WordPress 4.5.3 Maintenance and Security Release

(cherry picked from commit 9abc1b7ba9)

.gitignore

@@ -17,3 +17,15 @@ clog
 /wordpress-4.2.tar.gz
 /wordpress-4.2.1.tar.gz
 /wordpress-4.2.2.tar.gz
+/wordpress-4.2.3.tar.gz
+/wordpress-4.2.4.tar.gz
+/wordpress-4.3.tar.gz
+/wordpress-4.3.1.tar.gz
+/wordpress-4.4.tar.gz
+/wordpress-4.4.1.tar.gz
+/wordpress-4.4.2.tar.gz
+/wordpress-4.5-RC1.tar.gz
+/wordpress-4.5.tar.gz
+/wordpress-4.5.1.tar.gz
+/wordpress-4.5.2.tar.gz
+/wordpress-4.5.3.tar.gz

sources

@@ -1 +1 @@
-c40d56cf85975482d5f5fa8c4b97d1d2  wordpress-4.2.2.tar.gz
+6cd70fcceb7050bfe22fc03e801e0305  wordpress-4.5.3.tar.gz

wordpress-4.0-config.patch

@@ -1,7 +1,7 @@
 diff -up wordpress/wp-config.php.orig wordpress/wp-config.php
 --- wordpress/wp-config.php.orig	2014-09-08 13:12:36.525908423 +0200
 +++ wordpress/wp-config.php	2014-09-08 13:14:33.583402525 +0200
-@@ -62,6 +62,19 @@ define('NONCE_SALT',       'put your uni
+@@ -66,6 +66,19 @@ define('NONCE_SALT',       'put your uni
  $table_prefix  = 'wp_';
  
  /**
@@ -21,7 +21,7 @@ diff -up wordpress/wp-config.php.orig wordpress/wp-config.php
   * For developers: WordPress debugging mode.
   *
   * Change this to true to enable the display of notices during development.
-@@ -74,7 +87,7 @@ define('WP_DEBUG', false);
+@@ -83,7 +96,7 @@ define('WP_DEBUG', false);
  
  /** Absolute path to the WordPress directory. */
  if ( !defined('ABSPATH') )

wordpress-4.0-systemlibs.patch

@@ -1,21 +0,0 @@
-diff -up wordpress/wp-admin/includes/media.php.old wordpress/wp-admin/includes/media.php
---- wordpress/wp-admin/includes/media.php.old	2014-09-30 08:54:21.666519693 +0200
-+++ wordpress/wp-admin/includes/media.php	2014-09-30 08:55:11.247757421 +0200
-@@ -2907,7 +2907,7 @@ function wp_read_video_metadata( $file )
- 	$metadata = array();
- 
- 	if ( ! class_exists( 'getID3' ) )
--		require( ABSPATH . WPINC . '/ID3/getid3.php' );
-+		require( '/usr/share/php/getid3/getid3.php' );
- 	$id3 = new getID3();
- 	$data = $id3->analyze( $file );
- 
-@@ -2962,7 +2962,7 @@ function wp_read_audio_metadata( $file )
- 	$metadata = array();
- 
- 	if ( ! class_exists( 'getID3' ) )
--		require( ABSPATH . WPINC . '/ID3/getid3.php' );
-+		require( '/usr/share/php/getid3/getid3.php' );
- 	$id3 = new getID3();
- 	$data = $id3->analyze( $file );
- 

wordpress-4.0-tinymce_noflash.patch

@@ -1,7 +1,7 @@
 diff -up wordpress/wp-includes/js/tinymce/plugins/media/plugin.js.rpm wordpress/wp-includes/js/tinymce/plugins/media/plugin.js
 --- wordpress/wp-includes/js/tinymce/plugins/media/plugin.js.rpm	2014-08-22 01:53:18.000000000 +0200
 +++ wordpress/wp-includes/js/tinymce/plugins/media/plugin.js	2014-09-08 13:10:15.717314458 +0200
-@@ -44,10 +44,6 @@ tinymce.PluginManager.add('media', funct
+@@ -46,10 +46,6 @@ tinymce.PluginManager.add('media', funct
  			return 'video/ogg';
  		}
  
@@ -12,7 +12,7 @@ diff -up wordpress/wp-includes/js/tinymce/plugins/media/plugin.js.rpm wordpress/
  		return '';
  	}
  
-@@ -239,7 +235,7 @@ tinymce.PluginManager.add('media', funct
+@@ -247,7 +243,7 @@ tinymce.PluginManager.add('media', funct
  		data.source1mime = guessMime(data.source1);
  		data.source2mime = guessMime(data.source2);
  		data.poster = editor.convertURL(data.poster, "poster");

wordpress-4.2-noupdate.patch

@@ -1,86 +0,0 @@
-diff -up wordpress/wp-admin/includes/class-wp-upgrader.php.noupdate wordpress/wp-admin/includes/class-wp-upgrader.php
---- wordpress/wp-admin/includes/class-wp-upgrader.php.noupdate	2015-04-03 02:18:27.000000000 +0200
-+++ wordpress/wp-admin/includes/class-wp-upgrader.php	2015-04-24 10:33:31.166724612 +0200
-@@ -2142,6 +2142,9 @@ class Core_Upgrader extends WP_Upgrader
- 			}
- 		}
- 
-+		// RPM: nether allow core update
-+		return false;
-+
- 		// 1: If we're already on that version, not much point in updating?
- 		if ( $offered_ver == $wp_version )
- 			return false;
-@@ -2373,7 +2376,7 @@ class WP_Automatic_Updater {
- 	 */
- 	public function is_disabled() {
- 		// Background updates are disabled if you don't want file changes.
--		if ( defined( 'DISALLOW_FILE_MODS' ) && DISALLOW_FILE_MODS )
-+		if ( !defined( 'DISALLOW_FILE_MODS' ) || DISALLOW_FILE_MODS )
- 			return true;
- 
- 		if ( defined( 'WP_INSTALLING' ) )
-diff -up wordpress/wp-admin/includes/update.php.noupdate wordpress/wp-admin/includes/update.php
---- wordpress/wp-admin/includes/update.php.noupdate	2015-04-24 10:37:28.288734495 +0200
-+++ wordpress/wp-admin/includes/update.php	2015-04-24 10:37:46.985814124 +0200
-@@ -211,8 +211,6 @@ function update_nag() {
- 	}
- 	echo "<div class='update-nag'>$msg</div>";
- }
--add_action( 'admin_notices', 'update_nag', 3 );
--add_action( 'network_admin_notices', 'update_nag', 3 );
- 
- // Called directly from dashboard
- function update_right_now_message() {
-@@ -227,7 +225,7 @@ function update_right_now_message() {
- 		$cur = get_preferred_from_update_core();
- 
- 		if ( isset( $cur->response ) && $cur->response == 'upgrade' )
--			$msg .= '<a href="' . network_admin_url( 'update-core.php' ) . '" class="button" aria-describedby="wp-version">' . sprintf( __( 'Update to %s' ), $cur->current ? $cur->current : __( 'Latest' ) ) . '</a> ';
-+			$msg .= '';
- 	}
- 
- 	$msg .= sprintf( '<span id="wp-version">' . __( 'WordPress %1$s running %2$s theme.' ) . '</span>', get_bloginfo( 'version', 'display' ), $theme_name );
-diff -up wordpress/wp-includes/capabilities.php.noupdate wordpress/wp-includes/capabilities.php
---- wordpress/wp-includes/capabilities.php.noupdate	2015-04-20 09:27:27.000000000 +0200
-+++ wordpress/wp-includes/capabilities.php	2015-04-24 10:33:31.167724617 +0200
-@@ -1281,7 +1281,7 @@ function map_meta_cap( $cap, $user_id )
- 		// Disallow the file editors.
- 		if ( defined( 'DISALLOW_FILE_EDIT' ) && DISALLOW_FILE_EDIT )
- 			$caps[] = 'do_not_allow';
--		elseif ( defined( 'DISALLOW_FILE_MODS' ) && DISALLOW_FILE_MODS )
-+		elseif ( !defined( 'DISALLOW_FILE_MODS' ) || DISALLOW_FILE_MODS )
- 			$caps[] = 'do_not_allow';
- 		elseif ( is_multisite() && ! is_super_admin( $user_id ) )
- 			$caps[] = 'do_not_allow';
-@@ -1299,7 +1299,7 @@ function map_meta_cap( $cap, $user_id )
- 	case 'update_core':
- 		// Disallow anything that creates, deletes, or updates core, plugin, or theme files.
- 		// Files in uploads are excepted.
--		if ( defined( 'DISALLOW_FILE_MODS' ) && DISALLOW_FILE_MODS ) {
-+		if ( !defined( 'DISALLOW_FILE_MODS' ) || DISALLOW_FILE_MODS ) {
- 			$caps[] = 'do_not_allow';
- 		} elseif ( is_multisite() && ! is_super_admin( $user_id ) ) {
- 			$caps[] = 'do_not_allow';
-diff -up wordpress/wp-includes/update.php.noupdate wordpress/wp-includes/update.php
---- wordpress/wp-includes/update.php.noupdate	2015-03-18 23:07:28.000000000 +0100
-+++ wordpress/wp-includes/update.php	2015-04-24 10:33:31.167724617 +0200
-@@ -624,9 +624,6 @@ function _maybe_update_themes() {
-  * @since 3.1.0
-  */
- function wp_schedule_update_checks() {
--	if ( !wp_next_scheduled('wp_version_check') && !defined('WP_INSTALLING') )
--		wp_schedule_event(time(), 'twicedaily', 'wp_version_check');
--
- 	if ( !wp_next_scheduled('wp_update_plugins') && !defined('WP_INSTALLING') )
- 		wp_schedule_event(time(), 'twicedaily', 'wp_update_plugins');
- 
-@@ -668,8 +665,6 @@ if ( ( ! is_main_site() && ! is_network_
- }
- 
- add_action( 'admin_init', '_maybe_update_core' );
--add_action( 'wp_version_check', 'wp_version_check' );
--add_action( 'upgrader_process_complete', 'wp_version_check', 10, 0 );
- 
- add_action( 'load-plugins.php', 'wp_update_plugins' );
- add_action( 'load-update.php', 'wp_update_plugins' );

wordpress-4.4-no_swfupload.patch

@@ -1,7 +1,6 @@
-diff -up wordpress/wp-includes/script-loader.php.orig wordpress/wp-includes/script-loader.php
---- wordpress/wp-includes/script-loader.php.orig	2014-05-07 15:55:26.485228222 +0200
-+++ wordpress/wp-includes/script-loader.php	2014-05-07 15:55:18.019198073 +0200
-@@ -280,15 +280,6 @@
+--- wordpress/wp-includes/script-loader.php.orig	2015-12-09 16:51:44.740328793 +0100
++++ wordpress/wp-includes/script-loader.php	2015-12-09 16:53:00.870701835 +0100
+@@ -300,15 +300,6 @@ function wp_default_scripts( &$scripts )
  	$scripts->add( 'wp-plupload', "/wp-includes/js/plupload/wp-plupload$suffix.js", array( 'plupload', 'jquery', 'json2', 'media-models' ), false, 1 );
  	did_action( 'init' ) && $scripts->localize( 'wp-plupload', 'pluploadL10n', $uploader_l10n );
  
@@ -16,4 +15,4 @@ diff -up wordpress/wp-includes/script-loader.php.orig wordpress/wp-includes/scri
 -
  	$scripts->add( 'comment-reply', "/wp-includes/js/comment-reply$suffix.js", array(), false, 1 );
  
- 	$scripts->add( 'json2', "/wp-includes/js/json2$suffix.js", array(), '2011-02-23' );
+ 	$scripts->add( 'json2', "/wp-includes/js/json2$suffix.js", array(), '2015-05-03' );

wordpress-4.4-systemlibs.patch

@@ -0,0 +1,20 @@
+--- wordpress/wp-admin/includes/media.php.orig	2015-12-09 17:01:52.453306607 +0100
++++ wordpress/wp-admin/includes/media.php	2015-12-09 17:05:31.477379833 +0100
+@@ -2989,7 +2989,7 @@ function wp_read_video_metadata( $file )
+ 	}
+ 
+ 	if ( ! class_exists( 'getID3', false ) ) {
+-		require( ABSPATH . WPINC . '/ID3/getid3.php' );
++		require( '/usr/share/php/getid3/getid3.php' );
+ 	}
+ 	$id3 = new getID3();
+ 	$data = $id3->analyze( $file );
+@@ -3050,7 +3050,7 @@ function wp_read_audio_metadata( $file )
+ 	}
+ 
+ 	if ( ! class_exists( 'getID3', false ) ) {
+-		require( ABSPATH . WPINC . '/ID3/getid3.php' );
++		require( '/usr/share/php/getid3/getid3.php' );
+ 	}
+ 	$id3 = new getID3();
+ 	$data = $id3->analyze( $file );

wordpress-4.5-noupdate.patch

@@ -0,0 +1,108 @@
+diff -up wordpress/wp-admin/includes/admin-filters.php.orig wordpress/wp-admin/includes/admin-filters.php
+--- wordpress/wp-admin/includes/admin-filters.php.orig	2015-10-15 00:35:24.000000000 +0200
++++ wordpress/wp-admin/includes/admin-filters.php	2015-12-09 17:08:00.945112230 +0100
+@@ -100,7 +100,6 @@ add_action( 'profile_update', 'default_p
+ add_action( 'admin_init', 'wp_plugin_update_rows' );
+ add_action( 'admin_init', 'wp_theme_update_rows'  );
+ 
+-add_action( 'admin_notices', 'update_nag',      3  );
+ add_action( 'admin_notices', 'maintenance_nag', 10 );
+ 
+ add_filter( 'update_footer', 'core_update_footer' );
+diff -up wordpress/wp-admin/includes/class-wp-upgrader.php.orig wordpress/wp-admin/includes/class-wp-upgrader.php
+--- wordpress/wp-admin/includes/class-wp-upgrader.php.orig	2015-11-16 03:47:25.000000000 +0100
++++ wordpress/wp-admin/includes/class-wp-upgrader.php	2015-12-09 17:09:34.735571806 +0100
+@@ -2465,6 +2465,9 @@ class Core_Upgrader extends WP_Upgrader
+ 			}
+ 		}
+ 
++		// RPM: nether allow core update
++		return false;
++
+ 		// 1: If we're already on that version, not much point in updating?
+ 		if ( $offered_ver == $wp_version )
+ 			return false;
+@@ -2706,7 +2709,7 @@ class WP_Automatic_Updater {
+ 	 */
+ 	public function is_disabled() {
+ 		// Background updates are disabled if you don't want file changes.
+-		if ( defined( 'DISALLOW_FILE_MODS' ) && DISALLOW_FILE_MODS )
++		if ( !defined( 'DISALLOW_FILE_MODS' ) || DISALLOW_FILE_MODS )
+ 			return true;
+ 
+ 		if ( wp_installing() )
+diff -up wordpress/wp-admin/includes/update.php.orig wordpress/wp-admin/includes/update.php
+--- wordpress/wp-admin/includes/update.php.orig	2015-12-09 17:08:00.946112235 +0100
++++ wordpress/wp-admin/includes/update.php	2015-12-09 17:10:27.642831054 +0100
+@@ -251,7 +251,7 @@ function update_right_now_message() {
+ 		$cur = get_preferred_from_update_core();
+ 
+ 		if ( isset( $cur->response ) && $cur->response == 'upgrade' )
+-			$msg .= '<a href="' . network_admin_url( 'update-core.php' ) . '" class="button" aria-describedby="wp-version">' . sprintf( __( 'Update to %s' ), $cur->current ? $cur->current : __( 'Latest' ) ) . '</a> ';
++			$msg .= '';
+ 	}
+ 
+ 	/* translators: 1: version number, 2: theme name */
+diff -up wordpress/wp-includes/capabilities.php.orig wordpress/wp-includes/capabilities.php
+--- wordpress/wp-includes/capabilities.php.orig	2015-11-29 03:27:18.000000000 +0100
++++ wordpress/wp-includes/capabilities.php	2015-12-09 17:08:00.946112235 +0100
+@@ -310,7 +310,7 @@ function map_meta_cap( $cap, $user_id )
+ 		// Disallow the file editors.
+ 		if ( defined( 'DISALLOW_FILE_EDIT' ) && DISALLOW_FILE_EDIT )
+ 			$caps[] = 'do_not_allow';
+-		elseif ( defined( 'DISALLOW_FILE_MODS' ) && DISALLOW_FILE_MODS )
++		elseif ( !defined( 'DISALLOW_FILE_MODS' ) || DISALLOW_FILE_MODS )
+ 			$caps[] = 'do_not_allow';
+ 		elseif ( is_multisite() && ! is_super_admin( $user_id ) )
+ 			$caps[] = 'do_not_allow';
+@@ -328,7 +328,7 @@ function map_meta_cap( $cap, $user_id )
+ 	case 'update_core':
+ 		// Disallow anything that creates, deletes, or updates core, plugin, or theme files.
+ 		// Files in uploads are excepted.
+-		if ( defined( 'DISALLOW_FILE_MODS' ) && DISALLOW_FILE_MODS ) {
++		if ( !defined( 'DISALLOW_FILE_MODS' ) || DISALLOW_FILE_MODS ) {
+ 			$caps[] = 'do_not_allow';
+ 		} elseif ( is_multisite() && ! is_super_admin( $user_id ) ) {
+ 			$caps[] = 'do_not_allow';
+diff -up wordpress/wp-includes/update.php.orig wordpress/wp-includes/update.php
+--- wordpress/wp-includes/update.php.orig	2015-12-06 16:44:27.000000000 +0100
++++ wordpress/wp-includes/update.php	2015-12-09 17:12:09.038327895 +0100
+@@ -653,9 +653,6 @@ function _maybe_update_themes() {
+  * @since 3.1.0
+  */
+ function wp_schedule_update_checks() {
+-	if ( ! wp_next_scheduled( 'wp_version_check' ) && ! wp_installing() )
+-		wp_schedule_event(time(), 'twicedaily', 'wp_version_check');
+-
+ 	if ( ! wp_next_scheduled( 'wp_update_plugins' ) && ! wp_installing() )
+ 		wp_schedule_event(time(), 'twicedaily', 'wp_update_plugins');
+ 
+@@ -683,8 +680,6 @@ if ( ( ! is_main_site() && ! is_network_
+ }
+ 
+ add_action( 'admin_init', '_maybe_update_core' );
+-add_action( 'wp_version_check', 'wp_version_check' );
+-add_action( 'upgrader_process_complete', 'wp_version_check', 10, 0 );
+ 
+ add_action( 'load-plugins.php', 'wp_update_plugins' );
+ add_action( 'load-update.php', 'wp_update_plugins' );
+--- wordpress/wp-admin/includes/translation-install.php.orig	2016-03-25 14:48:58.616147092 +0100
++++ wordpress/wp-admin/includes/translation-install.php	2016-03-25 14:50:43.841612441 +0100
+@@ -181,7 +181,7 @@ function wp_download_language_pack( $dow
+ 		return $download;
+ 	}
+ 
+-	if ( defined( 'DISALLOW_FILE_MODS' ) && DISALLOW_FILE_MODS ) {
++	if ( !defined( 'DISALLOW_FILE_MODS' ) || DISALLOW_FILE_MODS ) {
+ 		return false;
+ 	}
+ 
+@@ -224,7 +224,7 @@ function wp_download_language_pack( $dow
+  * @return bool Returns true on success, false on failure.
+  */
+ function wp_can_install_language_pack() {
+-	if ( defined( 'DISALLOW_FILE_MODS' ) && DISALLOW_FILE_MODS ) {
++	if ( !defined( 'DISALLOW_FILE_MODS' ) || DISALLOW_FILE_MODS ) {
+ 		return false;
+ 	}
+ 

wordpress-httpd-conf

@@ -1,5 +1,8 @@
 Alias /wordpress /usr/share/wordpress
 
+# Access is only allowed via local access
+# Change this once configured
+
 <Directory /usr/share/wordpress>
   AllowOverride Options
   <IfModule mod_authz_core.c>
@@ -15,7 +18,16 @@ Alias /wordpress /usr/share/wordpress
  </IfModule>
 </Directory>
 
+<Directory /usr/share/wordpress/wp-content/uploads>
+  # Deny access to any php file in the uploads directory
+  <FilesMatch "\.(php)$">
+    Order Deny,Allow
+    Deny from all
+  </FilesMatch>
+</Directory>
+
 <Directory /usr/share/wordpress/wp-content/plugins/akismet>
+  # Deny access to any php file in the akismet directory
   <FilesMatch "\.(php|txt)$">
     Order Deny,Allow
     Deny from all

wordpress-nginx-conf

@@ -0,0 +1,35 @@
+# Wordpress
+
+location = /wordpress {
+    alias /usr/share/wordpress/;
+}
+
+location /wordpress/ {
+    root /usr/share;
+    index index.php;
+
+    location ~ ^/wordpress/wp-content/uploads/(.+)\.php$ {
+        # Deny access to any php file in the uploads directory
+        deny all;
+    }
+    location ~ ^/wordpress/wp-content/plugins/akismet/(.+)\.php$ {
+        # Deny access to any php file in the akismet directory
+        deny all;
+    }
+
+    # Access is only allowed via local access
+    # Change this once configured
+    location ~ ^/wordpress/(.+\.php)$ {
+        allow 127.0.0.1;
+        allow ::1;
+        deny all;
+
+        try_files $uri =404;
+        fastcgi_intercept_errors on;
+        include        fastcgi_params;
+        fastcgi_param  SERVER_NAME      $host;
+        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
+        fastcgi_pass   php-fpm;
+    }
+}
+

wordpress.spec

@@ -1,30 +1,40 @@
+# Fedora spec file for wordpress
+#
+# License: MIT
+# http://opensource.org/licenses/MIT
+#
+# Please preserve changelog entries
+#
 %{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}-%{version}}
 %global wp_content %{_datadir}/wordpress/wp-content
 
-%if 0%{?rhel} == 5
-%global with_cacert 0
+%if 0%{?fedora} >= 21
+%global with_nginx 1
 %else
-%global with_cacert 1
+%global with_nginx 0
 %endif
+
 # https://bugzilla.redhat.com/1147817 php53-getid3 review
 %if 0%{?fedora} >= 17 || 0%{?rhel} >= 6
 %global with_getid3 1
 %else
 %global with_getid3 0
 %endif
+#global prever RC1
 
 Summary:    Blog tool and publishing platform
 URL:        http://www.wordpress.org
 Name:       wordpress
-Version:    4.2.2
+Version:    4.5.3
 Group:      Applications/Publishing
 Release:    1%{?dist}
 License:    GPLv2
 
-Source0:    http://wordpress.org/%{name}-%{version}.tar.gz
+Source0:    http://wordpress.org/%{name}-%{version}%{?prever:-%{prever}}.tar.gz
 Source1:    wordpress-httpd-conf
 Source2:    README.fedora.wordpress
 Source3:    README.fedora.wordpress-mu
+Source4:    wordpress-nginx-conf
 
 # Patch out copyrighted text of Hello, Dolly
 # (and replace it with Free Software Song)
@@ -33,15 +43,11 @@ Patch0: wordpress-debian_patches_hello.patch
 # This patch doesn’t work well, see bugzilla.redhat.com/522897
 Patch1: wordpress-move-wp-content.patch
 # Drop swfupload: not built from source, not reasonably possible to do
-Patch2: wordpress-4.2-no_swfupload.patch
+Patch2: wordpress-4.4-no_swfupload.patch
 # Adjust tinymce's media plugin not to use its SWF plugin. This changes
 # 'p.getParam("flash_video_player_url",u.convertUrl(u.url+"/moxieplayer.swf"))'
 # to 'false'
 Patch3: wordpress-4.0-tinymce_noflash.patch
-# Adjust mediaelement not to use its SWF and Silverlight plugins. This
-# changes 'plugins:["flash,"silverlight","youtube","vimeo"]' to
-# 'plugins:["youtube","vimeo"]'
-Patch4: wordpress-4.2-mediaelement-noflash_silverlight.patch
 # RPM configuration:
 # Path to installation
 # Disable auto-updater
@@ -50,9 +56,9 @@ Patch5: wordpress-4.0-config.patch
 # disable version check and updated
 # change DISALLOW_FILE_MODS default value to true
 # ignore WP_AUTO_UPDATE_CORE (always false)
-Patch6: wordpress-4.2-noupdate.patch
+Patch6: wordpress-4.5-noupdate.patch
 # Use system libraries
-Patch7: wordpress-4.0-systemlibs.patch
+Patch7: wordpress-4.4-systemlibs.patch
 
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildArch: noarch
@@ -64,7 +70,16 @@ Requires: php53-simplepie >= 1.3.1
 Requires: php53-getid3
 %endif
 %else
+%if %{with_nginx}
+Requires: webserver
+Requires: php(httpd)
+Suggests: httpd
+# For directory ownership
+Requires: httpd-filesystem
+Requires: nginx-filesystem
+%else
 Requires: php >= 5.2.4
+%endif
 Requires: php-simplepie >= 1.3.1
 %if %{with_getid3}
 Requires: php-getid3
@@ -100,9 +115,8 @@ Requires: php-zlib
 # Unbundled libraries
 Requires: php-PHPMailer
 Requires: httpd
-%if %{with_cacert}
-Requires: ca-certificates
-%endif
+# ca-certificates (excepted on EL-5)
+Requires: %{_sysconfdir}/pki/tls/certs/ca-bundle.crt
 Provides: wordpress-mu = %{version}-%{release}
 Obsoletes: wordpress-mu < 2.9.3
 
@@ -145,7 +159,10 @@ rm wp-content/plugins/akismet/.htaccess
 #patch1 -p1 -b .rhbz522897
 %patch2 -p1
 %patch3 -p1
-%patch4 -p1
+# Adjust mediaelement not to use its SWF and Silverlight plugins. This
+# changes 'plugins:["flash,"silverlight","youtube","vimeo"]' to
+# 'plugins:["youtube","vimeo"]'
+sed -s 's/"flash","silverlight",//' -i wp-includes/js/mediaelement/mediaelement-and-player.min.js
 %if %{with_getid3}
 %patch7 -p1
 %endif
@@ -170,7 +187,7 @@ gzip --force $arc
 ls -l $arc.gz
 
 # Create RPM configuration
-cp wp-config-sample.php wp-config.php
+sed -e 's/\r//' wp-config-sample.php >wp-config.php
 %patch5 -p1
 %patch6 -p1
 
@@ -184,6 +201,10 @@ sed -i -e 's/\r//' license.txt
 # Apache configuration
 install -m 0644 -D -p %{SOURCE1} ${RPM_BUILD_ROOT}%{_sysconfdir}/httpd/conf.d/wordpress.conf
 
+%if %{with_nginx}
+install -m 0644 -D -p %{SOURCE4} ${RPM_BUILD_ROOT}%{_sysconfdir}/nginx/default.d/wordpress.conf
+%endif
+
 # Application
 mkdir -p ${RPM_BUILD_ROOT}%{_datadir}/wordpress
 cp -pr * ${RPM_BUILD_ROOT}%{_datadir}/wordpress
@@ -227,11 +248,9 @@ rm -r ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/ID3
 %endif
 
 # Remove bundled ca-bundle.crt
-%if %{with_cacert}
 rm ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/certificates/ca-bundle.crt
-ln -s /etc/pki/tls/certs/ca-bundle.crt \
+ln -s %{_sysconfdir}/pki/tls/certs/ca-bundle.crt \
    ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/certificates/ca-bundle.crt
-%endif
 
 # Remove backup copies of patches
 find ${RPM_BUILD_ROOT} \( -name \*.dolly -o -name \*.rhbz522897 -o -name \*.orig \) \
@@ -257,6 +276,9 @@ rm -rf ${RPM_BUILD_ROOT}
 %files
 %defattr(-,root,root,-)
 %config(noreplace) %{_sysconfdir}/httpd/conf.d/wordpress.conf
+%if %{with_nginx}
+%config(noreplace) %{_sysconfdir}/nginx/default.d/wordpress.conf
+%endif
 %dir %{_datadir}/wordpress
 %{_datadir}/wordpress/wp-admin
 %{_datadir}/wordpress/wp-includes
@@ -281,6 +303,43 @@ rm -rf ${RPM_BUILD_ROOT}
 
 
 %changelog
+* Wed Jun 22 2016 Remi Collet <remi@fedoraproject.org> - 4.5.3-1
+- WordPress 4.5.3 Maintenance and Security Release
+- never bundle ca-bundle.crt (EL-5)
+- provide nginx configuration (fedora)
+- drop mandatory dependency on httpd (suggested) #1336091
+- protect php files in uploads directory
+
+* Tue May 10 2016 Remi Collet <remi@fedoraproject.org> - 4.5.2-1
+- WordPress 4.5.2 Security Release
+
+* Wed Apr 27 2016 Remi Collet <remi@fedoraproject.org> - 4.5.1-1
+- WordPress 4.5.1 Maintenance Release
+
+* Wed Apr 13 2016 Remi Collet <remi@fedoraproject.org> - 4.5-1
+- WordPress 4.5 “Coleman”
+
+* Wed Feb  3 2016 Remi Collet <remi@fedoraproject.org> - 4.4.2-1
+- WordPress 4.4.2 Security and Maintenance Release
+
+* Thu Jan  7 2016 Remi Collet <remi@fedoraproject.org> - 4.4.1-1
+- WordPress 4.4.1 Security and Maintenance Release
+
+* Wed Dec  9 2015 Remi Collet <remi@fedoraproject.org> - 4.4-1
+- WordPress 4.4 “Clifford”
+
+* Wed Sep 16 2015 Remi Collet <remi@fedoraproject.org> - 4.3.1-1
+- WordPress 4.3.1 Security and Maintenance Release
+
+* Wed Aug 26 2015 Remi Collet <remi@fedoraproject.org> - 4.3-1
+- WordPress 4.3 “Billie”
+
+* Tue Aug  4 2015 Remi Collet <remi@fedoraproject.org> - 4.2.4-1
+- WordPress 4.2.4 Security and Maintenance Release
+
+* Fri Jul 24 2015 Remi Collet <remi@fedoraproject.org> - 4.2.3-1
+- WordPress 4.2.3 Security and Maintenance Release
+
 * Thu May  7 2015 Remi Collet <remi@fedoraproject.org> - 4.2.2-1
 - WordPress 4.2.2 Security and Maintenance Release