d.play()},false)}return this.updateNative(k,c,h,l)}else if(k.method!=="")return this.createPlugin(k,c,e,h,l,j);else{this.createErrorMessage(k,c,e);return this}},

wordpress-3.6-no_swfupload.patch

@@ -1,18 +0,0 @@
---- wordpress/wp-includes/script-loader.php	2013-08-01 06:47:23.000000000 -0700
-+++ wordpress/wp-includes/script-loader.php.new	2013-08-23 00:10:37.406222565 -0700
-@@ -252,15 +252,6 @@
- 	$scripts->add( 'wp-plupload', "/wp-includes/js/plupload/wp-plupload$suffix.js", array('plupload-all', 'jquery', 'json2', 'media-models'), false, 1 );
- 	did_action( 'init' ) && $scripts->localize( 'wp-plupload', 'pluploadL10n', $uploader_l10n );
- 
--	// keep 'swfupload' for back-compat.
--	$scripts->add( 'swfupload', '/wp-includes/js/swfupload/swfupload.js', array(), '2201-20110113');
--	$scripts->add( 'swfupload-swfobject', '/wp-includes/js/swfupload/plugins/swfupload.swfobject.js', array('swfupload', 'swfobject'), '2201a');
--	$scripts->add( 'swfupload-queue', '/wp-includes/js/swfupload/plugins/swfupload.queue.js', array('swfupload'), '2201');
--	$scripts->add( 'swfupload-speed', '/wp-includes/js/swfupload/plugins/swfupload.speed.js', array('swfupload'), '2201');
--	$scripts->add( 'swfupload-all', false, array('swfupload', 'swfupload-swfobject', 'swfupload-queue'), '2201');
--	$scripts->add( 'swfupload-handlers', "/wp-includes/js/swfupload/handlers$suffix.js", array('swfupload-all', 'jquery'), '2201-20110524');
--	did_action( 'init' ) && $scripts->localize( 'swfupload-handlers', 'swfuploadL10n', $uploader_l10n );
--
- 	$scripts->add( 'comment-reply', "/wp-includes/js/comment-reply$suffix.js" );
- 
- 	$scripts->add( 'json2', "/wp-includes/js/json2$suffix.js", array(), '2011-02-23');

wordpress-4.9-mediaelement_no_swf.patch

@@ -0,0 +1,38 @@
+diff -up wordpress/wp-includes/js/mediaelement/mediaelement-and-player.js.old wordpress/wp-includes/js/mediaelement/mediaelement-and-player.js
+--- wordpress/wp-includes/js/mediaelement/mediaelement-and-player.js.old	2017-11-16 09:22:17.148277728 +0100
++++ wordpress/wp-includes/js/mediaelement/mediaelement-and-player.js	2017-11-16 09:23:42.056696625 +0100
+@@ -6121,6 +6121,7 @@ if (hasFlash) {
+ 		}
+ 	});
+ 
++/* swf files removed from RPM
+ 	var FlashMediaElementVideoRenderer = {
+ 		name: 'flash_video',
+ 		options: {
+@@ -6205,6 +6206,7 @@ if (hasFlash) {
+ 		create: FlashMediaElementRenderer.create
+ 	};
+ 	_renderer.renderer.add(FlashMediaElementAudioOggRenderer);
++*/
+ }
+ 
+ },{"2":2,"25":25,"27":27,"28":28,"3":3,"5":5,"7":7,"8":8}],21:[function(_dereq_,module,exports){
+diff -up wordpress/wp-includes/js/mediaelement/mediaelement.js.old wordpress/wp-includes/js/mediaelement/mediaelement.js
+--- wordpress/wp-includes/js/mediaelement/mediaelement.js.old	2017-11-16 09:24:44.984007081 +0100
++++ wordpress/wp-includes/js/mediaelement/mediaelement.js	2017-11-16 09:24:49.655030123 +0100
+@@ -1839,6 +1839,7 @@ if (hasFlash) {
+ 		}
+ 	});
+ 
++/* swf files removed from RPM
+ 	var FlashMediaElementVideoRenderer = {
+ 		name: 'flash_video',
+ 		options: {
+@@ -1923,6 +1924,7 @@ if (hasFlash) {
+ 		create: FlashMediaElementRenderer.create
+ 	};
+ 	_renderer.renderer.add(FlashMediaElementAudioOggRenderer);
++*/
+ }
+ 
+ },{"16":16,"18":18,"19":19,"2":2,"3":3,"5":5,"7":7,"8":8}],12:[function(_dereq_,module,exports){

wordpress-5.1-config.patch

@@ -0,0 +1,32 @@
+diff -up wordpress/wp-config.php.orig wordpress/wp-config.php
+--- wordpress/wp-config.php.orig	2019-02-21 15:07:29.558863904 +0100
++++ wordpress/wp-config.php	2019-02-21 15:07:37.024901925 +0100
+@@ -66,6 +66,19 @@ define( 'NONCE_SALT',       'put your un
+ $table_prefix = 'wp_';
+ 
+ /**
++ * See http://make.wordpress.org/core/2013/10/25/the-definitive-guide-to-disabling-auto-updates-in-wordpress-3-7
++ */
++
++/* Disable all file change, as RPM base installation are read-only */
++define('DISALLOW_FILE_MODS', true);
++
++/* Disable automatic updater, in case you want to allow
++   above FILE_MODS for plugins, themes, ... */
++define('AUTOMATIC_UPDATER_DISABLED', true);
++
++/* Core update is always disabled, WP_AUTO_UPDATE_CORE value is ignore */
++
++/**
+  * For developers: WordPress debugging mode.
+  *
+  * Change this to true to enable the display of notices during development.
+@@ -83,7 +96,7 @@ define( 'WP_DEBUG', false );
+ 
+ /** Absolute path to the WordPress directory. */
+ if ( ! defined( 'ABSPATH' ) ) {
+-	define( 'ABSPATH', dirname( __FILE__ ) . '/' );
++	define('ABSPATH', '/usr/share/wordpress');
+ }
+ 
+ /** Sets up WordPress vars and included files. */

wordpress-5.1-no_swfupload.patch

@@ -0,0 +1,16 @@
+diff -up wordpress/wp-includes/script-loader.php.orig wordpress/wp-includes/script-loader.php
+--- wordpress/wp-includes/script-loader.php.orig	2019-02-21 14:57:23.338776485 +0100
++++ wordpress/wp-includes/script-loader.php	2019-02-21 14:57:25.832789185 +0100
+@@ -1098,12 +1098,6 @@ function wp_default_scripts( &$scripts )
+ 	$scripts->add( 'wp-plupload', "/wp-includes/js/plupload/wp-plupload$suffix.js", array( 'plupload', 'jquery', 'json2', 'media-models' ), false, 1 );
+ 	did_action( 'init' ) && $scripts->localize( 'wp-plupload', 'pluploadL10n', $uploader_l10n );
+ 
+-	// keep 'swfupload' for back-compat.
+-	$scripts->add( 'swfupload', '/wp-includes/js/swfupload/swfupload.js', array(), '2201-20110113' );
+-	$scripts->add( 'swfupload-all', false, array( 'swfupload' ), '2201' );
+-	$scripts->add( 'swfupload-handlers', "/wp-includes/js/swfupload/handlers$suffix.js", array( 'swfupload-all', 'jquery' ), '2201-20110524' );
+-	did_action( 'init' ) && $scripts->localize( 'swfupload-handlers', 'swfuploadL10n', $uploader_l10n );
+-
+ 	$scripts->add( 'comment-reply', "/wp-includes/js/comment-reply$suffix.js", array(), false, 1 );
+ 
+ 	$scripts->add( 'json2', "/wp-includes/js/json2$suffix.js", array(), '2015-05-03' );

wordpress-5.1-noupdate.patch

@@ -0,0 +1,74 @@
+diff -up wordpress/wp-admin/includes/admin-filters.php.rpm wordpress/wp-admin/includes/admin-filters.php
+--- wordpress/wp-admin/includes/admin-filters.php.rpm	2019-02-21 15:14:36.864022775 +0100
++++ wordpress/wp-admin/includes/admin-filters.php	2019-02-21 15:14:46.729070707 +0100
+@@ -116,7 +116,6 @@ add_action( 'personal_options_update', '
+ add_action( 'load-plugins.php', 'wp_plugin_update_rows', 20 ); // After wp_update_plugins() is called.
+ add_action( 'load-themes.php', 'wp_theme_update_rows', 20 ); // After wp_update_themes() is called.
+ 
+-add_action( 'admin_notices', 'update_nag', 3 );
+ add_action( 'admin_notices', 'maintenance_nag', 10 );
+ 
+ add_filter( 'update_footer', 'core_update_footer' );
+diff -up wordpress/wp-admin/includes/class-core-upgrader.php.rpm wordpress/wp-admin/includes/class-core-upgrader.php
+--- wordpress/wp-admin/includes/class-core-upgrader.php.rpm	2019-02-21 15:14:36.864022775 +0100
++++ wordpress/wp-admin/includes/class-core-upgrader.php	2019-02-21 15:14:46.729070707 +0100
+@@ -250,6 +250,9 @@ class Core_Upgrader extends WP_Upgrader
+ 	 * @return bool True if we should update to the offered version, otherwise false.
+ 	 */
+ 	public static function should_update_to_version( $offered_ver ) {
++		// RPM: nether allow core update
++		return false;
++
+ 		include( ABSPATH . WPINC . '/version.php' ); // $wp_version; // x.y.z
+ 
+ 		$current_branch                 = implode( '.', array_slice( preg_split( '/[.-]/', $wp_version ), 0, 2 ) ); // x.y
+diff -up wordpress/wp-admin/includes/class-wp-automatic-updater.php.rpm wordpress/wp-admin/includes/class-wp-automatic-updater.php
+--- wordpress/wp-admin/includes/class-wp-automatic-updater.php.rpm	2019-02-21 15:14:36.864022775 +0100
++++ wordpress/wp-admin/includes/class-wp-automatic-updater.php	2019-02-21 15:14:46.729070707 +0100
+@@ -38,7 +38,7 @@ class WP_Automatic_Updater {
+ 		}
+ 
+ 		// More fine grained control can be done through the WP_AUTO_UPDATE_CORE constant and filters.
+-		$disabled = defined( 'AUTOMATIC_UPDATER_DISABLED' ) && AUTOMATIC_UPDATER_DISABLED;
++		$disabled = !defined( 'AUTOMATIC_UPDATER_DISABLED' ) || AUTOMATIC_UPDATER_DISABLED;
+ 
+ 		/**
+ 		 * Filters whether to entirely disable background updates.
+diff -up wordpress/wp-admin/includes/update.php.rpm wordpress/wp-admin/includes/update.php
+--- wordpress/wp-admin/includes/update.php.rpm	2019-02-21 15:14:36.865022780 +0100
++++ wordpress/wp-admin/includes/update.php	2019-02-21 15:14:46.729070707 +0100
+@@ -301,7 +301,7 @@ function update_right_now_message() {
+ 		$cur = get_preferred_from_update_core();
+ 
+ 		if ( isset( $cur->response ) && $cur->response == 'upgrade' ) {
+-			$msg .= '<a href="' . network_admin_url( 'update-core.php' ) . '" class="button" aria-describedby="wp-version">' . sprintf( __( 'Update to %s' ), $cur->current ? $cur->current : __( 'Latest' ) ) . '</a> ';
++			$msg .= '';
+ 		}
+ 	}
+ 
+diff -up wordpress/wp-includes/load.php.rpm wordpress/wp-includes/load.php
+--- wordpress/wp-includes/load.php.rpm	2019-01-30 12:01:52.000000000 +0100
++++ wordpress/wp-includes/load.php	2019-02-21 15:14:36.865022780 +0100
+@@ -1259,7 +1259,7 @@ function wp_is_file_mod_allowed( $contex
+ 	 * @param bool   $file_mod_allowed Whether file modifications are allowed.
+ 	 * @param string $context          The usage context.
+ 	 */
+-	return apply_filters( 'file_mod_allowed', ! defined( 'DISALLOW_FILE_MODS' ) || ! DISALLOW_FILE_MODS, $context );
++	return apply_filters( 'file_mod_allowed', defined( 'DISALLOW_FILE_MODS' ) && ! DISALLOW_FILE_MODS, $context );
+ }
+ 
+ /**
+diff -up wordpress/wp-includes/update.php.rpm wordpress/wp-includes/update.php
+--- wordpress/wp-includes/update.php.rpm	2019-02-21 15:14:36.865022780 +0100
++++ wordpress/wp-includes/update.php	2019-02-21 15:16:50.428671765 +0100
+@@ -770,10 +770,6 @@ function _maybe_update_themes() {
+  * @since 3.1.0
+  */
+ function wp_schedule_update_checks() {
+-	if ( ! wp_next_scheduled( 'wp_version_check' ) && ! wp_installing() ) {
+-		wp_schedule_event( time(), 'twicedaily', 'wp_version_check' );
+-	}
+-
+ 	if ( ! wp_next_scheduled( 'wp_update_plugins' ) && ! wp_installing() ) {
+ 		wp_schedule_event( time(), 'twicedaily', 'wp_update_plugins' );
+ 	}

wordpress-5.1-remove-jshint-refs.patch

@@ -0,0 +1,11 @@
+diff -up wordpress/wp-includes/script-loader.php.orig wordpress/wp-includes/script-loader.php
+--- wordpress/wp-includes/script-loader.php.orig	2019-02-22 10:52:01.902006889 +0100
++++ wordpress/wp-includes/script-loader.php	2019-02-22 10:52:04.560023086 +0100
+@@ -1251,7 +1251,6 @@ function wp_default_scripts( &$scripts )
+ 	$scripts->add( 'wp-codemirror', '/wp-includes/js/codemirror/codemirror.min.js', array(), '5.29.1-alpha-ee20357' );
+ 	$scripts->add( 'csslint', '/wp-includes/js/codemirror/csslint.js', array(), '1.0.5' );
+ 	$scripts->add( 'esprima', '/wp-includes/js/codemirror/esprima.js', array(), '4.0.0' );
+-	$scripts->add( 'jshint', '/wp-includes/js/codemirror/fakejshint.js', array( 'esprima' ), '2.9.5' );
+ 	$scripts->add( 'jsonlint', '/wp-includes/js/codemirror/jsonlint.js', array(), '1.6.2' );
+ 	$scripts->add( 'htmlhint', '/wp-includes/js/codemirror/htmlhint.js', array(), '0.9.14-xwp' );
+ 	$scripts->add( 'htmlhint-kses', '/wp-includes/js/codemirror/htmlhint-kses.js', array( 'htmlhint' ) );

wordpress-5.1-systemlibs.patch

@@ -0,0 +1,21 @@
+diff -up wordpress/wp-admin/includes/media.php.orig wordpress/wp-admin/includes/media.php
+--- wordpress/wp-admin/includes/media.php.orig	2019-02-21 15:01:56.055165397 +0100
++++ wordpress/wp-admin/includes/media.php	2019-02-21 15:02:41.288395787 +0100
+@@ -3261,7 +3261,7 @@ function wp_read_video_metadata( $file )
+ 	}
+ 
+ 	if ( ! class_exists( 'getID3', false ) ) {
+-		require( ABSPATH . WPINC . '/ID3/getid3.php' );
++		require( '/usr/share/php/getid3/getid3.php' );
+ 	}
+ 	$id3  = new getID3();
+ 	$data = $id3->analyze( $file );
+@@ -3358,7 +3358,7 @@ function wp_read_audio_metadata( $file )
+ 	}
+ 
+ 	if ( ! class_exists( 'getID3', false ) ) {
+-		require( ABSPATH . WPINC . '/ID3/getid3.php' );
++		require( '/usr/share/php/getid3/getid3.php' );
+ 	}
+ 	$id3  = new getID3();
+ 	$data = $id3->analyze( $file );

wordpress-5.1-tinymce_noflash.patch

@@ -0,0 +1,35 @@
+diff -up wordpress/wp-includes/js/tinymce/plugins/media/plugin.js.orig wordpress/wp-includes/js/tinymce/plugins/media/plugin.js
+--- wordpress/wp-includes/js/tinymce/plugins/media/plugin.js.orig	2019-02-21 14:59:28.793415420 +0100
++++ wordpress/wp-includes/js/tinymce/plugins/media/plugin.js	2019-02-21 15:00:14.319647286 +0100
+@@ -166,7 +166,6 @@ var media = (function () {
+         mp4: 'video/mp4',
+         webm: 'video/webm',
+         ogg: 'video/ogg',
+-        swf: 'application/x-shockwave-flash'
+       };
+       var fileEnd = url.toLowerCase().split('.').pop();
+       var mime = mimes[fileEnd];
+@@ -424,14 +423,6 @@ var media = (function () {
+       var allowFullscreen = data.allowFullscreen ? ' allowFullscreen="1"' : '';
+       return '<iframe src="' + data.source1 + '" width="' + data.width + '" height="' + data.height + '"' + allowFullscreen + '></iframe>';
+     };
+-    var getFlashHtml = function (data) {
+-      var html = '<object data="' + data.source1 + '" width="' + data.width + '" height="' + data.height + '" type="application/x-shockwave-flash">';
+-      if (data.poster) {
+-        html += '<img src="' + data.poster + '" width="' + data.width + '" height="' + data.height + '" />';
+-      }
+-      html += '</object>';
+-      return html;
+-    };
+     var getAudioHtml = function (data, audioTemplateCallback) {
+       if (audioTemplateCallback) {
+         return audioTemplateCallback(data);
+@@ -494,8 +485,6 @@ var media = (function () {
+         });
+         if (data.type === 'iframe') {
+           return getIframeHtml(data);
+-        } else if (data.source1mime === 'application/x-shockwave-flash') {
+-          return getFlashHtml(data);
+         } else if (data.source1mime.indexOf('audio') !== -1) {
+           return getAudioHtml(data, audioTemplateCallback);
+         } else if (data.type === 'script') {

wordpress-FSF-address.patch

@@ -1,12 +0,0 @@
-diff -up wordpress/wp-includes/kses.php.FSFaddr wordpress/wp-includes/kses.php
---- wordpress/wp-includes/kses.php.FSFaddr	2011-05-25 23:54:34.347025847 +0200
-+++ wordpress/wp-includes/kses.php	2011-05-25 23:56:18.403727954 +0200
-@@ -15,7 +15,7 @@
-  *
-  * You should have received a copy of the GNU General Public License along
-  * with this program; if not, write to the Free Software Foundation, Inc.,
-- * 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA  or visit
-+ * 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-  * http://www.gnu.org/licenses/gpl.html
-  *
-  * [kses strips evil scripts!]

wordpress-debian_patches_hello.patch

@@ -1,13 +1,14 @@
---- wordpress/wp-content/plugins/hello.php	2013-05-22 14:08:40.000000000 -0700
+diff -up ./wp-content/plugins/hello.php.dolly ./wp-content/plugins/hello.php
-+++ wordpress/wp-content/plugins/hello.php.new	2013-08-22 23:46:04.594788007 -0700
+--- ./wp-content/plugins/hello.php.dolly	2018-11-16 00:38:48.000000000 +0100
-@@ -6,42 +6,26 @@
++++ ./wp-content/plugins/hello.php	2018-12-12 13:54:41.867980830 +0100
+@@ -6,41 +6,26 @@
  /*
  Plugin Name: Hello Dolly
  Plugin URI: http://wordpress.org/plugins/hello-dolly/
 -Description: This is not just a plugin, it symbolizes the hope and enthusiasm of an entire generation summed up in two words sung most famously by Louis Armstrong: Hello, Dolly. When activated you will randomly see a lyric from <cite>Hello, Dolly</cite> in the upper right of your admin screen on every page.
 +Description: This is not just a plugin, it symbolizes the hope and enthusiasm of an entire generation summed up in two words sung most famously by Richard M. Stallman: Free Software. When activated you will randomly see a lyric from the <cite>Free Software Song</cite> in the upper right of your admin screen on every page.
  Author: Matt Mullenweg
- Version: 1.6
+ Version: 1.7.1
  Author URI: http://ma.tt/
  */
  
@@ -20,12 +21,11 @@
 -I can tell, Dolly
 -You're still glowin', you're still crowin'
 -You're still goin' strong
--We feel the room swayin'
+-I feel the room swayin'
 -While the band's playin'
--One of your old favourite songs from way back when
+-One of our old favorite songs from way back when
 -So, take her wrap, fellas
--Find her an empty lap, fellas
+-Dolly, never go away again 
--Dolly'll never go away again
 -Hello, Dolly
 -Well, hello, Dolly
 -It's so nice to have you back where you belong
@@ -33,16 +33,16 @@
 -I can tell, Dolly
 -You're still glowin', you're still crowin'
 -You're still goin' strong
--We feel the room swayin'
+-I feel the room swayin'
 -While the band's playin'
--One of your old favourite songs from way back when
+-One of our old favorite songs from way back when
--Golly, gee, fellas
+-So, golly, gee, fellas
--Find her a vacant knee, fellas
+-Have a little faith in me, fellas
--Dolly'll never go away
+-Dolly, never go away
--Dolly'll never go away
+-Promise, you'll never go away
 -Dolly'll never go away again";
 +	// These are the lyrics to the Free Software Song
-+$lyrics = "Join us now and share the software;
++	$lyrics = "Join us now and share the software;
 +You'll be free, hackers, you'll be free.
 +Hoarders may get piles of money,
 +That is true, hackers, that is true.

wordpress-httpd-conf

@@ -1,5 +1,8 @@
 Alias /wordpress /usr/share/wordpress
 
+# Access is only allowed via local access
+# Change this once configured
+
 <Directory /usr/share/wordpress>
   AllowOverride Options
   <IfModule mod_authz_core.c>
@@ -15,7 +18,16 @@ Alias /wordpress /usr/share/wordpress
  </IfModule>
 </Directory>
 
+<Directory /usr/share/wordpress/wp-content/uploads>
+  # Deny access to any php file in the uploads directory
+  <FilesMatch "\.(php)$">
+    Order Deny,Allow
+    Deny from all
+  </FilesMatch>
+</Directory>
+
 <Directory /usr/share/wordpress/wp-content/plugins/akismet>
+  # Deny access to any php file in the akismet directory
   <FilesMatch "\.(php|txt)$">
     Order Deny,Allow
     Deny from all

wordpress-minify.php

@@ -0,0 +1,16 @@
+<?php
+require '/usr/share/php/Patchwork/autoload-jsqueeze.php';
+
+$in = file_get_contents($_SERVER['argv'][1]);
+if (!$in) exit(1);
+$jsqueeze = new \Patchwork\JSqueeze();
+$out = $jsqueeze->squeeze($in);
+if ($out) {
+    printf("+ minify from %s to %s: %2d%% of %6d\n", 
+        basename($_SERVER['argv'][1]), basename($_SERVER['argv'][2]),
+        round(strlen($out)*100/strlen($in)), strlen($in));
+    file_put_contents($_SERVER['argv'][2], $out);
+} else {
+    exit(2);
+}
+

wordpress-nginx-conf

@@ -0,0 +1,35 @@
+# Wordpress
+
+location = /wordpress {
+    alias /usr/share/wordpress/;
+}
+
+location /wordpress/ {
+    root /usr/share;
+    index index.php;
+
+    location ~ ^/wordpress/wp-content/uploads/(.+)\.php$ {
+        # Deny access to any php file in the uploads directory
+        deny all;
+    }
+    location ~ ^/wordpress/wp-content/plugins/akismet/(.+)\.php$ {
+        # Deny access to any php file in the akismet directory
+        deny all;
+    }
+
+    # Access is only allowed via local access
+    # Change this once configured
+    location ~ ^/wordpress/(.+\.php)$ {
+        allow 127.0.0.1;
+        allow ::1;
+        deny all;
+
+        try_files $uri =404;
+        fastcgi_intercept_errors on;
+        include        fastcgi_params;
+        fastcgi_param  SERVER_NAME      $host;
+        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
+        fastcgi_pass   php-fpm;
+    }
+}
+

wordpress.spec

@@ -1,19 +1,34 @@
+# Fedora spec file for wordpress
+#
+# License: MIT
+# http://opensource.org/licenses/MIT
+#
+# Please preserve changelog entries
+#
+%{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}-%{version}}
 %global wp_content %{_datadir}/wordpress/wp-content
-%global betatag RC3
 
-Summary: Blog tool and publishing platform
+%if 0%{?fedora} >= 21 || 0%{?rhel} >= 8
-URL: http://www.wordpress.org
+%global with_nginx 1
-Name: wordpress
+%else
-Version: 3.6
+%global with_nginx 0
-Group: Applications/Publishing
+%endif
-#Release: 0.5.%{betatag}%{?dist}
+
-Release: 1%{?dist}
+Summary:    Blog tool and publishing platform
-License: GPLv2
+URL:        http://www.wordpress.org
-#Source0: http://wordpress.org/%{name}-%{version}-%{betatag}.tar.gz
+Name:       wordpress
-Source0: http://wordpress.org/%{name}-%{version}.tar.gz
+Version:    5.1.18
-Source1: wordpress-httpd-conf
+Release:    1%{?dist}
-Source2: README.fedora.wordpress
+License:    GPLv2
-Source3: README.fedora.wordpress-mu
+
+Source0:    https://wordpress.org/%{name}-%{version}.tar.gz
+Source1:    wordpress-httpd-conf
+Source2:    README.fedora.wordpress
+Source3:    README.fedora.wordpress-mu
+Source4:    wordpress-nginx-conf
+# To minify JS assets
+Source5:    wordpress-minify.php
+
 # Patch out copyrighted text of Hello, Dolly
 # (and replace it with Free Software Song)
 Patch0: wordpress-debian_patches_hello.patch
@@ -21,56 +36,75 @@ Patch0: wordpress-debian_patches_hello.patch
 # This patch doesn’t work well, see bugzilla.redhat.com/522897
 Patch1: wordpress-move-wp-content.patch
 # Drop swfupload: not built from source, not reasonably possible to do
-Patch2: wordpress-3.6-no_swfupload.patch
+Patch2: wordpress-5.1-no_swfupload.patch
 # Adjust tinymce's media plugin not to use its SWF plugin. This changes
 # 'p.getParam("flash_video_player_url",u.convertUrl(u.url+"/moxieplayer.swf"))'
 # to 'false'
-Patch3: wordpress-3.6-tinymce_noflash.patch
+Patch3: wordpress-5.1-tinymce_noflash.patch
-# Adjust mediaelement not to use its SWF and Silverlight plugins. This
+# We drop the SWF files from mediaelement
-# changes 'plugins:["flash,"silverlight","youtube","vimeo"]' to
+Patch4: wordpress-4.9-mediaelement_no_swf.patch
-# 'plugins:["youtube","vimeo"]'
+# RPM configuration:
-Patch4: wordpress-3.6-mediaelement-noflash_silverlight.patch
+# Path to installation
+# Disable auto-updater
+Patch5: wordpress-5.1-config.patch
+# RPM are readonly
+# disable version check and updated
+# change DISALLOW_FILE_MODS default value to true
+# ignore WP_AUTO_UPDATE_CORE (always false)
+Patch6: wordpress-5.1-noupdate.patch
+# Use system libraries
+Patch7: wordpress-5.1-systemlibs.patch
+# Debian patch for jshint
+Patch8: wordpress-5.1-remove-jshint-refs.patch
+
 
-BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildArch: noarch
+BuildRequires: php-cli
+BuildRequires: php-patchwork-jsqueeze
+
+%if %{with_nginx}
+Requires: webserver
+Requires: php(httpd)
+Suggests: httpd
+# For directory ownership
+Requires: httpd-filesystem
+Requires: nginx-filesystem
 
-%if 0%{?rhel} == 5
-Requires: php53 >= 5.2.4
-Requires: php53-simplepie >= 1.3.1
 %else
 Requires: php >= 5.2.4
-Requires: php-simplepie >= 1.3.1
 %endif
-# Required php extension (detected by phpci)
+Requires: php-simplepie >= 1.3.1
+Requires: php-getid3
+Requires: php-ctype
+Requires: php-filter
+Requires: php-mysqli
+
+# From phpcompatinfo report for version 4.5.3
 Requires: php-curl
 Requires: php-date
 Requires: php-dom
-Requires: php-enchant
-# not yet available for RHEL Requires: php-ereg
 Requires: php-exif
 Requires: php-fileinfo
-# not yet available for RHEL Requires: php-filter
+Requires: php-gd
 Requires: php-gettext
 Requires: php-hash
 Requires: php-iconv
+Requires: php-intl
 Requires: php-json
 Requires: php-libxml
 Requires: php-mbstring
-Requires: php-mysql
 Requires: php-openssl
 Requires: php-pcre
-Requires: php-pdo
-Requires: php-posix
-Requires: php-reflection
 Requires: php-simplexml
-Requires: php-sockets
 Requires: php-spl
-Requires: php-tokenizer
+Requires: php-xml
+Requires: php-xmlreader
 Requires: php-zip
 Requires: php-zlib
 # Unbundled libraries
 Requires: php-PHPMailer
-Requires: webserver
+Requires: httpd
+Requires: ca-certificates
 Provides: wordpress-mu = %{version}-%{release}
 Obsoletes: wordpress-mu < 2.9.3
 
@@ -78,59 +112,85 @@ Obsoletes: wordpress-mu < 2.9.3
 Wordpress is an online publishing / weblog package that makes it very easy,
 almost trivial, to get information out to people on the web.
 
+Important information in %{_pkgdocdir}/README.fedora
+
+
 %prep
 %setup -q -n wordpress
 
-# Drop pre-compiled binary lumps: Flash and Silverlight
-# This means that Flash video fallbacks in Wordpress' media support
-# and the tinymce plugin, the plupload Flash and Silverlight
-# uploaders, and swfupload are not available.
-# To re-introduce these they would have to be built from the
-# ActionScript source as part of this package build, they cannot be
-# shipped pre-compiled. Removing plupload.flash.js and
-# plupload.silverlight.js causes plupload only to try and use the html4
-# or html5 uploaders; if you just wipe the binaries but leave the
-# .js files, it will try and use the Flash or Silverlight uploaders
-# and draw a non-functional button. - AdamW, 2013/08
-# https://fedoraproject.org/wiki/Packaging:Guidelines#No_inclusion_of_pre-built_binaries_or_libraries
-
-rm -f wp-includes/js/mediaelement/silverlightmediaelement.xap
-rm -f wp-includes/js/mediaelement/flashmediaelement.sw
-rm -f wp-includes/js/tinymce/plugins/media/moxieplayer.swf
-rm -f wp-includes/js/plupload/plupload.silverlight.xap 
-rm -f wp-includes/js/plupload/plupload.silverlight.js
-rm -f wp-includes/js/plupload/plupload.flash.swf
-rm -f wp-includes/js/plupload/plupload.flash.js
-
 # swfupload can just die in its entirety
 rm -rf wp-includes/js/swfupload
 
-%patch0 -p1 -b .dolly
+# remove .htaccess, protected by httpd config file
-#%patch1 -p1 -b .rhbz522897
+rm wp-content/plugins/akismet/.htaccess
-%patch2 -p1
+
-%patch3 -p1
+%patch -P0 -p1 -b .dolly
-%patch4 -p1
+#patch1 -p1 -b .rhbz522897
+%patch -P2 -p1
+%patch -P3 -p1
+# Adjust mediaelement not to use its SWF
+%patch -P4 -p1
+#rm  wp-includes/js/mediaelement/media*swf
+%patch -P7 -p1
+%patch -P8 -p1
+
+# We patch .js files, so minify them
+php %{SOURCE5} \
+  wp-includes/js/tinymce/plugins/media/plugin.js \
+  wp-includes/js/tinymce/plugins/media/plugin.min.js
+php %{SOURCE5} \
+  wp-includes/js/mediaelement/mediaelement-and-player.js \
+  wp-includes/js/mediaelement/mediaelement-and-player.min.js
+php %{SOURCE5} \
+  wp-includes/js/mediaelement/mediaelement.js \
+  wp-includes/js/mediaelement/mediaelement.min.js
+
+# Re-Generated the archive
+arc=wp-includes/js/tinymce/wp-tinymce.js
+grep "^// Source" $arc | while read a b c
+do
+  if [ -f $c ]; then
+    echo -e "\n$a $b $c"
+    cat $c
+  else
+    exit 1
+  fi
+done >$arc.tmp
+if [ -s $arc.tmp ]; then
+  gzip -c $arc > $arc.gz
+  ls -l $arc*
+  mv $arc.tmp $arc
+else
+  exit 1
+fi
+
+# Create RPM configuration
+sed -e 's/\r//' wp-config-sample.php >wp-config.php
+%patch5 -p1
+%patch6 -p1
 
-# disable wp_version_check, updates are always installed via rpm
-sed -i -e "s,\(.*\)'wp_version_check'\(.*\),#\1'wp_version_check'\2,g" \
-	wp-includes/update.php
-# disable update_nag() function
-sed -i -e "s,\(.*\)'update_nag'\(.*\),#\1'update_nag'\2,g; \
-	s,\(.*\)\$msg .=\(.*\),\1\$msg .= '';,g;" \
-	wp-admin/includes/update.php
 # fix file encoding
 sed -i -e 's/\r//' license.txt
 
+
 %build
 
 %install
-mkdir -p ${RPM_BUILD_ROOT}%{_datadir}/wordpress
+# Apache configuration
-mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/wordpress
 install -m 0644 -D -p %{SOURCE1} ${RPM_BUILD_ROOT}%{_sysconfdir}/httpd/conf.d/wordpress.conf
+
+%if %{with_nginx}
+install -m 0644 -D -p %{SOURCE4} ${RPM_BUILD_ROOT}%{_sysconfdir}/nginx/default.d/wordpress.conf
+%endif
+
+# Application
+mkdir -p ${RPM_BUILD_ROOT}%{_datadir}/wordpress
 cp -pr * ${RPM_BUILD_ROOT}%{_datadir}/wordpress
-cat wp-config-sample.php | sed -e "s|dirname(__FILE__).'/'|'/usr/share/wordpress/'|g" > \
+
-	${RPM_BUILD_ROOT}%{_sysconfdir}/wordpress/wp-config.php
+# Configuration
+install -m 0644 -D wp-config.php ${RPM_BUILD_ROOT}%{_sysconfdir}/wordpress/wp-config.php
 /bin/ln -sf ../../../etc/wordpress/wp-config.php ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-config.php
+
 /bin/cp %{SOURCE2} ./README.fedora
 /bin/cp %{SOURCE3} ./README.fedora-multiuser
 
@@ -143,13 +203,9 @@ find ${RPM_BUILD_ROOT} -type f -empty -exec rm -vf {} \;
 rm -f ${RPM_BUILD_ROOT}%{_datadir}/wordpress/{license.txt,readme.html}
 
 # Remove bundled php-simplepie and link to system copy
-rm     ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/class-simplepie.php
+rm    ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/class-simplepie.php
-rm -rf ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/SimplePie
+rm -r ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/SimplePie
-%if 0%{?rhel} == 5
+ln -s /usr/share/php/php-simplepie/autoloader.php \
-ln -sf /usr/share/php/php53-simplepie/autoloader.php \
-%else
-ln -sf /usr/share/php/php-simplepie/autoloader.php \
-%endif
        ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/class-simplepie.php
 
 # Remove bundled PHPMailer and link to system one
@@ -160,51 +216,309 @@ for fic in phpmailer smtp; do
          ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/class-$fic.php
 done
 
+# Remove bundled php-getid3
+rm -r ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/ID3
+
+# Remove bundled ca-bundle.crt
+rm ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/certificates/ca-bundle.crt
+ln -s %{_sysconfdir}/pki/tls/certs/ca-bundle.crt \
+   ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/certificates/ca-bundle.crt
+
 # Remove backup copies of patches
-find ${RPM_BUILD_ROOT} \( -name \*.dolly -o -name \*.rhbz522897 -o -name \*.FSFaddr \) \
+find ${RPM_BUILD_ROOT} \( -name \*.dolly -o -name \*.rhbz522897 -o -name \*.orig \) \
     -print -delete
 
 ## Move wp-content directory to /var/www location
-#mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/www/wordpress
+#mkdir -p ${RPM_BUILD_ROOT}%%{_localstatedir}/www/wordpress
-#mv -v ${RPM_BUILD_ROOT}%{wp_content}/ \
+#mv -v ${RPM_BUILD_ROOT}%%{wp_content}/ \
-#  ${RPM_BUILD_ROOT}%{_localstatedir}/www/wordpress
+#  ${RPM_BUILD_ROOT}%%{_localstatedir}/www/wordpress
 
-#%post
+#%%post
 #if [ $1 -eq 2 ] ; then
 ## In case user has old wp-content from previous version, move it to
 ## the new location.
-#mv -uf %{wp_content}/* %{_localstatedir}/www/wordpress/
+#mv -uf %%{wp_content}/* %%{_localstatedir}/www/wordpress/
-#/sbin/restorecon -R %{_localstatedir}/www/wordpress/
+#/sbin/restorecon -R %%{_localstatedir}/www/wordpress/
 #fi
 
-%clean
-rm -rf ${RPM_BUILD_ROOT}
 
 %files
-%defattr(-,root,root,-)
 %config(noreplace) %{_sysconfdir}/httpd/conf.d/wordpress.conf
+%if %{with_nginx}
+%config(noreplace) %{_sysconfdir}/nginx/default.d/wordpress.conf
+%endif
 %dir %{_datadir}/wordpress
 %{_datadir}/wordpress/wp-admin
 %{_datadir}/wordpress/wp-includes
 %{_datadir}/wordpress/index.php
 %dir %{wp_content}/
 %{wp_content}/index.php
-%dir %attr(0775,apache,ftp) %{wp_content}/plugins
+%dir %attr(2775,apache,ftp) %{wp_content}/plugins
-%dir %attr(0775,apache,ftp) %{wp_content}/themes
+%dir %attr(2775,apache,ftp) %{wp_content}/themes
-%dir %attr(0775,apache,ftp) %{wp_content}/upgrade
+%dir %attr(2775,apache,ftp) %{wp_content}/upgrade
-%dir %attr(0775,apache,ftp) %{wp_content}/uploads
+%dir %attr(2775,apache,ftp) %{wp_content}/uploads
 %{wp_content}/plugins/*
 %{wp_content}/themes/*
-%doc license.txt
+%{!?_licensedir:%global license %%doc}
+%license license.txt
 %doc readme.html
 %doc README.fedora
 %doc README.fedora-multiuser
 %{_datadir}/wordpress/wp-*.php
-%config(noreplace) %{_sysconfdir}/wordpress/wp-config.php
+%attr(750,root,apache) %dir               %{_sysconfdir}/wordpress
+%attr(640,root,apache) %config(noreplace) %{_sysconfdir}/wordpress/wp-config.php
 %{_datadir}/wordpress/xmlrpc.php
-%dir %{_sysconfdir}/wordpress
+
 
 %changelog
+* Thu Feb 01 2024 Remi Collet <remi@remirepo.net> - 5.1.18-1
+- WordPress 5.1.18 Security Release
+
+* Mon Oct 16 2023 Remi Collet <remi@remirepo.net> - 5.1.17-1
+- WordPress 5.1.17 Security Release
+
+* Wed May 17 2023 Remi Collet <remi@remirepo.net> - 5.1.16-1
+- WordPress 5.1.16 Security Release
+
+* Tue Oct 18 2022 Remi Collet <remi@remirepo.net> - 5.1.15-1
+- WordPress 5.1.15 Security Release
+
+* Fri Mar 11 2022 Remi Collet <remi@remirepo.net> - 5.1.13-1
+- WordPress 5.1.13 Security Release
+
+* Fri Jan  7 2022 Remi Collet <remi@remirepo.net> - 5.1.12-1
+- WordPress 5.1.12 Security Release
+
+* Thu Nov 11 2021 Remi Collet <remi@remirepo.net> - 5.1.11-1
+- WordPress 5.1.11 Security Release
+
+* Mon May 17 2021 Remi Collet <remi@remirepo.net> - 5.1.10-1
+- WordPress 5.1.10 Security Release
+
+* Thu Apr 15 2021 Remi Collet <remi@remirepo.net> - 5.1.9-1
+- WordPress 5.1.9 Security Release
+
+* Mon Nov  2 2020 Remi Collet <remi@remirepo.net> - 5.1.8-1
+- WordPress 5.1.8 Maintenance Release
+
+* Fri Oct 30 2020 Remi Collet <remi@remirepo.net> - 5.1.7-1
+- WordPress 5.1.7 Security Release
+
+* Thu Jun 11 2020 Remi Collet <remi@remirepo.net> - 5.1.6-1
+- WordPress 5.1.6 Security Release
+
+* Thu Apr 30 2020 Remi Collet <remi@remirepo.net> - 5.1.5-1
+- WordPress 5.1.5 Security Release
+
+* Fri Dec 13 2019 Remi Collet <remi@remirepo.net> - 5.1.4-1
+- WordPress 5.1.4 Security Release
+
+* Tue Oct 15 2019 Remi Collet <remi@remirepo.net> - 5.1.3-1
+- WordPress 5.1.3 Security Release
+
+* Thu Sep  5 2019 Remi Collet <remi@remirepo.net> - 5.1.2-1
+- update to 5.1.2
+
+* Fri Mar 22 2019 Remi Collet <remi@remirepo.net> - 5.1.1-4
+- fix wp-tinymce.js is missing, wp-tinymce.js.gz is empty #1691524
+
+* Wed Mar 13 2019 Remi Collet <remi@remirepo.net> - 5.1.1-1
+- WordPress 5.1.1 Security and Maintenance Release
+
+* Fri Feb 22 2019 Remi Collet <remi@remirepo.net> - 5.1-1
+- WordPress 5.1 “Betty”
+
+* Fri Jan 11 2019 Remi Collet <remi@remirepo.net> - 5.0.3-1
+- WordPress 5.0.3 Maintenance Release
+
+* Thu Dec 20 2018 Remi Collet <remi@remirepo.net> - 5.0.2-1
+- WordPress 5.0.2 Maintenance Release
+
+* Thu Dec 13 2018 Remi Collet <remi@remirepo.net> - 5.0.1-1
+- WordPress 5.0.1 Security Release
+
+* Wed Dec 12 2018 Remi Collet <remi@remirepo.net> - 5.0-1
+- WordPress 5.0 “Bebo”
+
+* Fri Aug 03 2018 Kevin Fenzi <kevin@scrye.com> - 4.9.8-1
+- Update to 4.9.8. Fixes bug #1611877
+
+* Thu Jul 05 2018 Kevin Fenzi <kevin@scrye.com> - 4.9.7-1
+- Update to 4.9.7 security update. Fixes bug #1598612
+- Fixes CVE-2018-12895 bugs #1595584 and #1595585
+
+* Fri May 18 2018 Kevin Fenzi <kevin@scrye.com> - 4.9.6-1
+- Update to 4.9.6. Fixes bug #1579584
+
+* Wed Apr  4 2018 Remi Collet <remi@remirepo.net> - 4.9.5-1
+- WordPress 4.9.5 Security and Maintenance Release
+
+* Wed Feb  7 2018 Remi Collet <remi@remirepo.net> - 4.9.4-1
+- WordPress 4.9.4 Maintenance Release
+
+* Wed Jan 17 2018 Remi Collet <remi@remirepo.net> - 4.9.2-1
+- WordPress 4.9.2 Security and Maintenance Release
+- drop non-free jshint.js file #1528765
+
+* Thu Nov 30 2017 Remi Collet <remi@remirepo.net> - 4.9.1-1
+- WordPress 4.9.1 Security and Maintenance Release
+
+* Thu Nov 16 2017 Remi Collet <remi@remirepo.net> - 4.9-1
+- WordPress 4.9 “Tipton”
+- minify patched JS files
+
+* Tue Oct 31 2017 Kevin Fenzi <kevin@scrye.com> - 4.8.3-1
+- Update to 4.8.3. Security release. Fixes bug #1508255
+
+* Wed Sep 20 2017 Remi Collet <remi@remirepo.net> - 4.8.2-1
+- Update to 4.8.2 Security and Maintenance Release
+
+* Thu Aug  3 2017 Remi Collet <remi@remirepo.net> - 4.8.1-1
+- Update to 4.8.1 Maintenance Release.
+
+* Fri Jun  9 2017 Remi Collet <remi@remirepo.net> - 4.8-1
+- WordPress 4.8 “Evans”
+
+* Wed May 17 2017 Remi Collet <remi@remirepo.net> - 4.7.5-1
+- WordPress 4.7.5 Security and Maintenance Release
+
+* Sat Apr 22 2017 Kevin Fenzi <kevin@scrye.com> - 4.7.4-1
+- Update to 4.7.4. Maintenance Release.
+
+* Tue Mar  7 2017 Remi Collet <remi@fedoraproject.org> - 4.7.3-1
+- WordPress 4.7.3 Security and Maintenance Release
+
+* Fri Jan 27 2017 Remi Collet <remi@fedoraproject.org> - 4.7.2-1
+- WordPress 4.7.2 Security Release
+
+* Thu Jan 12 2017 Remi Collet <remi@fedoraproject.org> - 4.7.1-1
+- WordPress 4.7.1 Security and Maintenance Release
+
+* Wed Dec  7 2016 Remi Collet <remi@fedoraproject.org> - 4.7.0-1
+- WordPress 4.7 “Vaughan”
+
+* Thu Sep  8 2016 Remi Collet <remi@fedoraproject.org> - 4.6.1-1
+- WordPress 4.6.1 Security and Maintenance Release
+
+* Sat Sep  3 2016 Remi Collet <remi@fedoraproject.org> - 4.6-2
+- WordPress 4.6 “Pepper”
+- fix directory permissions #1305687
+
+* Wed Jun 22 2016 Remi Collet <remi@fedoraproject.org> - 4.5.3-1
+- WordPress 4.5.3 Maintenance and Security Release
+- never bundle ca-bundle.crt (EL-5)
+- provide nginx configuration (fedora)
+- drop mandatory dependency on httpd (suggested) #1336091
+- protect php files in uploads directory
+
+* Tue May 10 2016 Remi Collet <remi@fedoraproject.org> - 4.5.2-1
+- WordPress 4.5.2 Security Release
+
+* Wed Apr 27 2016 Remi Collet <remi@fedoraproject.org> - 4.5.1-1
+- WordPress 4.5.1 Maintenance Release
+
+* Wed Apr 13 2016 Remi Collet <remi@fedoraproject.org> - 4.5-1
+- WordPress 4.5 “Coleman”
+
+* Wed Feb  3 2016 Remi Collet <remi@fedoraproject.org> - 4.4.2-1
+- WordPress 4.4.2 Security and Maintenance Release
+
+* Thu Jan  7 2016 Remi Collet <remi@fedoraproject.org> - 4.4.1-1
+- WordPress 4.4.1 Security and Maintenance Release
+
+* Wed Dec  9 2015 Remi Collet <remi@fedoraproject.org> - 4.4-1
+- WordPress 4.4 “Clifford”
+
+* Wed Sep 16 2015 Remi Collet <remi@fedoraproject.org> - 4.3.1-1
+- WordPress 4.3.1 Security and Maintenance Release
+
+* Wed Aug 26 2015 Remi Collet <remi@fedoraproject.org> - 4.3-1
+- WordPress 4.3 “Billie”
+
+* Tue Aug  4 2015 Remi Collet <remi@fedoraproject.org> - 4.2.4-1
+- WordPress 4.2.4 Security and Maintenance Release
+
+* Fri Jul 24 2015 Remi Collet <remi@fedoraproject.org> - 4.2.3-1
+- WordPress 4.2.3 Security and Maintenance Release
+
+* Thu May  7 2015 Remi Collet <remi@fedoraproject.org> - 4.2.2-1
+- WordPress 4.2.2 Security and Maintenance Release
+
+* Tue Apr 28 2015 Remi Collet <remi@fedoraproject.org> - 4.2.1-1
+- WordPress 4.2.1 Security Release
+- WordPress 4.2 “Powell”
+
+* Fri Apr 24 2015 Remi Collet <remi@fedoraproject.org> - 4.1.3-1
+- WordPress 4.1.3 Maintenance Release
+
+* Thu Apr 23 2015 Remi Collet <remi@fedoraproject.org> - 4.1.2-1
+- WordPress 4.1.2 Security Release
+
+* Thu Feb 19 2015 Remi Collet <remi@fedoraproject.org> - 4.1.1-1
+- WordPress 4.1.1 Maintenance Release
+
+* Mon Dec 22 2014 Remi Collet <remi@fedoraproject.org> - 4.1-1
+- WordPress 4.1 “Dinah”
+
+* Fri Nov 21 2014 Remi Collet <remi@fedoraproject.org> - 4.0.1-1
+- WordPress 4.0.1 Security Release
+- use system php-getid3 when available #1145574
+
+* Mon Sep  8 2014 Remi Collet <remi@fedoraproject.org> - 4.0-1
+- WordPress 4.0 “Benny”
+
+* Fri Aug  8 2014 Remi Collet <remi@fedoraproject.org> - 3.9.2-3
+- config dir only readable by apache group, better fix for #1124582
+- fix license handling
+
+* Thu Aug  7 2014 Remi Collet <remi@fedoraproject.org> - 3.9.2-2
+- update to 3.9.2 Security Release #1127547
+- config file only readable by apache user (httpd or php-fpm) #1124582
+
+* Fri May  9 2014 Remi Collet <remi@fedoraproject.org> - 3.9.1-1
+- update to 3.9.1 Maintenance Release
+
+* Wed May  7 2014 Remi Collet <remi@fedoraproject.org> - 3.9-1
+- update to 3.9 “Smith”
+
+* Tue Apr 15 2014 Remi Collet <remi@fedoraproject.org> - 3.8.3-1
+- update to 3.8.3 Maintenance Release
+  http://wordpress.org/news/2014/04/wordpress-3-8-3/
+
+* Wed Apr  9 2014 Remi Collet <remi@fedoraproject.org> - 3.8.2-1
+- update to 3.8.2 Security Release
+- fix privilege escalation issue  CVE-2014-0165
+- fix authentication bypass issue CVE-2014-0166
+
+* Sat Jan 25 2014 Remi Collet <remi@fedoraproject.org> - 3.8.1-3
+- ignore WP_AUTO_UPDATE_CORE (always false)
+
+* Fri Jan 24 2014 Remi Collet <remi@fedoraproject.org> - 3.8.1-2
+- comment provided configuration about auto-updater
+- disable auto-updater on default configuration #1057521
+- switch some sed to patch (more robust)
+
+* Thu Jan 23 2014 Adam Williamson <awilliam@redhat.com> - 3.8.1-1
+- new upstream release 3.8.1 (bugfixes)
+
+* Mon Dec 16 2013 Remi Collet <rcollet@redhat.com> - 3.8-1
+- update to 3.8 “Parker” #1043104
+- link to README.fedora in package description
+- add note about optional packages #1037516
+- add php dependencies: ereg, ftp, gd, xml
+- del php dependencies: pdo, reflection
+
+* Wed Oct 30 2013 Remi Collet <rcollet@redhat.com> - 3.7.1-1
+- update to 3.7.1 (bugfixes)
+
+* Fri Oct 25 2013 Remi Collet <rcollet@redhat.com> - 3.7-1
+- update to 3.7
+- requires ca-certificates for ca-bundle.crt
+
+* Thu Sep 12 2013 Paul Wouters <pwouters@redhat.com> - 3.6.1-1
+- update to 3.6.1, various bugs and security fixes:
+  CVE-2013-4338 CVE-2013-4339 CVE-2013-4340
+
 * Thu Aug 22 2013 Adam Williamson <awilliam@redhat.com> - 3.6.0-1
 - update to 3.6.0
 - drop pre-compiled Flash and Silverlight binaries - #1000267