WordPress 4.9.5 Security and Maintenance Release

(cherry picked from commit f7f9218272)

.gitignore

@@ -1,44 +1,5 @@
-*spec~
 clog
-/wordpress-3.7.tar.gz
+/wordpress-*.tar.gz
-/wordpress-3.7.1.tar.gz
+/wordpress-4.9.2-strip.tar.xz
-/wordpress-3.8.tar.gz
+/wordpress-4.9.4-strip.tar.xz
-/wordpress-3.8.1.tar.gz
+/wordpress-4.9.5-strip.tar.xz
-/wordpress-3.8.2.tar.gz
-/wordpress-3.8.3.tar.gz
-/wordpress-3.9.tar.gz
-/wordpress-3.9.1.tar.gz
-/wordpress-3.9.2.tar.gz
-/wordpress-4.0.tar.gz
-/wordpress-4.0.1.tar.gz
-/wordpress-4.1.tar.gz
-/wordpress-4.1.1.tar.gz
-/wordpress-4.1.2.tar.gz
-/wordpress-4.2.tar.gz
-/wordpress-4.2.1.tar.gz
-/wordpress-4.2.2.tar.gz
-/wordpress-4.2.3.tar.gz
-/wordpress-4.2.4.tar.gz
-/wordpress-4.3.tar.gz
-/wordpress-4.3.1.tar.gz
-/wordpress-4.4.tar.gz
-/wordpress-4.4.1.tar.gz
-/wordpress-4.4.2.tar.gz
-/wordpress-4.5-RC1.tar.gz
-/wordpress-4.5.tar.gz
-/wordpress-4.5.1.tar.gz
-/wordpress-4.5.2.tar.gz
-/wordpress-4.5.3.tar.gz
-/wordpress-debian_patches_hello.patch
-/wordpress-4.6.tar.gz
-/wordpress-4.6.1.tar.gz
-/wordpress-4.7.tar.gz
-/wordpress-4.7.1.tar.gz
-/wordpress-4.7.2.tar.gz
-/wordpress-4.7.3.tar.gz
-/wordpress-4.7.4.tar.gz
-/wordpress-4.7.5.tar.gz
-/wordpress-4.8.tar.gz
-/wordpress-4.8.1.tar.gz
-/wordpress-4.8.2.tar.gz
-/wordpress-4.8.3.tar.gz

sources

@@ -1 +1 @@
-SHA512 (wordpress-4.8.3.tar.gz) = 696be1c24dec869d896e22b408b17009e8c482545237156f17d4b5f2d726876a17c3cc5c3de632126229747589d74f7b188c06d2a79878efc800bd6db273d709
+SHA512 (wordpress-4.9.5-strip.tar.xz) = 5b763b833c9e6758a86b2eecd0cd74e5a7671851351eb7bb56454b15611f9b12bfda6181e2df09cad485611ce5f32e61dcd9b86906e32afe95b86b0077876a4a

strip.sh

@@ -0,0 +1,33 @@
+#!/bin/sh
+
+if [ -z "$1" ]; then
+  echo usage $0 version
+  exit 1
+fi
+
+srce=wordpress-$1.tar.gz
+dest=wordpress-$1-strip.tar.xz
+
+if [ ! -f $srce ]; then
+  echo Download...
+  wget http://wordpress.org/$srce || exit 1
+fi
+
+if [ ! -f $dest ]; then
+  echo Cleanup...
+  [ -d wordpress ] && rm -r wordpress
+  
+  echo Unpack...
+  tar xf $srce
+
+  echo Strip non free file
+  rm wordpress/wp-includes/js/codemirror/jshint.js
+
+  echo Pack...
+  tar cJf $dest wordpress
+
+  echo Cleanup...
+  rm -r wordpress  
+
+  echo Done.
+fi

wordpress-4.9-mediaelement_no_swf.patch

@@ -0,0 +1,38 @@
+diff -up wordpress/wp-includes/js/mediaelement/mediaelement-and-player.js.old wordpress/wp-includes/js/mediaelement/mediaelement-and-player.js
+--- wordpress/wp-includes/js/mediaelement/mediaelement-and-player.js.old	2017-11-16 09:22:17.148277728 +0100
++++ wordpress/wp-includes/js/mediaelement/mediaelement-and-player.js	2017-11-16 09:23:42.056696625 +0100
+@@ -6121,6 +6121,7 @@ if (hasFlash) {
+ 		}
+ 	});
+ 
++/* swf files removed from RPM
+ 	var FlashMediaElementVideoRenderer = {
+ 		name: 'flash_video',
+ 		options: {
+@@ -6205,6 +6206,7 @@ if (hasFlash) {
+ 		create: FlashMediaElementRenderer.create
+ 	};
+ 	_renderer.renderer.add(FlashMediaElementAudioOggRenderer);
++*/
+ }
+ 
+ },{"2":2,"25":25,"27":27,"28":28,"3":3,"5":5,"7":7,"8":8}],21:[function(_dereq_,module,exports){
+diff -up wordpress/wp-includes/js/mediaelement/mediaelement.js.old wordpress/wp-includes/js/mediaelement/mediaelement.js
+--- wordpress/wp-includes/js/mediaelement/mediaelement.js.old	2017-11-16 09:24:44.984007081 +0100
++++ wordpress/wp-includes/js/mediaelement/mediaelement.js	2017-11-16 09:24:49.655030123 +0100
+@@ -1839,6 +1839,7 @@ if (hasFlash) {
+ 		}
+ 	});
+ 
++/* swf files removed from RPM
+ 	var FlashMediaElementVideoRenderer = {
+ 		name: 'flash_video',
+ 		options: {
+@@ -1923,6 +1924,7 @@ if (hasFlash) {
+ 		create: FlashMediaElementRenderer.create
+ 	};
+ 	_renderer.renderer.add(FlashMediaElementAudioOggRenderer);
++*/
+ }
+ 
+ },{"16":16,"18":18,"19":19,"2":2,"3":3,"5":5,"7":7,"8":8}],12:[function(_dereq_,module,exports){

wordpress-4.9-no_swfupload.patch

@@ -1,15 +1,13 @@
---- wordpress/wp-includes/script-loader.php.orig	2015-12-09 16:51:44.740328793 +0100
+diff -up wordpress/wp-includes/script-loader.php.orig wordpress/wp-includes/script-loader.php
-+++ wordpress/wp-includes/script-loader.php	2015-12-09 16:53:00.870701835 +0100
+--- wordpress/wp-includes/script-loader.php.orig	2017-11-16 08:43:42.069856252 +0100
-@@ -300,15 +300,6 @@ function wp_default_scripts( &$scripts )
++++ wordpress/wp-includes/script-loader.php	2017-11-16 08:44:03.872963818 +0100
+@@ -323,12 +323,6 @@ function wp_default_scripts( &$scripts )
  	$scripts->add( 'wp-plupload', "/wp-includes/js/plupload/wp-plupload$suffix.js", array( 'plupload', 'jquery', 'json2', 'media-models' ), false, 1 );
  	did_action( 'init' ) && $scripts->localize( 'wp-plupload', 'pluploadL10n', $uploader_l10n );
  
 -	// keep 'swfupload' for back-compat.
 -	$scripts->add( 'swfupload', '/wp-includes/js/swfupload/swfupload.js', array(), '2201-20110113');
--	$scripts->add( 'swfupload-swfobject', '/wp-includes/js/swfupload/plugins/swfupload.swfobject.js', array('swfupload', 'swfobject'), '2201a');
+-	$scripts->add( 'swfupload-all', false, array( 'swfupload' ), '2201' );
--	$scripts->add( 'swfupload-queue', '/wp-includes/js/swfupload/plugins/swfupload.queue.js', array('swfupload'), '2201');
--	$scripts->add( 'swfupload-speed', '/wp-includes/js/swfupload/plugins/swfupload.speed.js', array('swfupload'), '2201');
--	$scripts->add( 'swfupload-all', false, array('swfupload', 'swfupload-swfobject', 'swfupload-queue'), '2201');
 -	$scripts->add( 'swfupload-handlers', "/wp-includes/js/swfupload/handlers$suffix.js", array('swfupload-all', 'jquery'), '2201-20110524');
 -	did_action( 'init' ) && $scripts->localize( 'swfupload-handlers', 'swfuploadL10n', $uploader_l10n );
 -

wordpress-4.9-noupdate.patch

@@ -1,7 +1,7 @@
 diff -up wordpress/wp-admin/includes/admin-filters.php.rpm wordpress/wp-admin/includes/admin-filters.php
---- wordpress/wp-admin/includes/admin-filters.php.rpm	2016-07-31 20:11:29.000000000 +0200
+--- wordpress/wp-admin/includes/admin-filters.php.rpm	2017-10-04 20:25:46.000000000 +0200
-+++ wordpress/wp-admin/includes/admin-filters.php	2017-06-09 13:27:51.184747881 +0200
++++ wordpress/wp-admin/includes/admin-filters.php	2017-11-16 08:46:52.340794957 +0100
-@@ -106,7 +106,6 @@ add_action( 'profile_update', 'default_p
+@@ -115,7 +115,6 @@ add_action( 'personal_options_update', '
  add_action( 'load-plugins.php', 'wp_plugin_update_rows', 20 ); // After wp_update_plugins() is called.
  add_action( 'load-themes.php', 'wp_theme_update_rows', 20 ); // After wp_update_themes() is called.
  
@@ -10,9 +10,9 @@ diff -up wordpress/wp-admin/includes/admin-filters.php.rpm wordpress/wp-admin/in
  
  add_filter( 'update_footer', 'core_update_footer' );
 diff -up wordpress/wp-admin/includes/class-core-upgrader.php.rpm wordpress/wp-admin/includes/class-core-upgrader.php
---- wordpress/wp-admin/includes/class-core-upgrader.php.rpm	2016-07-08 15:19:30.000000000 +0200
+--- wordpress/wp-admin/includes/class-core-upgrader.php.rpm	2017-10-18 19:15:47.000000000 +0200
-+++ wordpress/wp-admin/includes/class-core-upgrader.php	2017-06-09 13:27:51.184747881 +0200
++++ wordpress/wp-admin/includes/class-core-upgrader.php	2017-11-16 08:46:52.340794957 +0100
-@@ -236,6 +236,9 @@ class Core_Upgrader extends WP_Upgrader
+@@ -234,6 +234,9 @@ class Core_Upgrader extends WP_Upgrader
  	 * @return bool True if we should update to the offered version, otherwise false.
  	 */
  	public static function should_update_to_version( $offered_ver ) {
@@ -23,9 +23,9 @@ diff -up wordpress/wp-admin/includes/class-core-upgrader.php.rpm wordpress/wp-ad
  
  		$current_branch = implode( '.', array_slice( preg_split( '/[.-]/', $wp_version  ), 0, 2 ) ); // x.y
 diff -up wordpress/wp-admin/includes/class-wp-automatic-updater.php.rpm wordpress/wp-admin/includes/class-wp-automatic-updater.php
---- wordpress/wp-admin/includes/class-wp-automatic-updater.php.rpm	2017-06-09 13:27:51.184747881 +0200
+--- wordpress/wp-admin/includes/class-wp-automatic-updater.php.rpm	2017-10-18 19:48:49.000000000 +0200
-+++ wordpress/wp-admin/includes/class-wp-automatic-updater.php	2017-06-09 13:30:18.175525864 +0200
++++ wordpress/wp-admin/includes/class-wp-automatic-updater.php	2017-11-16 08:46:52.340794957 +0100
-@@ -38,7 +38,7 @@ class WP_Automatic_Updater {
+@@ -36,7 +36,7 @@ class WP_Automatic_Updater {
  			return true;
  
  		// More fine grained control can be done through the WP_AUTO_UPDATE_CORE constant and filters.
@@ -35,8 +35,8 @@ diff -up wordpress/wp-admin/includes/class-wp-automatic-updater.php.rpm wordpres
  		/**
  		 * Filters whether to entirely disable background updates.
 diff -up wordpress/wp-admin/includes/update.php.rpm wordpress/wp-admin/includes/update.php
---- wordpress/wp-admin/includes/update.php.rpm	2017-05-06 16:30:40.000000000 +0200
+--- wordpress/wp-admin/includes/update.php.rpm	2017-08-22 13:52:48.000000000 +0200
-+++ wordpress/wp-admin/includes/update.php	2017-06-09 13:27:51.185747886 +0200
++++ wordpress/wp-admin/includes/update.php	2017-11-16 08:46:52.340794957 +0100
 @@ -279,7 +279,7 @@ function update_right_now_message() {
  		$cur = get_preferred_from_update_core();
  
@@ -47,19 +47,21 @@ diff -up wordpress/wp-admin/includes/update.php.rpm wordpress/wp-admin/includes/
  
  	/* translators: 1: version number, 2: theme name */
 diff -up wordpress/wp-includes/load.php.rpm wordpress/wp-includes/load.php
---- wordpress/wp-includes/load.php.rpm	2017-06-09 13:33:24.946514394 +0200
+--- wordpress/wp-includes/load.php.rpm	2017-11-16 08:46:52.340794957 +0100
-+++ wordpress/wp-includes/load.php	2017-06-09 13:33:35.654571069 +0200
++++ wordpress/wp-includes/load.php	2017-11-16 08:47:47.535067259 +0100
-@@ -1108,5 +1108,5 @@ function wp_is_file_mod_allowed( $contex
+@@ -1112,7 +1112,7 @@ function wp_is_file_mod_allowed( $contex
  	 * @param bool   $file_mod_allowed Whether file modifications are allowed.
  	 * @param string $context          The usage context.
  	 */
 -	return apply_filters( 'file_mod_allowed', ! defined( 'DISALLOW_FILE_MODS' ) || ! DISALLOW_FILE_MODS, $context );
 +	return apply_filters( 'file_mod_allowed', defined( 'DISALLOW_FILE_MODS' ) && ! DISALLOW_FILE_MODS, $context );
  }
+ 
+ /**
 diff -up wordpress/wp-includes/update.php.rpm wordpress/wp-includes/update.php
---- wordpress/wp-includes/update.php.rpm	2017-05-06 16:30:40.000000000 +0200
+--- wordpress/wp-includes/update.php.rpm	2017-10-22 00:42:51.000000000 +0200
-+++ wordpress/wp-includes/update.php	2017-06-09 13:27:51.185747886 +0200
++++ wordpress/wp-includes/update.php	2017-11-16 08:46:52.340794957 +0100
-@@ -683,9 +683,6 @@ function _maybe_update_themes() {
+@@ -707,9 +707,6 @@ function _maybe_update_themes() {
   * @since 3.1.0
   */
  function wp_schedule_update_checks() {

wordpress-4.9.4-remove-jshint-refs.patch

@@ -0,0 +1,19 @@
+Description: Remove references to jshint
+ The file jshint.js uses a non-free license. It is removed as part of the upstream
+ tarball rebuild but this patch removes the things that reference it. Luckily the
+ script handler does a NOP for a non-existent script
+Author: Craig Small <csmall@debian.org>
+Origin: Debian
+Bug: https://core.trac.wordpress.org/ticket/42850
+Reviewed-by: Craig Small <csmall@debian.org>
+Last-Update: 2017-12-09
+--- a/wp-includes/script-loader.php
++++ b/wp-includes/script-loader.php
+@@ -461,7 +461,6 @@
+ 
+ 	$scripts->add( 'wp-codemirror', '/wp-includes/js/codemirror/codemirror.min.js', array(), '5.29.1-alpha-ee20357' );
+ 	$scripts->add( 'csslint', '/wp-includes/js/codemirror/csslint.js', array(), '1.0.5' );
+-	$scripts->add( 'jshint', '/wp-includes/js/codemirror/jshint.js', array(), '2.9.5.999' );
+ 	$scripts->add( 'jsonlint', '/wp-includes/js/codemirror/jsonlint.js', array(), '1.6.2' );
+ 	$scripts->add( 'htmlhint', '/wp-includes/js/codemirror/htmlhint.js', array(), '0.9.14-xwp' );
+ 	$scripts->add( 'htmlhint-kses', '/wp-includes/js/codemirror/htmlhint-kses.js', array( 'htmlhint' ) );

wordpress-debian_patches_hello.patch

@@ -1,13 +1,14 @@
---- wordpress/wp-content/plugins/hello.php	2013-05-22 14:08:40.000000000 -0700
+diff -up wordpress/wp-content/plugins/hello.php.dolly wordpress/wp-content/plugins/hello.php
-+++ wordpress/wp-content/plugins/hello.php.new	2013-08-22 23:46:04.594788007 -0700
+--- wordpress/wp-content/plugins/hello.php.dolly	2018-04-04 08:17:16.113486189 +0200
-@@ -6,42 +6,26 @@
++++ wordpress/wp-content/plugins/hello.php	2018-04-04 08:17:34.599563913 +0200
+@@ -6,41 +6,26 @@
  /*
  Plugin Name: Hello Dolly
  Plugin URI: http://wordpress.org/plugins/hello-dolly/
 -Description: This is not just a plugin, it symbolizes the hope and enthusiasm of an entire generation summed up in two words sung most famously by Louis Armstrong: Hello, Dolly. When activated you will randomly see a lyric from <cite>Hello, Dolly</cite> in the upper right of your admin screen on every page.
 +Description: This is not just a plugin, it symbolizes the hope and enthusiasm of an entire generation summed up in two words sung most famously by Richard M. Stallman: Free Software. When activated you will randomly see a lyric from the <cite>Free Software Song</cite> in the upper right of your admin screen on every page.
  Author: Matt Mullenweg
- Version: 1.6
+ Version: 1.7
  Author URI: http://ma.tt/
  */
  
@@ -20,12 +21,11 @@
 -I can tell, Dolly
 -You're still glowin', you're still crowin'
 -You're still goin' strong
--We feel the room swayin'
+-I feel the room swayin'
 -While the band's playin'
--One of your old favourite songs from way back when
+-One of our old favorite songs from way back when
 -So, take her wrap, fellas
--Find her an empty lap, fellas
+-Dolly, never go away again 
--Dolly'll never go away again
 -Hello, Dolly
 -Well, hello, Dolly
 -It's so nice to have you back where you belong
@@ -33,16 +33,16 @@
 -I can tell, Dolly
 -You're still glowin', you're still crowin'
 -You're still goin' strong
--We feel the room swayin'
+-I feel the room swayin'
 -While the band's playin'
--One of your old favourite songs from way back when
+-One of our old favorite songs from way back when
--Golly, gee, fellas
+-So, golly, gee, fellas
--Find her a vacant knee, fellas
+-Have a little faith in me, fellas
--Dolly'll never go away
+-Dolly, never go away
--Dolly'll never go away
+-Promise, you'll never go away
 -Dolly'll never go away again";
 +	// These are the lyrics to the Free Software Song
-+$lyrics = "Join us now and share the software;
++	$lyrics = "Join us now and share the software;
 +You'll be free, hackers, you'll be free.
 +Hoarders may get piles of money,
 +That is true, hackers, that is true.

wordpress-minify.php

@@ -0,0 +1,16 @@
+<?php
+require '/usr/share/php/Patchwork/autoload-jsqueeze.php';
+
+$in = file_get_contents($_SERVER['argv'][1]);
+if (!$in) exit(1);
+$jsqueeze = new \Patchwork\JSqueeze();
+$out = $jsqueeze->squeeze($in);
+if ($out) {
+    printf("+ minify from %s to %s: %2d%% of %6d\n", 
+        basename($_SERVER['argv'][1]), basename($_SERVER['argv'][2]),
+        round(strlen($out)*100/strlen($in)), strlen($in));
+    file_put_contents($_SERVER['argv'][2], $out);
+} else {
+    exit(2);
+}
+

wordpress.spec

@@ -8,7 +8,7 @@
 %{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}-%{version}}
 %global wp_content %{_datadir}/wordpress/wp-content
 
-%if 0%{?fedora} >= 21
+%if 0%{?fedora} >= 21 || 0%{?rhel} >= 8
 %global with_nginx 1
 %else
 %global with_nginx 0
@@ -19,16 +19,20 @@
 Summary:    Blog tool and publishing platform
 URL:        http://www.wordpress.org
 Name:       wordpress
-Version:    4.8.3
+Version:    4.9.5
 Group:      Applications/Publishing
 Release:    1%{?dist}
 License:    GPLv2
 
-Source0:    http://wordpress.org/%{name}-%{version}%{?prever:-%{prever}}.tar.gz
+Source0:    %{name}-%{version}%{?prever:-%{prever}}-strip.tar.xz
 Source1:    wordpress-httpd-conf
 Source2:    README.fedora.wordpress
 Source3:    README.fedora.wordpress-mu
 Source4:    wordpress-nginx-conf
+# To minify JS assets
+Source5:    wordpress-minify.php
+# To generate the tarball without non-free files
+Source6:    strip.sh
 
 # Patch out copyrighted text of Hello, Dolly
 # (and replace it with Free Software Song)
@@ -37,11 +41,13 @@ Patch0: wordpress-debian_patches_hello.patch
 # This patch doesn’t work well, see bugzilla.redhat.com/522897
 Patch1: wordpress-move-wp-content.patch
 # Drop swfupload: not built from source, not reasonably possible to do
-Patch2: wordpress-4.4-no_swfupload.patch
+Patch2: wordpress-4.9-no_swfupload.patch
 # Adjust tinymce's media plugin not to use its SWF plugin. This changes
 # 'p.getParam("flash_video_player_url",u.convertUrl(u.url+"/moxieplayer.swf"))'
 # to 'false'
 Patch3: wordpress-4.8-tinymce_noflash.patch
+# We drop the SWF files from mediaelement
+Patch4: wordpress-4.9-mediaelement_no_swf.patch
 # RPM configuration:
 # Path to installation
 # Disable auto-updater
@@ -50,11 +56,16 @@ Patch5: wordpress-4.0-config.patch
 # disable version check and updated
 # change DISALLOW_FILE_MODS default value to true
 # ignore WP_AUTO_UPDATE_CORE (always false)
-Patch6: wordpress-4.8-noupdate.patch
+Patch6: wordpress-4.9-noupdate.patch
 # Use system libraries
 Patch7: wordpress-4.4-systemlibs.patch
+# Debian patch for jshint
+Patch8: wordpress-4.9.4-remove-jshint-refs.patch
+
 
 BuildArch: noarch
+BuildRequires: php-cli
+BuildRequires: php-patchwork-jsqueeze
 
 %if %{with_nginx}
 Requires: webserver
@@ -115,24 +126,6 @@ Important information in %{_pkgdocdir}/README.fedora
 %prep
 %setup -q -n wordpress
 
-# Drop pre-compiled binary lumps: Flash and Silverlight
-# This means that Flash video fallbacks in Wordpress' media support
-# and the tinymce plugin, the plupload Flash and Silverlight
-# uploaders, and swfupload are not available.
-# To re-introduce these they would have to be built from the
-# ActionScript source as part of this package build, they cannot be
-# shipped pre-compiled. Removing plupload.flash.js and
-# plupload.silverlight.js causes plupload only to try and use the html4
-# or html5 uploaders; if you just wipe the binaries but leave the
-# .js files, it will try and use the Flash or Silverlight uploaders
-# and draw a non-functional button. - AdamW, 2013/08
-# https://fedoraproject.org/wiki/Packaging:Guidelines#No_inclusion_of_pre-built_binaries_or_libraries
-
-rm wp-includes/js/mediaelement/silverlightmediaelement.xap
-rm wp-includes/js/mediaelement/flashmediaelement.swf
-rm wp-includes/js/plupload/plupload.silverlight.xap
-rm wp-includes/js/plupload/plupload.flash.swf
-
 # swfupload can just die in its entirety
 rm -rf wp-includes/js/swfupload
 
@@ -143,14 +136,22 @@ rm wp-content/plugins/akismet/.htaccess
 #patch1 -p1 -b .rhbz522897
 %patch2 -p1
 %patch3 -p1
-# Adjust mediaelement not to use its SWF and Silverlight plugins. This
+# Adjust mediaelement not to use its SWF
-# changes 'plugins:["flash,"silverlight","youtube","vimeo"]' to
+%patch4 -p1
-# 'plugins:["youtube","vimeo"]'
+#rm  wp-includes/js/mediaelement/media*swf
-sed -s 's/"flash","silverlight",//' -i wp-includes/js/mediaelement/mediaelement-and-player.min.js
 %patch7 -p1
+%patch8 -p1
 
-# We patch a .js file, used patched file instead of unpatch minified one
+# We patch .js files, so minify them
-ln -sf plugin.js wp-includes/js/tinymce/plugins/media/plugin.min.js
+php %{SOURCE5} \
+  wp-includes/js/tinymce/plugins/media/plugin.js \
+  wp-includes/js/tinymce/plugins/media/plugin.min.js
+php %{SOURCE5} \
+  wp-includes/js/mediaelement/mediaelement-and-player.js \
+  wp-includes/js/mediaelement/mediaelement-and-player.min.js
+php %{SOURCE5} \
+  wp-includes/js/mediaelement/mediaelement.js \
+  wp-includes/js/mediaelement/mediaelement.min.js
 
 # Re-Generated the archive
 arc=wp-includes/js/tinymce/wp-tinymce.js
@@ -233,16 +234,16 @@ find ${RPM_BUILD_ROOT} \( -name \*.dolly -o -name \*.rhbz522897 -o -name \*.orig
     -print -delete
 
 ## Move wp-content directory to /var/www location
-#mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/www/wordpress
+#mkdir -p ${RPM_BUILD_ROOT}%%{_localstatedir}/www/wordpress
-#mv -v ${RPM_BUILD_ROOT}%{wp_content}/ \
+#mv -v ${RPM_BUILD_ROOT}%%{wp_content}/ \
-#  ${RPM_BUILD_ROOT}%{_localstatedir}/www/wordpress
+#  ${RPM_BUILD_ROOT}%%{_localstatedir}/www/wordpress
 
-#%post
+#%%post
 #if [ $1 -eq 2 ] ; then
 ## In case user has old wp-content from previous version, move it to
 ## the new location.
-#mv -uf %{wp_content}/* %{_localstatedir}/www/wordpress/
+#mv -uf %%{wp_content}/* %%{_localstatedir}/www/wordpress/
-#/sbin/restorecon -R %{_localstatedir}/www/wordpress/
+#/sbin/restorecon -R %%{_localstatedir}/www/wordpress/
 #fi
 
 
@@ -275,6 +276,23 @@ find ${RPM_BUILD_ROOT} \( -name \*.dolly -o -name \*.rhbz522897 -o -name \*.orig
 
 
 %changelog
+* Wed Apr  4 2018 Remi Collet <remi@remirepo.net> - 4.9.5-1
+- WordPress 4.9.5 Security and Maintenance Release
+
+* Wed Feb  7 2018 Remi Collet <remi@remirepo.net> - 4.9.4-1
+- WordPress 4.9.4 Maintenance Release
+
+* Wed Jan 17 2018 Remi Collet <remi@remirepo.net> - 4.9.2-1
+- WordPress 4.9.2 Security and Maintenance Release
+- drop non-free jshint.js file #1528765
+
+* Thu Nov 30 2017 Remi Collet <remi@remirepo.net> - 4.9.1-1
+- WordPress 4.9.1 Security and Maintenance Release
+
+* Thu Nov 16 2017 Remi Collet <remi@remirepo.net> - 4.9-1
+- WordPress 4.9 “Tipton”
+- minify patched JS files
+
 * Tue Oct 31 2017 Kevin Fenzi <kevin@scrye.com> - 4.8.3-1
 - Update to 4.8.3. Security release. Fixes bug #1508255
 
@@ -284,9 +302,6 @@ find ${RPM_BUILD_ROOT} \( -name \*.dolly -o -name \*.rhbz522897 -o -name \*.orig
 * Thu Aug  3 2017 Remi Collet <remi@remirepo.net> - 4.8.1-1
 - Update to 4.8.1 Maintenance Release.
 
-* Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 4.8-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
-
 * Fri Jun  9 2017 Remi Collet <remi@remirepo.net> - 4.8-1
 - WordPress 4.8 “Evans”