Update to 4.8.3. Security release. Fixes bug #1508255

(cherry picked from commit 2dc3758a31)

.gitignore

@@ -37,3 +37,8 @@ clog
 /wordpress-4.7.2.tar.gz
 /wordpress-4.7.3.tar.gz
 /wordpress-4.7.4.tar.gz
+/wordpress-4.7.5.tar.gz
+/wordpress-4.8.tar.gz
+/wordpress-4.8.1.tar.gz
+/wordpress-4.8.2.tar.gz
+/wordpress-4.8.3.tar.gz

sources

@@ -1 +1 @@
-SHA512 (wordpress-4.7.4.tar.gz) = 9d1b7fa2688e80d8e8409bd9f7fa61007b266de70a11eaa592fc737c501906e9c14b20eab63542077acb8dd65f5491f481b0945f5ed9e98d8b5207a47c3ec950
+SHA512 (wordpress-4.8.3.tar.gz) = 696be1c24dec869d896e22b408b17009e8c482545237156f17d4b5f2d726876a17c3cc5c3de632126229747589d74f7b188c06d2a79878efc800bd6db273d709

wordpress-4.0-tinymce_noflash.patch

@@ -1,30 +0,0 @@
-diff -Nur wordpress.orig/wp-includes/js/tinymce/plugins/media/plugin.js wordpress/wp-includes/js/tinymce/plugins/media/plugin.js
---- wordpress.orig/wp-includes/js/tinymce/plugins/media/plugin.js	2017-04-12 19:52:38.000000000 -0600
-+++ wordpress/wp-includes/js/tinymce/plugins/media/plugin.js	2017-04-22 11:28:42.415026834 -0600
-@@ -438,7 +438,6 @@
- 			'mp4': 'video/mp4',
- 			'webm': 'video/webm',
- 			'ogg': 'video/ogg',
--			'swf': 'application/x-shockwave-flash'
- 		};
- 		var fileEnd = url.toLowerCase().split('.').pop();
- 		var mime = mimes[fileEnd];
-@@ -583,18 +582,6 @@
- 					'" width="' + data.width +
- 					'" height="' + data.height +
- 					'"' + allowFullscreen + '></iframe>';
--			} else if (data.source1mime === "application/x-shockwave-flash") {
--				html +=
--					'<object data="' + data.source1 +
--					'" width="' + data.width +
--					'" height="' + data.height +
--					'" type="application/x-shockwave-flash">';
--
--				if (data.poster) {
--					html += '<img src="' + data.poster + '" width="' + data.width + '" height="' + data.height + '" />';
--				}
--
--				html += '</object>';
- 			} else if (data.source1mime.indexOf('audio') !== -1) {
- 				if (editor.settings.audio_template_callback) {
- 					html = editor.settings.audio_template_callback(data);

wordpress-4.6-noupdate.patch

@@ -1,103 +0,0 @@
-diff -up wordpress/wp-admin/includes/admin-filters.php.rpm wordpress/wp-admin/includes/admin-filters.php
---- wordpress/wp-admin/includes/admin-filters.php.rpm	2016-09-03 07:50:51.812312381 +0200
-+++ wordpress/wp-admin/includes/admin-filters.php	2016-09-03 07:51:39.070577518 +0200
-@@ -106,7 +106,6 @@ add_action( 'profile_update', 'default_p
- add_action( 'load-plugins.php', 'wp_plugin_update_rows', 20 ); // After wp_update_plugins() is called.
- add_action( 'load-themes.php', 'wp_theme_update_rows', 20 ); // After wp_update_themes() is called.
- 
--add_action( 'admin_notices', 'update_nag',      3  );
- add_action( 'admin_notices', 'maintenance_nag', 10 );
- 
- add_filter( 'update_footer', 'core_update_footer' );
-diff -up wordpress/wp-admin/includes/class-core-upgrader.php.rpm wordpress/wp-admin/includes/class-core-upgrader.php
---- wordpress/wp-admin/includes/class-core-upgrader.php.rpm	2016-09-03 07:59:45.832367671 +0200
-+++ wordpress/wp-admin/includes/class-core-upgrader.php	2016-09-03 07:59:50.160392833 +0200
-@@ -236,6 +236,9 @@ class Core_Upgrader extends WP_Upgrader
- 	 * @return bool True if we should update to the offered version, otherwise false.
- 	 */
- 	public static function should_update_to_version( $offered_ver ) {
-+		// RPM: nether allow core update
-+		return false;
-+
- 		include( ABSPATH . WPINC . '/version.php' ); // $wp_version; // x.y.z
- 
- 		$current_branch = implode( '.', array_slice( preg_split( '/[.-]/', $wp_version  ), 0, 2 ) ); // x.y
-diff -up wordpress/wp-admin/includes/class-wp-automatic-updater.php.rpm wordpress/wp-admin/includes/class-wp-automatic-updater.php
---- wordpress/wp-admin/includes/class-wp-automatic-updater.php.rpm	2016-09-03 08:00:15.810540773 +0200
-+++ wordpress/wp-admin/includes/class-wp-automatic-updater.php	2016-09-03 08:00:28.915616106 +0200
-@@ -31,7 +31,7 @@ class WP_Automatic_Updater {
- 	 */
- 	public function is_disabled() {
- 		// Background updates are disabled if you don't want file changes.
--		if ( defined( 'DISALLOW_FILE_MODS' ) && DISALLOW_FILE_MODS )
-+		if ( !defined( 'DISALLOW_FILE_MODS' ) || DISALLOW_FILE_MODS )
- 			return true;
- 
- 		if ( wp_installing() )
-diff -up wordpress/wp-admin/includes/translation-install.php.rpm wordpress/wp-admin/includes/translation-install.php
---- wordpress/wp-admin/includes/translation-install.php.rpm	2016-05-22 20:01:30.000000000 +0200
-+++ wordpress/wp-admin/includes/translation-install.php	2016-09-03 07:50:51.813312387 +0200
-@@ -181,7 +181,7 @@ function wp_download_language_pack( $dow
- 		return $download;
- 	}
- 
--	if ( defined( 'DISALLOW_FILE_MODS' ) && DISALLOW_FILE_MODS ) {
-+	if ( !defined( 'DISALLOW_FILE_MODS' ) || DISALLOW_FILE_MODS ) {
- 		return false;
- 	}
- 
-@@ -224,7 +224,7 @@ function wp_download_language_pack( $dow
-  * @return bool Returns true on success, false on failure.
-  */
- function wp_can_install_language_pack() {
--	if ( defined( 'DISALLOW_FILE_MODS' ) && DISALLOW_FILE_MODS ) {
-+	if ( !defined( 'DISALLOW_FILE_MODS' ) || DISALLOW_FILE_MODS ) {
- 		return false;
- 	}
- 
-diff -up wordpress/wp-admin/includes/update.php.rpm wordpress/wp-admin/includes/update.php
---- wordpress/wp-admin/includes/update.php.rpm	2016-08-10 21:06:31.000000000 +0200
-+++ wordpress/wp-admin/includes/update.php	2016-09-03 07:50:51.812312381 +0200
-@@ -271,7 +271,7 @@ function update_right_now_message() {
- 		$cur = get_preferred_from_update_core();
- 
- 		if ( isset( $cur->response ) && $cur->response == 'upgrade' )
--			$msg .= '<a href="' . network_admin_url( 'update-core.php' ) . '" class="button" aria-describedby="wp-version">' . sprintf( __( 'Update to %s' ), $cur->current ? $cur->current : __( 'Latest' ) ) . '</a> ';
-+			$msg .= '';
- 	}
- 
- 	/* translators: 1: version number, 2: theme name */
-diff -up wordpress/wp-includes/capabilities.php.rpm wordpress/wp-includes/capabilities.php
---- wordpress/wp-includes/capabilities.php.rpm	2016-06-30 03:02:29.000000000 +0200
-+++ wordpress/wp-includes/capabilities.php	2016-09-03 07:50:51.812312381 +0200
-@@ -330,7 +330,7 @@ function map_meta_cap( $cap, $user_id )
- 		// Disallow the file editors.
- 		if ( defined( 'DISALLOW_FILE_EDIT' ) && DISALLOW_FILE_EDIT )
- 			$caps[] = 'do_not_allow';
--		elseif ( defined( 'DISALLOW_FILE_MODS' ) && DISALLOW_FILE_MODS )
-+		elseif ( !defined( 'DISALLOW_FILE_MODS' ) || DISALLOW_FILE_MODS )
- 			$caps[] = 'do_not_allow';
- 		elseif ( is_multisite() && ! is_super_admin( $user_id ) )
- 			$caps[] = 'do_not_allow';
-@@ -348,7 +348,7 @@ function map_meta_cap( $cap, $user_id )
- 	case 'update_core':
- 		// Disallow anything that creates, deletes, or updates core, plugin, or theme files.
- 		// Files in uploads are excepted.
--		if ( defined( 'DISALLOW_FILE_MODS' ) && DISALLOW_FILE_MODS ) {
-+		if ( !defined( 'DISALLOW_FILE_MODS' ) || DISALLOW_FILE_MODS ) {
- 			$caps[] = 'do_not_allow';
- 		} elseif ( is_multisite() && ! is_super_admin( $user_id ) ) {
- 			$caps[] = 'do_not_allow';
-diff -up wordpress/wp-includes/update.php.rpm wordpress/wp-includes/update.php
---- wordpress/wp-includes/update.php.rpm	2016-05-25 21:36:28.000000000 +0200
-+++ wordpress/wp-includes/update.php	2016-09-03 07:50:51.813312387 +0200
-@@ -653,9 +653,6 @@ function _maybe_update_themes() {
-  * @since 3.1.0
-  */
- function wp_schedule_update_checks() {
--	if ( ! wp_next_scheduled( 'wp_version_check' ) && ! wp_installing() )
--		wp_schedule_event(time(), 'twicedaily', 'wp_version_check');
--
- 	if ( ! wp_next_scheduled( 'wp_update_plugins' ) && ! wp_installing() )
- 		wp_schedule_event(time(), 'twicedaily', 'wp_update_plugins');
- 

wordpress-4.8-noupdate.patch

@@ -0,0 +1,71 @@
+diff -up wordpress/wp-admin/includes/admin-filters.php.rpm wordpress/wp-admin/includes/admin-filters.php
+--- wordpress/wp-admin/includes/admin-filters.php.rpm	2016-07-31 20:11:29.000000000 +0200
++++ wordpress/wp-admin/includes/admin-filters.php	2017-06-09 13:27:51.184747881 +0200
+@@ -106,7 +106,6 @@ add_action( 'profile_update', 'default_p
+ add_action( 'load-plugins.php', 'wp_plugin_update_rows', 20 ); // After wp_update_plugins() is called.
+ add_action( 'load-themes.php', 'wp_theme_update_rows', 20 ); // After wp_update_themes() is called.
+ 
+-add_action( 'admin_notices', 'update_nag',      3  );
+ add_action( 'admin_notices', 'maintenance_nag', 10 );
+ 
+ add_filter( 'update_footer', 'core_update_footer' );
+diff -up wordpress/wp-admin/includes/class-core-upgrader.php.rpm wordpress/wp-admin/includes/class-core-upgrader.php
+--- wordpress/wp-admin/includes/class-core-upgrader.php.rpm	2016-07-08 15:19:30.000000000 +0200
++++ wordpress/wp-admin/includes/class-core-upgrader.php	2017-06-09 13:27:51.184747881 +0200
+@@ -236,6 +236,9 @@ class Core_Upgrader extends WP_Upgrader
+ 	 * @return bool True if we should update to the offered version, otherwise false.
+ 	 */
+ 	public static function should_update_to_version( $offered_ver ) {
++		// RPM: nether allow core update
++		return false;
++
+ 		include( ABSPATH . WPINC . '/version.php' ); // $wp_version; // x.y.z
+ 
+ 		$current_branch = implode( '.', array_slice( preg_split( '/[.-]/', $wp_version  ), 0, 2 ) ); // x.y
+diff -up wordpress/wp-admin/includes/class-wp-automatic-updater.php.rpm wordpress/wp-admin/includes/class-wp-automatic-updater.php
+--- wordpress/wp-admin/includes/class-wp-automatic-updater.php.rpm	2017-06-09 13:27:51.184747881 +0200
++++ wordpress/wp-admin/includes/class-wp-automatic-updater.php	2017-06-09 13:30:18.175525864 +0200
+@@ -38,7 +38,7 @@ class WP_Automatic_Updater {
+ 			return true;
+ 
+ 		// More fine grained control can be done through the WP_AUTO_UPDATE_CORE constant and filters.
+-		$disabled = defined( 'AUTOMATIC_UPDATER_DISABLED' ) && AUTOMATIC_UPDATER_DISABLED;
++		$disabled = !defined( 'AUTOMATIC_UPDATER_DISABLED' ) || AUTOMATIC_UPDATER_DISABLED;
+ 
+ 		/**
+ 		 * Filters whether to entirely disable background updates.
+diff -up wordpress/wp-admin/includes/update.php.rpm wordpress/wp-admin/includes/update.php
+--- wordpress/wp-admin/includes/update.php.rpm	2017-05-06 16:30:40.000000000 +0200
++++ wordpress/wp-admin/includes/update.php	2017-06-09 13:27:51.185747886 +0200
+@@ -279,7 +279,7 @@ function update_right_now_message() {
+ 		$cur = get_preferred_from_update_core();
+ 
+ 		if ( isset( $cur->response ) && $cur->response == 'upgrade' )
+-			$msg .= '<a href="' . network_admin_url( 'update-core.php' ) . '" class="button" aria-describedby="wp-version">' . sprintf( __( 'Update to %s' ), $cur->current ? $cur->current : __( 'Latest' ) ) . '</a> ';
++			$msg .= '';
+ 	}
+ 
+ 	/* translators: 1: version number, 2: theme name */
+diff -up wordpress/wp-includes/load.php.rpm wordpress/wp-includes/load.php
+--- wordpress/wp-includes/load.php.rpm	2017-06-09 13:33:24.946514394 +0200
++++ wordpress/wp-includes/load.php	2017-06-09 13:33:35.654571069 +0200
+@@ -1108,5 +1108,5 @@ function wp_is_file_mod_allowed( $contex
+ 	 * @param bool   $file_mod_allowed Whether file modifications are allowed.
+ 	 * @param string $context          The usage context.
+ 	 */
+-	return apply_filters( 'file_mod_allowed', ! defined( 'DISALLOW_FILE_MODS' ) || ! DISALLOW_FILE_MODS, $context );
++	return apply_filters( 'file_mod_allowed', defined( 'DISALLOW_FILE_MODS' ) && ! DISALLOW_FILE_MODS, $context );
+ }
+diff -up wordpress/wp-includes/update.php.rpm wordpress/wp-includes/update.php
+--- wordpress/wp-includes/update.php.rpm	2017-05-06 16:30:40.000000000 +0200
++++ wordpress/wp-includes/update.php	2017-06-09 13:27:51.185747886 +0200
+@@ -683,9 +683,6 @@ function _maybe_update_themes() {
+  * @since 3.1.0
+  */
+ function wp_schedule_update_checks() {
+-	if ( ! wp_next_scheduled( 'wp_version_check' ) && ! wp_installing() )
+-		wp_schedule_event(time(), 'twicedaily', 'wp_version_check');
+-
+ 	if ( ! wp_next_scheduled( 'wp_update_plugins' ) && ! wp_installing() )
+ 		wp_schedule_event(time(), 'twicedaily', 'wp_update_plugins');
+ 

wordpress-4.8-tinymce_noflash.patch

@@ -0,0 +1,31 @@
+--- ./wp-includes/js/tinymce/plugins/media/plugin.js.orig	2017-06-09 13:24:42.303748183 +0200
++++ ./wp-includes/js/tinymce/plugins/media/plugin.js	2017-06-09 13:25:21.965958105 +0200
+@@ -937,8 +937,7 @@
+         'wav': 'audio/wav',
+         'mp4': 'video/mp4',
+         'webm': 'video/webm',
+-        'ogg': 'video/ogg',
+-        'swf': 'application/x-shockwave-flash'
++        'ogg': 'video/ogg'
+       };
+       var fileEnd = url.toLowerCase().split('.').pop();
+       var mime = mimes[fileEnd];
+@@ -1111,18 +1110,6 @@
+             '" width="' + data.width +
+             '" height="' + data.height +
+             '"' + allowFullscreen + '></iframe>';
+-        } else if (data.source1mime === "application/x-shockwave-flash") {
+-          html +=
+-            '<object data="' + data.source1 +
+-            '" width="' + data.width +
+-            '" height="' + data.height +
+-            '" type="application/x-shockwave-flash">';
+-
+-          if (data.poster) {
+-            html += '<img src="' + data.poster + '" width="' + data.width + '" height="' + data.height + '" />';
+-          }
+-
+-          html += '</object>';
+         } else if (data.source1mime.indexOf('audio') !== -1) {
+           if (editor.settings.audio_template_callback) {
+             html = editor.settings.audio_template_callback(data);

wordpress.spec

@@ -14,18 +14,12 @@
 %global with_nginx 0
 %endif
 
-# https://bugzilla.redhat.com/1147817 php53-getid3 review
-%if 0%{?fedora} >= 17 || 0%{?rhel} >= 6
-%global with_getid3 1
-%else
-%global with_getid3 0
-%endif
 #global prever RC1
 
 Summary:    Blog tool and publishing platform
 URL:        http://www.wordpress.org
 Name:       wordpress
-Version:    4.7.4
+Version:    4.8.3
 Group:      Applications/Publishing
 Release:    1%{?dist}
 License:    GPLv2
@@ -47,7 +41,7 @@ Patch2: wordpress-4.4-no_swfupload.patch
 # Adjust tinymce's media plugin not to use its SWF plugin. This changes
 # 'p.getParam("flash_video_player_url",u.convertUrl(u.url+"/moxieplayer.swf"))'
 # to 'false'
-Patch3: wordpress-4.0-tinymce_noflash.patch
+Patch3: wordpress-4.8-tinymce_noflash.patch
 # RPM configuration:
 # Path to installation
 # Disable auto-updater
@@ -56,22 +50,12 @@ Patch5: wordpress-4.0-config.patch
 # disable version check and updated
 # change DISALLOW_FILE_MODS default value to true
 # ignore WP_AUTO_UPDATE_CORE (always false)
-Patch6: wordpress-4.6-noupdate.patch
+Patch6: wordpress-4.8-noupdate.patch
 # Use system libraries
 Patch7: wordpress-4.4-systemlibs.patch
 
-BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildArch: noarch
 
-%if 0%{?rhel} == 5
-Requires: php53 >= 5.2.4
-Requires: php53-simplepie >= 1.3.1
-%if %{with_getid3}
-Requires: php53-getid3
-%endif
-Requires: php53-mysql
-
-%else
 %if %{with_nginx}
 Requires: webserver
 Requires: php(httpd)
@@ -84,13 +68,10 @@ Requires: nginx-filesystem
 Requires: php >= 5.2.4
 %endif
 Requires: php-simplepie >= 1.3.1
-%if %{with_getid3}
 Requires: php-getid3
-%endif
 Requires: php-ctype
 Requires: php-filter
 Requires: php-mysqli
-%endif
 
 # From phpcompatinfo report for version 4.5.3
 Requires: php-curl
@@ -149,7 +130,6 @@ Important information in %{_pkgdocdir}/README.fedora
 
 rm wp-includes/js/mediaelement/silverlightmediaelement.xap
 rm wp-includes/js/mediaelement/flashmediaelement.swf
-rm wp-includes/js/tinymce/plugins/media/moxieplayer.swf
 rm wp-includes/js/plupload/plupload.silverlight.xap
 rm wp-includes/js/plupload/plupload.flash.swf
 
@@ -167,9 +147,7 @@ rm wp-content/plugins/akismet/.htaccess
 # changes 'plugins:["flash,"silverlight","youtube","vimeo"]' to
 # 'plugins:["youtube","vimeo"]'
 sed -s 's/"flash","silverlight",//' -i wp-includes/js/mediaelement/mediaelement-and-player.min.js
-%if %{with_getid3}
 %patch7 -p1
-%endif
 
 # We patch a .js file, used patched file instead of unpatch minified one
 ln -sf plugin.js wp-includes/js/tinymce/plugins/media/plugin.min.js
@@ -231,11 +209,7 @@ rm -f ${RPM_BUILD_ROOT}%{_datadir}/wordpress/{license.txt,readme.html}
 # Remove bundled php-simplepie and link to system copy
 rm    ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/class-simplepie.php
 rm -r ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/SimplePie
-%if 0%{?rhel} == 5
-ln -s /usr/share/php/php53-simplepie/autoloader.php \
-%else
 ln -s /usr/share/php/php-simplepie/autoloader.php \
-%endif
        ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/class-simplepie.php
 
 # Remove bundled PHPMailer and link to system one
@@ -246,10 +220,8 @@ for fic in phpmailer smtp; do
          ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/class-$fic.php
 done
 
-%if %{with_getid3}
 # Remove bundled php-getid3
 rm -r ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/ID3
-%endif
 
 # Remove bundled ca-bundle.crt
 rm ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/certificates/ca-bundle.crt
@@ -274,11 +246,7 @@ find ${RPM_BUILD_ROOT} \( -name \*.dolly -o -name \*.rhbz522897 -o -name \*.orig
 #fi
 
 
-%clean
-rm -rf ${RPM_BUILD_ROOT}
-
 %files
-%defattr(-,root,root,-)
 %config(noreplace) %{_sysconfdir}/httpd/conf.d/wordpress.conf
 %if %{with_nginx}
 %config(noreplace) %{_sysconfdir}/nginx/default.d/wordpress.conf
@@ -307,6 +275,21 @@ rm -rf ${RPM_BUILD_ROOT}
 
 
 %changelog
+* Tue Oct 31 2017 Kevin Fenzi <kevin@scrye.com> - 4.8.3-1
+- Update to 4.8.3. Security release. Fixes bug #1508255
+
+* Wed Sep 20 2017 Remi Collet <remi@remirepo.net> - 4.8.2-1
+- Update to 4.8.2 Security and Maintenance Release
+
+* Thu Aug  3 2017 Remi Collet <remi@remirepo.net> - 4.8.1-1
+- Update to 4.8.1 Maintenance Release.
+
+* Fri Jun  9 2017 Remi Collet <remi@remirepo.net> - 4.8-1
+- WordPress 4.8 “Evans”
+
+* Wed May 17 2017 Remi Collet <remi@remirepo.net> - 4.7.5-1
+- WordPress 4.7.5 Security and Maintenance Release
+
 * Sat Apr 22 2017 Kevin Fenzi <kevin@scrye.com> - 4.7.4-1
 - Update to 4.7.4. Maintenance Release.