WordPress 4.2.2 Security and Maintenance Release

(cherry picked from commit c3247e0fb0)

.gitignore

@@ -1,3 +1,19 @@
 *spec~
 clog
 /wordpress-3.7.tar.gz
+/wordpress-3.7.1.tar.gz
+/wordpress-3.8.tar.gz
+/wordpress-3.8.1.tar.gz
+/wordpress-3.8.2.tar.gz
+/wordpress-3.8.3.tar.gz
+/wordpress-3.9.tar.gz
+/wordpress-3.9.1.tar.gz
+/wordpress-3.9.2.tar.gz
+/wordpress-4.0.tar.gz
+/wordpress-4.0.1.tar.gz
+/wordpress-4.1.tar.gz
+/wordpress-4.1.1.tar.gz
+/wordpress-4.1.2.tar.gz
+/wordpress-4.2.tar.gz
+/wordpress-4.2.1.tar.gz
+/wordpress-4.2.2.tar.gz

README.fedora.wordpress

@@ -1,3 +1,5 @@
+-------------------------------------------------------------------------------
+
 Wordpress is a database driven blogging program designed to make it exceedingly
 easy to publish an online blog, sometimes also called a weblog or journal.
 
@@ -44,6 +46,8 @@ open a web browser to http://localhost/wordpress/wp-admin/install.php and
 follow the instructions given to you on the pages you see to set up the 
 database tables and begin publishing your blog.
 
+-------------------------------------------------------------------------------
+
 Wordpress ships with Flash and Silverlight plugins for the 'plupload' file
 uploader and the 'mediaelement' media player embedder. The idea is to try and
 be able to provide a multi-file uploader and an embedded video player when
@@ -64,3 +68,19 @@ b) If you try to embed media into a Wordpress post using the [video] and
 a browser that has HTML5 support for the media format in question; if not, the
 'Download Media' link will be offered. No Flash or Silverlight-based player
 element will be included.
+
+-------------------------------------------------------------------------------
+
+Optional dependencies:
+
+You may wish to install the following packages:
+
+	php-pecl-imagick: optimize image transformation
+	php-pecl-ssh2: for file transfert using ssh
+
+An opcode cache is also recommended:
+	php 5.5: php-opcache
+	php 5.4: php-pecl-zendopcache
+	php 5.3: php-pecl-apc
+
+-------------------------------------------------------------------------------

sources

@@ -1 +1 @@
-aaad36cd739b825952cf3e09de5e7856  wordpress-3.7.tar.gz
+c40d56cf85975482d5f5fa8c4b97d1d2  wordpress-4.2.2.tar.gz

wordpress-3.6-mediaelement-noflash_silverlight.patch

@@ -1,11 +0,0 @@
---- wordpress/wp-includes/js/mediaelement/mediaelement-and-player.min.js	2013-08-01 06:47:23.000000000 -0700
-+++ wordpress/wp-includes/js/mediaelement/mediaelement-and-player.min.js.new	2013-08-23 16:02:01.491295485 -0700
-@@ -37,7 +37,7 @@
- this.attributes},removeAttribute:function(a){delete this.attributes[a]},getAttribute:function(a){if(this.hasAttribute(a))return this.attributes[a];return""},setAttribute:function(a,b){this.attributes[a]=b},remove:function(){mejs.Utility.removeSwf(this.pluginElement.id);mejs.MediaPluginBridge.unregisterPluginElement(this.pluginElement.id)}};
- mejs.MediaPluginBridge={pluginMediaElements:{},htmlMediaElements:{},registerPluginElement:function(a,b,c){this.pluginMediaElements[a]=b;this.htmlMediaElements[a]=c},unregisterPluginElement:function(a){delete this.pluginMediaElements[a];delete this.htmlMediaElements[a]},initPlugin:function(a){var b=this.pluginMediaElements[a],c=this.htmlMediaElements[a];if(b){switch(b.pluginType){case "flash":b.pluginElement=b.pluginApi=document.getElementById(a);break;case "silverlight":b.pluginElement=document.getElementById(b.id);
- b.pluginApi=b.pluginElement.Content.MediaElementJS}b.pluginApi!=null&&b.success&&b.success(b,c)}},fireEvent:function(a,b,c){var d,e;if(a=this.pluginMediaElements[a]){b={type:b,target:a};for(d in c){a[d]=c[d];b[d]=c[d]}e=c.bufferedTime||0;b.target.buffered=b.buffered={start:function(){return 0},end:function(){return e},length:1};a.dispatchEvent(b.type,b)}}};
--mejs.MediaElementDefaults={mode:"auto",plugins:["flash","silverlight","youtube","vimeo"],enablePluginDebug:false,httpsBasicAuthSite:false,type:"",pluginPath:mejs.Utility.getScriptPath(["mediaelement.js","mediaelement.min.js","mediaelement-and-player.js","mediaelement-and-player.min.js"]),flashName:"flashmediaelement.swf",flashStreamer:"",enablePluginSmoothing:false,enablePseudoStreaming:false,pseudoStreamingStartQueryParam:"start",silverlightName:"silverlightmediaelement.xap",defaultVideoWidth:480,
-+mejs.MediaElementDefaults={mode:"auto",plugins:["youtube","vimeo"],enablePluginDebug:false,httpsBasicAuthSite:false,type:"",pluginPath:mejs.Utility.getScriptPath(["mediaelement.js","mediaelement.min.js","mediaelement-and-player.js","mediaelement-and-player.min.js"]),flashName:"flashmediaelement.swf",flashStreamer:"",enablePluginSmoothing:false,enablePseudoStreaming:false,pseudoStreamingStartQueryParam:"start",silverlightName:"silverlightmediaelement.xap",defaultVideoWidth:480,
- defaultVideoHeight:270,pluginWidth:-1,pluginHeight:-1,pluginVars:[],timerRate:250,startVolume:0.8,success:function(){},error:function(){}};mejs.MediaElement=function(a,b){return mejs.HtmlMediaElementShim.create(a,b)};
- mejs.HtmlMediaElementShim={create:function(a,b){var c=mejs.MediaElementDefaults,d=typeof a=="string"?document.getElementById(a):a,e=d.tagName.toLowerCase(),f=e==="audio"||e==="video",g=f?d.getAttribute("src"):d.getAttribute("href");e=d.getAttribute("poster");var h=d.getAttribute("autoplay"),l=d.getAttribute("preload"),j=d.getAttribute("controls"),k;for(k in b)c[k]=b[k];g=typeof g=="undefined"||g===null||g==""?null:g;e=typeof e=="undefined"||e===null?"":e;l=typeof l=="undefined"||l===null||l==="false"?
- "none":l;h=!(typeof h=="undefined"||h===null||h==="false");j=!(typeof j=="undefined"||j===null||j==="false");k=this.determinePlayback(d,c,mejs.MediaFeatures.supportsMediaTag,f,g);k.url=k.url!==null?mejs.Utility.absolutizeUrl(k.url):"";if(k.method=="native"){if(mejs.MediaFeatures.isBustedAndroid){d.src=k.url;d.addEventListener("click",function(){d.play()},false)}return this.updateNative(k,c,h,l)}else if(k.method!=="")return this.createPlugin(k,c,e,h,l,j);else{this.createErrorMessage(k,c,e);return this}},

wordpress-4.0-config.patch

@@ -0,0 +1,32 @@
+diff -up wordpress/wp-config.php.orig wordpress/wp-config.php
+--- wordpress/wp-config.php.orig	2014-09-08 13:12:36.525908423 +0200
++++ wordpress/wp-config.php	2014-09-08 13:14:33.583402525 +0200
+@@ -62,6 +62,19 @@ define('NONCE_SALT',       'put your uni
+ $table_prefix  = 'wp_';
+ 
+ /**
++ * See http://make.wordpress.org/core/2013/10/25/the-definitive-guide-to-disabling-auto-updates-in-wordpress-3-7
++ */
++
++/* Disable all file change, as RPM base installation are read-only */
++define('DISALLOW_FILE_MODS', true);
++
++/* Disable automatic updater, in case you want to allow
++   above FILE_MODS for plugins, themes, ... */
++define('AUTOMATIC_UPDATER_DISABLED', true);
++
++/* Core update is always disabled, WP_AUTO_UPDATE_CORE value is ignore */
++
++/**
+  * For developers: WordPress debugging mode.
+  *
+  * Change this to true to enable the display of notices during development.
+@@ -74,7 +87,7 @@ define('WP_DEBUG', false);
+ 
+ /** Absolute path to the WordPress directory. */
+ if ( !defined('ABSPATH') )
+-	define('ABSPATH', dirname(__FILE__) . '/');
++	define('ABSPATH', '/usr/share/wordpress');
+ 
+ /** Sets up WordPress vars and included files. */
+ require_once(ABSPATH . 'wp-settings.php');

wordpress-4.0-systemlibs.patch

@@ -0,0 +1,21 @@
+diff -up wordpress/wp-admin/includes/media.php.old wordpress/wp-admin/includes/media.php
+--- wordpress/wp-admin/includes/media.php.old	2014-09-30 08:54:21.666519693 +0200
++++ wordpress/wp-admin/includes/media.php	2014-09-30 08:55:11.247757421 +0200
+@@ -2907,7 +2907,7 @@ function wp_read_video_metadata( $file )
+ 	$metadata = array();
+ 
+ 	if ( ! class_exists( 'getID3' ) )
+-		require( ABSPATH . WPINC . '/ID3/getid3.php' );
++		require( '/usr/share/php/getid3/getid3.php' );
+ 	$id3 = new getID3();
+ 	$data = $id3->analyze( $file );
+ 
+@@ -2962,7 +2962,7 @@ function wp_read_audio_metadata( $file )
+ 	$metadata = array();
+ 
+ 	if ( ! class_exists( 'getID3' ) )
+-		require( ABSPATH . WPINC . '/ID3/getid3.php' );
++		require( '/usr/share/php/getid3/getid3.php' );
+ 	$id3 = new getID3();
+ 	$data = $id3->analyze( $file );
+ 

wordpress-4.0-tinymce_noflash.patch

@@ -0,0 +1,23 @@
+diff -up wordpress/wp-includes/js/tinymce/plugins/media/plugin.js.rpm wordpress/wp-includes/js/tinymce/plugins/media/plugin.js
+--- wordpress/wp-includes/js/tinymce/plugins/media/plugin.js.rpm	2014-08-22 01:53:18.000000000 +0200
++++ wordpress/wp-includes/js/tinymce/plugins/media/plugin.js	2014-09-08 13:10:15.717314458 +0200
+@@ -44,10 +44,6 @@ tinymce.PluginManager.add('media', funct
+ 			return 'video/ogg';
+ 		}
+ 
+-		if (url.indexOf('.swf') != -1) {
+-			return 'application/x-shockwave-flash';
+-		}
+-
+ 		return '';
+ 	}
+ 
+@@ -239,7 +235,7 @@ tinymce.PluginManager.add('media', funct
+ 		data.source1mime = guessMime(data.source1);
+ 		data.source2mime = guessMime(data.source2);
+ 		data.poster = editor.convertURL(data.poster, "poster");
+-		data.flashPlayerUrl = editor.convertURL(url + '/moxieplayer.swf', "movie");
++		data.flashPlayerUrl = false;
+ 
+ 		tinymce.each(urlPatterns, function(pattern) {
+ 			var match, i, url;

wordpress-4.2-no_swfupload.patch

@@ -1,7 +1,8 @@
---- wordpress/wp-includes/script-loader.php	2013-08-01 06:47:23.000000000 -0700
+diff -up wordpress/wp-includes/script-loader.php.orig wordpress/wp-includes/script-loader.php
-+++ wordpress/wp-includes/script-loader.php.new	2013-08-23 00:10:37.406222565 -0700
+--- wordpress/wp-includes/script-loader.php.orig	2014-05-07 15:55:26.485228222 +0200
-@@ -252,15 +252,6 @@
++++ wordpress/wp-includes/script-loader.php	2014-05-07 15:55:18.019198073 +0200
- 	$scripts->add( 'wp-plupload', "/wp-includes/js/plupload/wp-plupload$suffix.js", array('plupload-all', 'jquery', 'json2', 'media-models'), false, 1 );
+@@ -280,15 +280,6 @@
+ 	$scripts->add( 'wp-plupload', "/wp-includes/js/plupload/wp-plupload$suffix.js", array( 'plupload', 'jquery', 'json2', 'media-models' ), false, 1 );
  	did_action( 'init' ) && $scripts->localize( 'wp-plupload', 'pluploadL10n', $uploader_l10n );
  
 -	// keep 'swfupload' for back-compat.
@@ -13,6 +14,6 @@
 -	$scripts->add( 'swfupload-handlers', "/wp-includes/js/swfupload/handlers$suffix.js", array('swfupload-all', 'jquery'), '2201-20110524');
 -	did_action( 'init' ) && $scripts->localize( 'swfupload-handlers', 'swfuploadL10n', $uploader_l10n );
 -
- 	$scripts->add( 'comment-reply', "/wp-includes/js/comment-reply$suffix.js" );
+ 	$scripts->add( 'comment-reply', "/wp-includes/js/comment-reply$suffix.js", array(), false, 1 );
  
- 	$scripts->add( 'json2', "/wp-includes/js/json2$suffix.js", array(), '2011-02-23');
+ 	$scripts->add( 'json2', "/wp-includes/js/json2$suffix.js", array(), '2011-02-23' );

wordpress-4.2-noupdate.patch

@@ -0,0 +1,86 @@
+diff -up wordpress/wp-admin/includes/class-wp-upgrader.php.noupdate wordpress/wp-admin/includes/class-wp-upgrader.php
+--- wordpress/wp-admin/includes/class-wp-upgrader.php.noupdate	2015-04-03 02:18:27.000000000 +0200
++++ wordpress/wp-admin/includes/class-wp-upgrader.php	2015-04-24 10:33:31.166724612 +0200
+@@ -2142,6 +2142,9 @@ class Core_Upgrader extends WP_Upgrader
+ 			}
+ 		}
+ 
++		// RPM: nether allow core update
++		return false;
++
+ 		// 1: If we're already on that version, not much point in updating?
+ 		if ( $offered_ver == $wp_version )
+ 			return false;
+@@ -2373,7 +2376,7 @@ class WP_Automatic_Updater {
+ 	 */
+ 	public function is_disabled() {
+ 		// Background updates are disabled if you don't want file changes.
+-		if ( defined( 'DISALLOW_FILE_MODS' ) && DISALLOW_FILE_MODS )
++		if ( !defined( 'DISALLOW_FILE_MODS' ) || DISALLOW_FILE_MODS )
+ 			return true;
+ 
+ 		if ( defined( 'WP_INSTALLING' ) )
+diff -up wordpress/wp-admin/includes/update.php.noupdate wordpress/wp-admin/includes/update.php
+--- wordpress/wp-admin/includes/update.php.noupdate	2015-04-24 10:37:28.288734495 +0200
++++ wordpress/wp-admin/includes/update.php	2015-04-24 10:37:46.985814124 +0200
+@@ -211,8 +211,6 @@ function update_nag() {
+ 	}
+ 	echo "<div class='update-nag'>$msg</div>";
+ }
+-add_action( 'admin_notices', 'update_nag', 3 );
+-add_action( 'network_admin_notices', 'update_nag', 3 );
+ 
+ // Called directly from dashboard
+ function update_right_now_message() {
+@@ -227,7 +225,7 @@ function update_right_now_message() {
+ 		$cur = get_preferred_from_update_core();
+ 
+ 		if ( isset( $cur->response ) && $cur->response == 'upgrade' )
+-			$msg .= '<a href="' . network_admin_url( 'update-core.php' ) . '" class="button" aria-describedby="wp-version">' . sprintf( __( 'Update to %s' ), $cur->current ? $cur->current : __( 'Latest' ) ) . '</a> ';
++			$msg .= '';
+ 	}
+ 
+ 	$msg .= sprintf( '<span id="wp-version">' . __( 'WordPress %1$s running %2$s theme.' ) . '</span>', get_bloginfo( 'version', 'display' ), $theme_name );
+diff -up wordpress/wp-includes/capabilities.php.noupdate wordpress/wp-includes/capabilities.php
+--- wordpress/wp-includes/capabilities.php.noupdate	2015-04-20 09:27:27.000000000 +0200
++++ wordpress/wp-includes/capabilities.php	2015-04-24 10:33:31.167724617 +0200
+@@ -1281,7 +1281,7 @@ function map_meta_cap( $cap, $user_id )
+ 		// Disallow the file editors.
+ 		if ( defined( 'DISALLOW_FILE_EDIT' ) && DISALLOW_FILE_EDIT )
+ 			$caps[] = 'do_not_allow';
+-		elseif ( defined( 'DISALLOW_FILE_MODS' ) && DISALLOW_FILE_MODS )
++		elseif ( !defined( 'DISALLOW_FILE_MODS' ) || DISALLOW_FILE_MODS )
+ 			$caps[] = 'do_not_allow';
+ 		elseif ( is_multisite() && ! is_super_admin( $user_id ) )
+ 			$caps[] = 'do_not_allow';
+@@ -1299,7 +1299,7 @@ function map_meta_cap( $cap, $user_id )
+ 	case 'update_core':
+ 		// Disallow anything that creates, deletes, or updates core, plugin, or theme files.
+ 		// Files in uploads are excepted.
+-		if ( defined( 'DISALLOW_FILE_MODS' ) && DISALLOW_FILE_MODS ) {
++		if ( !defined( 'DISALLOW_FILE_MODS' ) || DISALLOW_FILE_MODS ) {
+ 			$caps[] = 'do_not_allow';
+ 		} elseif ( is_multisite() && ! is_super_admin( $user_id ) ) {
+ 			$caps[] = 'do_not_allow';
+diff -up wordpress/wp-includes/update.php.noupdate wordpress/wp-includes/update.php
+--- wordpress/wp-includes/update.php.noupdate	2015-03-18 23:07:28.000000000 +0100
++++ wordpress/wp-includes/update.php	2015-04-24 10:33:31.167724617 +0200
+@@ -624,9 +624,6 @@ function _maybe_update_themes() {
+  * @since 3.1.0
+  */
+ function wp_schedule_update_checks() {
+-	if ( !wp_next_scheduled('wp_version_check') && !defined('WP_INSTALLING') )
+-		wp_schedule_event(time(), 'twicedaily', 'wp_version_check');
+-
+ 	if ( !wp_next_scheduled('wp_update_plugins') && !defined('WP_INSTALLING') )
+ 		wp_schedule_event(time(), 'twicedaily', 'wp_update_plugins');
+ 
+@@ -668,8 +665,6 @@ if ( ( ! is_main_site() && ! is_network_
+ }
+ 
+ add_action( 'admin_init', '_maybe_update_core' );
+-add_action( 'wp_version_check', 'wp_version_check' );
+-add_action( 'upgrader_process_complete', 'wp_version_check', 10, 0 );
+ 
+ add_action( 'load-plugins.php', 'wp_update_plugins' );
+ add_action( 'load-update.php', 'wp_update_plugins' );

wordpress.spec

@@ -1,3 +1,4 @@
+%{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}-%{version}}
 %global wp_content %{_datadir}/wordpress/wp-content
 
 %if 0%{?rhel} == 5
@@ -5,11 +6,17 @@
 %else
 %global with_cacert 1
 %endif
+# https://bugzilla.redhat.com/1147817 php53-getid3 review
+%if 0%{?fedora} >= 17 || 0%{?rhel} >= 6
+%global with_getid3 1
+%else
+%global with_getid3 0
+%endif
 
 Summary:    Blog tool and publishing platform
 URL:        http://www.wordpress.org
 Name:       wordpress
-Version:    3.7
+Version:    4.2.2
 Group:      Applications/Publishing
 Release:    1%{?dist}
 License:    GPLv2
@@ -26,15 +33,26 @@ Patch0: wordpress-debian_patches_hello.patch
 # This patch doesn’t work well, see bugzilla.redhat.com/522897
 Patch1: wordpress-move-wp-content.patch
 # Drop swfupload: not built from source, not reasonably possible to do
-Patch2: wordpress-3.6-no_swfupload.patch
+Patch2: wordpress-4.2-no_swfupload.patch
 # Adjust tinymce's media plugin not to use its SWF plugin. This changes
 # 'p.getParam("flash_video_player_url",u.convertUrl(u.url+"/moxieplayer.swf"))'
 # to 'false'
-Patch3: wordpress-3.6-tinymce_noflash.patch
+Patch3: wordpress-4.0-tinymce_noflash.patch
 # Adjust mediaelement not to use its SWF and Silverlight plugins. This
 # changes 'plugins:["flash,"silverlight","youtube","vimeo"]' to
 # 'plugins:["youtube","vimeo"]'
-Patch4: wordpress-3.6-mediaelement-noflash_silverlight.patch
+Patch4: wordpress-4.2-mediaelement-noflash_silverlight.patch
+# RPM configuration:
+# Path to installation
+# Disable auto-updater
+Patch5: wordpress-4.0-config.patch
+# RPM are readonly
+# disable version check and updated
+# change DISALLOW_FILE_MODS default value to true
+# ignore WP_AUTO_UPDATE_CORE (always false)
+Patch6: wordpress-4.2-noupdate.patch
+# Use system libraries
+Patch7: wordpress-4.0-systemlibs.patch
 
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildArch: noarch
@@ -42,19 +60,26 @@ BuildArch: noarch
 %if 0%{?rhel} == 5
 Requires: php53 >= 5.2.4
 Requires: php53-simplepie >= 1.3.1
+%if %{with_getid3}
+Requires: php53-getid3
+%endif
 %else
 Requires: php >= 5.2.4
 Requires: php-simplepie >= 1.3.1
+%if %{with_getid3}
+Requires: php-getid3
 %endif
-# Required php extension (detected by phpcompatinfo)
+%endif
+# From phpcompatinfo report for version 3.8
 Requires: php-curl
 Requires: php-date
 Requires: php-dom
 Requires: php-enchant
-# not yet available for RHEL Requires: php-ereg
+Requires: php-ereg
 Requires: php-exif
 Requires: php-fileinfo
-# not yet available for RHEL Requires: php-filter
+Requires: php-ftp
+Requires: php-gd
 Requires: php-gettext
 Requires: php-hash
 Requires: php-iconv
@@ -64,18 +89,17 @@ Requires: php-mbstring
 Requires: php-mysql
 Requires: php-openssl
 Requires: php-pcre
-Requires: php-pdo
 Requires: php-posix
-Requires: php-reflection
 Requires: php-simplexml
 Requires: php-sockets
 Requires: php-spl
 Requires: php-tokenizer
+Requires: php-xml
 Requires: php-zip
 Requires: php-zlib
 # Unbundled libraries
 Requires: php-PHPMailer
-Requires: webserver
+Requires: httpd
 %if %{with_cacert}
 Requires: ca-certificates
 %endif
@@ -86,6 +110,9 @@ Obsoletes: wordpress-mu < 2.9.3
 Wordpress is an online publishing / weblog package that makes it very easy,
 almost trivial, to get information out to people on the web.
 
+Important information in %{_pkgdocdir}/README.fedora
+
+
 %prep
 %setup -q -n wordpress
 
@@ -102,43 +129,69 @@ almost trivial, to get information out to people on the web.
 # and draw a non-functional button. - AdamW, 2013/08
 # https://fedoraproject.org/wiki/Packaging:Guidelines#No_inclusion_of_pre-built_binaries_or_libraries
 
-rm -f wp-includes/js/mediaelement/silverlightmediaelement.xap
+rm wp-includes/js/mediaelement/silverlightmediaelement.xap
-rm -f wp-includes/js/mediaelement/flashmediaelement.sw
+rm wp-includes/js/mediaelement/flashmediaelement.swf
-rm -f wp-includes/js/tinymce/plugins/media/moxieplayer.swf
+rm wp-includes/js/tinymce/plugins/media/moxieplayer.swf
-rm -f wp-includes/js/plupload/plupload.silverlight.xap 
+rm wp-includes/js/plupload/plupload.silverlight.xap
-rm -f wp-includes/js/plupload/plupload.silverlight.js
+rm wp-includes/js/plupload/plupload.flash.swf
-rm -f wp-includes/js/plupload/plupload.flash.swf
-rm -f wp-includes/js/plupload/plupload.flash.js
 
 # swfupload can just die in its entirety
 rm -rf wp-includes/js/swfupload
 
+# remove .htaccess, protected by httpd config file
+rm wp-content/plugins/akismet/.htaccess
+
 %patch0 -p1 -b .dolly
-#%patch1 -p1 -b .rhbz522897
+#patch1 -p1 -b .rhbz522897
 %patch2 -p1
 %patch3 -p1
 %patch4 -p1
+%if %{with_getid3}
+%patch7 -p1
+%endif
+
+# We patch a .js file, used patched file instead of unpatch minified one
+ln -sf plugin.js wp-includes/js/tinymce/plugins/media/plugin.min.js
+
+# Re-Generated the archive
+arc=wp-includes/js/tinymce/wp-tinymce.js
+gunzip -dc $arc.gz | \
+  grep "^// Source" | \
+  while read a b c
+do
+  if [ -f $c ]; then
+    echo -e "\n$a $b $c"
+    cat $c
+  else
+    exit 1
+  fi
+done >$arc
+gzip --force $arc
+ls -l $arc.gz
+
+# Create RPM configuration
+cp wp-config-sample.php wp-config.php
+%patch5 -p1
+%patch6 -p1
 
-# disable wp_version_check, updates are always installed via rpm
-sed -i -e "s,\(.*\)'wp_version_check'\(.*\),#\1'wp_version_check'\2,g" \
-	wp-includes/update.php
-# disable update_nag() function
-sed -i -e "s,\(.*\)'update_nag'\(.*\),#\1'update_nag'\2,g; \
-	s,\(.*\)\$msg .=\(.*\),\1\$msg .= '';,g;" \
-	wp-admin/includes/update.php
 # fix file encoding
 sed -i -e 's/\r//' license.txt
 
+
 %build
 
 %install
-mkdir -p ${RPM_BUILD_ROOT}%{_datadir}/wordpress
+# Apache configuration
-mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/wordpress
 install -m 0644 -D -p %{SOURCE1} ${RPM_BUILD_ROOT}%{_sysconfdir}/httpd/conf.d/wordpress.conf
+
+# Application
+mkdir -p ${RPM_BUILD_ROOT}%{_datadir}/wordpress
 cp -pr * ${RPM_BUILD_ROOT}%{_datadir}/wordpress
-cat wp-config-sample.php | sed -e "s|dirname(__FILE__).'/'|'/usr/share/wordpress/'|g" > \
+
-	${RPM_BUILD_ROOT}%{_sysconfdir}/wordpress/wp-config.php
+# Configuration
+install -m 0644 -D wp-config.php ${RPM_BUILD_ROOT}%{_sysconfdir}/wordpress/wp-config.php
 /bin/ln -sf ../../../etc/wordpress/wp-config.php ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-config.php
+
 /bin/cp %{SOURCE2} ./README.fedora
 /bin/cp %{SOURCE3} ./README.fedora-multiuser
 
@@ -152,11 +205,11 @@ rm -f ${RPM_BUILD_ROOT}%{_datadir}/wordpress/{license.txt,readme.html}
 
 # Remove bundled php-simplepie and link to system copy
 rm    ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/class-simplepie.php
-rm -rf ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/SimplePie
+rm -r ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/SimplePie
 %if 0%{?rhel} == 5
-ln -sf /usr/share/php/php53-simplepie/autoloader.php \
+ln -s /usr/share/php/php53-simplepie/autoloader.php \
 %else
-ln -sf /usr/share/php/php-simplepie/autoloader.php \
+ln -s /usr/share/php/php-simplepie/autoloader.php \
 %endif
        ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/class-simplepie.php
 
@@ -168,6 +221,11 @@ for fic in phpmailer smtp; do
          ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/class-$fic.php
 done
 
+%if %{with_getid3}
+# Remove bundled php-getid3
+rm -r ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/ID3
+%endif
+
 # Remove bundled ca-bundle.crt
 %if %{with_cacert}
 rm ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/certificates/ca-bundle.crt
@@ -192,6 +250,7 @@ find ${RPM_BUILD_ROOT} \( -name \*.dolly -o -name \*.rhbz522897 -o -name \*.orig
 #/sbin/restorecon -R %{_localstatedir}/www/wordpress/
 #fi
 
+
 %clean
 rm -rf ${RPM_BUILD_ROOT}
 
@@ -210,16 +269,88 @@ rm -rf ${RPM_BUILD_ROOT}
 %dir %attr(0775,apache,ftp) %{wp_content}/uploads
 %{wp_content}/plugins/*
 %{wp_content}/themes/*
-%doc license.txt
+%{!?_licensedir:%global license %%doc}
+%license license.txt
 %doc readme.html
 %doc README.fedora
 %doc README.fedora-multiuser
 %{_datadir}/wordpress/wp-*.php
-%config(noreplace) %{_sysconfdir}/wordpress/wp-config.php
+%attr(750,root,apache) %dir               %{_sysconfdir}/wordpress
+%attr(640,root,apache) %config(noreplace) %{_sysconfdir}/wordpress/wp-config.php
 %{_datadir}/wordpress/xmlrpc.php
-%dir %{_sysconfdir}/wordpress
+
 
 %changelog
+* Thu May  7 2015 Remi Collet <remi@fedoraproject.org> - 4.2.2-1
+- WordPress 4.2.2 Security and Maintenance Release
+
+* Tue Apr 28 2015 Remi Collet <remi@fedoraproject.org> - 4.2.1-1
+- WordPress 4.2.1 Security Release
+- WordPress 4.2 “Powell”
+
+* Fri Apr 24 2015 Remi Collet <remi@fedoraproject.org> - 4.1.3-1
+- WordPress 4.1.3 Maintenance Release
+
+* Thu Apr 23 2015 Remi Collet <remi@fedoraproject.org> - 4.1.2-1
+- WordPress 4.1.2 Security Release
+
+* Thu Feb 19 2015 Remi Collet <remi@fedoraproject.org> - 4.1.1-1
+- WordPress 4.1.1 Maintenance Release
+
+* Mon Dec 22 2014 Remi Collet <remi@fedoraproject.org> - 4.1-1
+- WordPress 4.1 “Dinah”
+
+* Fri Nov 21 2014 Remi Collet <remi@fedoraproject.org> - 4.0.1-1
+- WordPress 4.0.1 Security Release
+- use system php-getid3 when available #1145574
+
+* Mon Sep  8 2014 Remi Collet <remi@fedoraproject.org> - 4.0-1
+- WordPress 4.0 “Benny”
+
+* Fri Aug  8 2014 Remi Collet <remi@fedoraproject.org> - 3.9.2-3
+- config dir only readable by apache group, better fix for #1124582
+- fix license handling
+
+* Thu Aug  7 2014 Remi Collet <remi@fedoraproject.org> - 3.9.2-2
+- update to 3.9.2 Security Release #1127547
+- config file only readable by apache user (httpd or php-fpm) #1124582
+
+* Fri May  9 2014 Remi Collet <remi@fedoraproject.org> - 3.9.1-1
+- update to 3.9.1 Maintenance Release
+
+* Wed May  7 2014 Remi Collet <remi@fedoraproject.org> - 3.9-1
+- update to 3.9 “Smith”
+
+* Tue Apr 15 2014 Remi Collet <remi@fedoraproject.org> - 3.8.3-1
+- update to 3.8.3 Maintenance Release
+  http://wordpress.org/news/2014/04/wordpress-3-8-3/
+
+* Wed Apr  9 2014 Remi Collet <remi@fedoraproject.org> - 3.8.2-1
+- update to 3.8.2 Security Release
+- fix privilege escalation issue  CVE-2014-0165
+- fix authentication bypass issue CVE-2014-0166
+
+* Sat Jan 25 2014 Remi Collet <remi@fedoraproject.org> - 3.8.1-3
+- ignore WP_AUTO_UPDATE_CORE (always false)
+
+* Fri Jan 24 2014 Remi Collet <remi@fedoraproject.org> - 3.8.1-2
+- comment provided configuration about auto-updater
+- disable auto-updater on default configuration #1057521
+- switch some sed to patch (more robust)
+
+* Thu Jan 23 2014 Adam Williamson <awilliam@redhat.com> - 3.8.1-1
+- new upstream release 3.8.1 (bugfixes)
+
+* Mon Dec 16 2013 Remi Collet <rcollet@redhat.com> - 3.8-1
+- update to 3.8 “Parker” #1043104
+- link to README.fedora in package description
+- add note about optional packages #1037516
+- add php dependencies: ereg, ftp, gd, xml
+- del php dependencies: pdo, reflection
+
+* Wed Oct 30 2013 Remi Collet <rcollet@redhat.com> - 3.7.1-1
+- update to 3.7.1 (bugfixes)
+
 * Fri Oct 25 2013 Remi Collet <rcollet@redhat.com> - 3.7-1
 - update to 3.7
 - requires ca-certificates for ca-bundle.crt