WordPress 5.2.4 Security Release

(cherry picked from commit dce3e0cbdc)

.gitignore

@@ -1,12 +1,2 @@
 clog
 /wordpress-*.tar.gz
-/wordpress-4.9.2-strip.tar.xz
-/wordpress-4.9.4-strip.tar.xz
-/wordpress-4.9.5-strip.tar.xz
-/wordpress-4.9.6-strip.tar.xz
-/wordpress-4.9.7-strip.tar.xz
-/wordpress-4.9.8-strip.tar.xz
-/wordpress-5.0-strip.tar.xz
-/wordpress-5.0.1-strip.tar.xz
-/wordpress-5.0.2-strip.tar.xz
-/wordpress-5.0.3-strip.tar.xz

sources

@@ -1 +1 @@
-SHA512 (wordpress-5.0.3-strip.tar.xz) = 1091f6607ca1eb93873b918ff0212824174330bd4d775f2a34480a79dc5cd3e7788f245e9fc27f365f6e54b48255e97c66463bd7589608edcae61e2eb85fbe6f
+SHA512 (wordpress-5.2.4.tar.gz) = eaf6e1555f13e4fe1f1a99691b271e658d9a83ab5fa7de1480987875565aab45d246bf8bb2e9828bd43979b96a0fb0db1ebf61c62c4967d9af08a370bef083e0

strip.sh

@@ -1,33 +0,0 @@
-#!/bin/sh
-
-if [ -z "$1" ]; then
-  echo usage $0 version
-  exit 1
-fi
-
-srce=wordpress-$1.tar.gz
-dest=wordpress-$1-strip.tar.xz
-
-if [ ! -f $srce ]; then
-  echo Download...
-  wget https://wordpress.org/$srce || exit 1
-fi
-
-if [ ! -f $dest ]; then
-  echo Cleanup...
-  [ -d wordpress ] && rm -r wordpress
-  
-  echo Unpack...
-  tar xf $srce
-
-  echo Strip non free file
-  rm wordpress/wp-includes/js/codemirror/jshint.js
-
-  echo Pack...
-  tar cJf $dest wordpress
-
-  echo Cleanup...
-  rm -r wordpress  
-
-  echo Done.
-fi

wordpress-4.4-systemlibs.patch

@@ -1,20 +0,0 @@
---- wordpress/wp-admin/includes/media.php.orig	2015-12-09 17:01:52.453306607 +0100
-+++ wordpress/wp-admin/includes/media.php	2015-12-09 17:05:31.477379833 +0100
-@@ -2989,7 +2989,7 @@ function wp_read_video_metadata( $file )
- 	}
- 
- 	if ( ! class_exists( 'getID3', false ) ) {
--		require( ABSPATH . WPINC . '/ID3/getid3.php' );
-+		require( '/usr/share/php/getid3/getid3.php' );
- 	}
- 	$id3 = new getID3();
- 	$data = $id3->analyze( $file );
-@@ -3050,7 +3050,7 @@ function wp_read_audio_metadata( $file )
- 	}
- 
- 	if ( ! class_exists( 'getID3', false ) ) {
--		require( ABSPATH . WPINC . '/ID3/getid3.php' );
-+		require( '/usr/share/php/getid3/getid3.php' );
- 	}
- 	$id3 = new getID3();
- 	$data = $id3->analyze( $file );

wordpress-4.9-tinymce_noflash.patch

@@ -1,36 +0,0 @@
-diff -Nur wordpress.orig/wp-includes/js/tinymce/plugins/media/plugin.js wordpress/wp-includes/js/tinymce/plugins/media/plugin.js
---- wordpress.orig/wp-includes/js/tinymce/plugins/media/plugin.js	2018-05-01 15:31:24.000000000 -0700
-+++ wordpress/wp-includes/js/tinymce/plugins/media/plugin.js	2018-05-18 11:22:34.648500557 -0700
-@@ -166,7 +166,6 @@
-       mp4: 'video/mp4',
-       webm: 'video/webm',
-       ogg: 'video/ogg',
--      swf: 'application/x-shockwave-flash'
-     };
-     var fileEnd = url.toLowerCase().split('.').pop();
-     var mime = mimes[fileEnd];
-@@ -424,14 +423,6 @@
-     var allowFullscreen = data.allowFullscreen ? ' allowFullscreen="1"' : '';
-     return '<iframe src="' + data.source1 + '" width="' + data.width + '" height="' + data.height + '"' + allowFullscreen + '></iframe>';
-   };
--  var getFlashHtml = function (data) {
--    var html = '<object data="' + data.source1 + '" width="' + data.width + '" height="' + data.height + '" type="application/x-shockwave-flash">';
--    if (data.poster) {
--      html += '<img src="' + data.poster + '" width="' + data.width + '" height="' + data.height + '" />';
--    }
--    html += '</object>';
--    return html;
--  };
-   var getAudioHtml = function (data, audioTemplateCallback) {
-     if (audioTemplateCallback) {
-       return audioTemplateCallback(data);
-@@ -494,8 +485,6 @@
-       });
-       if (data.type === 'iframe') {
-         return getIframeHtml(data);
--      } else if (data.source1mime === 'application/x-shockwave-flash') {
--        return getFlashHtml(data);
-       } else if (data.source1mime.indexOf('audio') !== -1) {
-         return getAudioHtml(data, audioTemplateCallback);
-       } else if (data.type === 'script') {
-Binary files wordpress.orig/wp-includes/js/tinymce/wp-tinymce.js.gz and wordpress/wp-includes/js/tinymce/wp-tinymce.js.gz differ

wordpress-4.9.4-remove-jshint-refs.patch

@@ -1,19 +0,0 @@
-Description: Remove references to jshint
- The file jshint.js uses a non-free license. It is removed as part of the upstream
- tarball rebuild but this patch removes the things that reference it. Luckily the
- script handler does a NOP for a non-existent script
-Author: Craig Small <csmall@debian.org>
-Origin: Debian
-Bug: https://core.trac.wordpress.org/ticket/42850
-Reviewed-by: Craig Small <csmall@debian.org>
-Last-Update: 2017-12-09
---- a/wp-includes/script-loader.php
-+++ b/wp-includes/script-loader.php
-@@ -461,7 +461,6 @@
- 
- 	$scripts->add( 'wp-codemirror', '/wp-includes/js/codemirror/codemirror.min.js', array(), '5.29.1-alpha-ee20357' );
- 	$scripts->add( 'csslint', '/wp-includes/js/codemirror/csslint.js', array(), '1.0.5' );
--	$scripts->add( 'jshint', '/wp-includes/js/codemirror/jshint.js', array(), '2.9.5.999' );
- 	$scripts->add( 'jsonlint', '/wp-includes/js/codemirror/jsonlint.js', array(), '1.6.2' );
- 	$scripts->add( 'htmlhint', '/wp-includes/js/codemirror/htmlhint.js', array(), '0.9.14-xwp' );
- 	$scripts->add( 'htmlhint-kses', '/wp-includes/js/codemirror/htmlhint-kses.js', array( 'htmlhint' ) );

wordpress-5.1-config.patch

@@ -1,8 +1,8 @@
 diff -up wordpress/wp-config.php.orig wordpress/wp-config.php
---- wordpress/wp-config.php.orig	2014-09-08 13:12:36.525908423 +0200
-+++ wordpress/wp-config.php	2014-09-08 13:14:33.583402525 +0200
-@@ -66,6 +66,19 @@ define('NONCE_SALT',       'put your uni
- $table_prefix  = 'wp_';
+--- wordpress/wp-config.php.orig	2019-02-21 15:07:29.558863904 +0100
++++ wordpress/wp-config.php	2019-02-21 15:07:37.024901925 +0100
+@@ -66,6 +66,19 @@ define( 'NONCE_SALT',       'put your un
+ $table_prefix = 'wp_';
  
  /**
 + * See http://make.wordpress.org/core/2013/10/25/the-definitive-guide-to-disabling-auto-updates-in-wordpress-3-7
@@ -21,12 +21,12 @@ diff -up wordpress/wp-config.php.orig wordpress/wp-config.php
   * For developers: WordPress debugging mode.
   *
   * Change this to true to enable the display of notices during development.
-@@ -83,7 +96,7 @@ define('WP_DEBUG', false);
+@@ -83,7 +96,7 @@ define( 'WP_DEBUG', false );
  
  /** Absolute path to the WordPress directory. */
- if ( !defined('ABSPATH') )
--	define('ABSPATH', dirname(__FILE__) . '/');
+ if ( ! defined( 'ABSPATH' ) ) {
+-	define( 'ABSPATH', dirname( __FILE__ ) . '/' );
 +	define('ABSPATH', '/usr/share/wordpress');
+ }
  
  /** Sets up WordPress vars and included files. */
- require_once(ABSPATH . 'wp-settings.php');

wordpress-5.1-no_swfupload.patch

@@ -1,14 +1,14 @@
 diff -up wordpress/wp-includes/script-loader.php.orig wordpress/wp-includes/script-loader.php
---- wordpress/wp-includes/script-loader.php.orig	2017-11-16 08:43:42.069856252 +0100
-+++ wordpress/wp-includes/script-loader.php	2017-11-16 08:44:03.872963818 +0100
-@@ -323,12 +323,6 @@ function wp_default_scripts( &$scripts )
+--- wordpress/wp-includes/script-loader.php.orig	2019-02-21 14:57:23.338776485 +0100
++++ wordpress/wp-includes/script-loader.php	2019-02-21 14:57:25.832789185 +0100
+@@ -1098,12 +1098,6 @@ function wp_default_scripts( &$scripts )
  	$scripts->add( 'wp-plupload', "/wp-includes/js/plupload/wp-plupload$suffix.js", array( 'plupload', 'jquery', 'json2', 'media-models' ), false, 1 );
  	did_action( 'init' ) && $scripts->localize( 'wp-plupload', 'pluploadL10n', $uploader_l10n );
  
 -	// keep 'swfupload' for back-compat.
--	$scripts->add( 'swfupload', '/wp-includes/js/swfupload/swfupload.js', array(), '2201-20110113');
+-	$scripts->add( 'swfupload', '/wp-includes/js/swfupload/swfupload.js', array(), '2201-20110113' );
 -	$scripts->add( 'swfupload-all', false, array( 'swfupload' ), '2201' );
--	$scripts->add( 'swfupload-handlers', "/wp-includes/js/swfupload/handlers$suffix.js", array('swfupload-all', 'jquery'), '2201-20110524');
+-	$scripts->add( 'swfupload-handlers', "/wp-includes/js/swfupload/handlers$suffix.js", array( 'swfupload-all', 'jquery' ), '2201-20110524' );
 -	did_action( 'init' ) && $scripts->localize( 'swfupload-handlers', 'swfuploadL10n', $uploader_l10n );
 -
  	$scripts->add( 'comment-reply', "/wp-includes/js/comment-reply$suffix.js", array(), false, 1 );

wordpress-5.1-remove-jshint-refs.patch

@@ -0,0 +1,11 @@
+diff -up wordpress/wp-includes/script-loader.php.orig wordpress/wp-includes/script-loader.php
+--- wordpress/wp-includes/script-loader.php.orig	2019-02-22 10:52:01.902006889 +0100
++++ wordpress/wp-includes/script-loader.php	2019-02-22 10:52:04.560023086 +0100
+@@ -1251,7 +1251,6 @@ function wp_default_scripts( &$scripts )
+ 	$scripts->add( 'wp-codemirror', '/wp-includes/js/codemirror/codemirror.min.js', array(), '5.29.1-alpha-ee20357' );
+ 	$scripts->add( 'csslint', '/wp-includes/js/codemirror/csslint.js', array(), '1.0.5' );
+ 	$scripts->add( 'esprima', '/wp-includes/js/codemirror/esprima.js', array(), '4.0.0' );
+-	$scripts->add( 'jshint', '/wp-includes/js/codemirror/fakejshint.js', array( 'esprima' ), '2.9.5' );
+ 	$scripts->add( 'jsonlint', '/wp-includes/js/codemirror/jsonlint.js', array(), '1.6.2' );
+ 	$scripts->add( 'htmlhint', '/wp-includes/js/codemirror/htmlhint.js', array(), '0.9.14-xwp' );
+ 	$scripts->add( 'htmlhint-kses', '/wp-includes/js/codemirror/htmlhint-kses.js', array( 'htmlhint' ) );

wordpress-5.1-systemlibs.patch

@@ -0,0 +1,21 @@
+diff -up wordpress/wp-admin/includes/media.php.orig wordpress/wp-admin/includes/media.php
+--- wordpress/wp-admin/includes/media.php.orig	2019-02-21 15:01:56.055165397 +0100
++++ wordpress/wp-admin/includes/media.php	2019-02-21 15:02:41.288395787 +0100
+@@ -3261,7 +3261,7 @@ function wp_read_video_metadata( $file )
+ 	}
+ 
+ 	if ( ! class_exists( 'getID3', false ) ) {
+-		require( ABSPATH . WPINC . '/ID3/getid3.php' );
++		require( '/usr/share/php/getid3/getid3.php' );
+ 	}
+ 	$id3  = new getID3();
+ 	$data = $id3->analyze( $file );
+@@ -3358,7 +3358,7 @@ function wp_read_audio_metadata( $file )
+ 	}
+ 
+ 	if ( ! class_exists( 'getID3', false ) ) {
+-		require( ABSPATH . WPINC . '/ID3/getid3.php' );
++		require( '/usr/share/php/getid3/getid3.php' );
+ 	}
+ 	$id3  = new getID3();
+ 	$data = $id3->analyze( $file );

wordpress-5.1-tinymce_noflash.patch

@@ -0,0 +1,35 @@
+diff -up wordpress/wp-includes/js/tinymce/plugins/media/plugin.js.orig wordpress/wp-includes/js/tinymce/plugins/media/plugin.js
+--- wordpress/wp-includes/js/tinymce/plugins/media/plugin.js.orig	2019-02-21 14:59:28.793415420 +0100
++++ wordpress/wp-includes/js/tinymce/plugins/media/plugin.js	2019-02-21 15:00:14.319647286 +0100
+@@ -166,7 +166,6 @@ var media = (function () {
+         mp4: 'video/mp4',
+         webm: 'video/webm',
+         ogg: 'video/ogg',
+-        swf: 'application/x-shockwave-flash'
+       };
+       var fileEnd = url.toLowerCase().split('.').pop();
+       var mime = mimes[fileEnd];
+@@ -424,14 +423,6 @@ var media = (function () {
+       var allowFullscreen = data.allowFullscreen ? ' allowFullscreen="1"' : '';
+       return '<iframe src="' + data.source1 + '" width="' + data.width + '" height="' + data.height + '"' + allowFullscreen + '></iframe>';
+     };
+-    var getFlashHtml = function (data) {
+-      var html = '<object data="' + data.source1 + '" width="' + data.width + '" height="' + data.height + '" type="application/x-shockwave-flash">';
+-      if (data.poster) {
+-        html += '<img src="' + data.poster + '" width="' + data.width + '" height="' + data.height + '" />';
+-      }
+-      html += '</object>';
+-      return html;
+-    };
+     var getAudioHtml = function (data, audioTemplateCallback) {
+       if (audioTemplateCallback) {
+         return audioTemplateCallback(data);
+@@ -494,8 +485,6 @@ var media = (function () {
+         });
+         if (data.type === 'iframe') {
+           return getIframeHtml(data);
+-        } else if (data.source1mime === 'application/x-shockwave-flash') {
+-          return getFlashHtml(data);
+         } else if (data.source1mime.indexOf('audio') !== -1) {
+           return getAudioHtml(data, audioTemplateCallback);
+         } else if (data.type === 'script') {

wordpress-5.2-hello.patch

@@ -1,6 +1,6 @@
-diff -up ./wp-content/plugins/hello.php.dolly ./wp-content/plugins/hello.php
---- ./wp-content/plugins/hello.php.dolly	2018-11-16 00:38:48.000000000 +0100
-+++ ./wp-content/plugins/hello.php	2018-12-12 13:54:41.867980830 +0100
+diff -up wordpress/wp-content/plugins/hello.php.dolly wordpress/wp-content/plugins/hello.php
+--- wordpress/wp-content/plugins/hello.php.dolly	2019-03-28 15:09:05.874797878 +0100
++++ wordpress/wp-content/plugins/hello.php	2019-03-28 15:10:15.892164549 +0100
 @@ -6,41 +6,26 @@
  /*
  Plugin Name: Hello Dolly
@@ -8,7 +8,7 @@ diff -up ./wp-content/plugins/hello.php.dolly ./wp-content/plugins/hello.php
 -Description: This is not just a plugin, it symbolizes the hope and enthusiasm of an entire generation summed up in two words sung most famously by Louis Armstrong: Hello, Dolly. When activated you will randomly see a lyric from <cite>Hello, Dolly</cite> in the upper right of your admin screen on every page.
 +Description: This is not just a plugin, it symbolizes the hope and enthusiasm of an entire generation summed up in two words sung most famously by Richard M. Stallman: Free Software. When activated you will randomly see a lyric from the <cite>Free Software Song</cite> in the upper right of your admin screen on every page.
  Author: Matt Mullenweg
- Version: 1.7.1
+ Version: 1.7.2
  Author URI: http://ma.tt/
  */
  
@@ -25,7 +25,7 @@ diff -up ./wp-content/plugins/hello.php.dolly ./wp-content/plugins/hello.php
 -While the band's playin'
 -One of our old favorite songs from way back when
 -So, take her wrap, fellas
--Dolly, never go away again 
+-Dolly, never go away again
 -Hello, Dolly
 -Well, hello, Dolly
 -It's so nice to have you back where you belong
@@ -55,5 +55,5 @@ diff -up ./wp-content/plugins/hello.php.dolly ./wp-content/plugins/hello.php
 +Join us now and share the software;
 +You'll be free, hackers, you'll be free.";
  
- 	// Here we split it into lines
+ 	// Here we split it into lines.
  	$lyrics = explode( "\n", $lyrics );

wordpress-5.2-noupdate.patch

@@ -1,18 +1,18 @@
 diff -up wordpress/wp-admin/includes/admin-filters.php.rpm wordpress/wp-admin/includes/admin-filters.php
---- wordpress/wp-admin/includes/admin-filters.php.rpm	2017-10-04 20:25:46.000000000 +0200
-+++ wordpress/wp-admin/includes/admin-filters.php	2017-11-16 08:46:52.340794957 +0100
-@@ -115,7 +115,6 @@ add_action( 'personal_options_update', '
+--- wordpress/wp-admin/includes/admin-filters.php.rpm	2019-03-28 15:12:21.157820497 +0100
++++ wordpress/wp-admin/includes/admin-filters.php	2019-03-28 15:12:41.792928559 +0100
+@@ -116,7 +116,6 @@ add_action( 'personal_options_update', '
  add_action( 'load-plugins.php', 'wp_plugin_update_rows', 20 ); // After wp_update_plugins() is called.
  add_action( 'load-themes.php', 'wp_theme_update_rows', 20 ); // After wp_update_themes() is called.
  
--add_action( 'admin_notices', 'update_nag',      3  );
+-add_action( 'admin_notices', 'update_nag', 3 );
+ add_action( 'admin_notices', 'paused_plugins_notice', 5 );
+ add_action( 'admin_notices', 'paused_themes_notice', 5 );
  add_action( 'admin_notices', 'maintenance_nag', 10 );
- 
- add_filter( 'update_footer', 'core_update_footer' );
 diff -up wordpress/wp-admin/includes/class-core-upgrader.php.rpm wordpress/wp-admin/includes/class-core-upgrader.php
---- wordpress/wp-admin/includes/class-core-upgrader.php.rpm	2017-10-18 19:15:47.000000000 +0200
-+++ wordpress/wp-admin/includes/class-core-upgrader.php	2017-11-16 08:46:52.340794957 +0100
-@@ -234,6 +234,9 @@ class Core_Upgrader extends WP_Upgrader
+--- wordpress/wp-admin/includes/class-core-upgrader.php.rpm	2019-03-28 00:05:54.000000000 +0100
++++ wordpress/wp-admin/includes/class-core-upgrader.php	2019-03-28 15:12:21.157820497 +0100
+@@ -269,6 +269,9 @@ class Core_Upgrader extends WP_Upgrader
  	 * @return bool True if we should update to the offered version, otherwise false.
  	 */
  	public static function should_update_to_version( $offered_ver ) {
@@ -21,12 +21,12 @@ diff -up wordpress/wp-admin/includes/class-core-upgrader.php.rpm wordpress/wp-ad
 +
  		include( ABSPATH . WPINC . '/version.php' ); // $wp_version; // x.y.z
  
- 		$current_branch = implode( '.', array_slice( preg_split( '/[.-]/', $wp_version  ), 0, 2 ) ); // x.y
+ 		$current_branch                 = implode( '.', array_slice( preg_split( '/[.-]/', $wp_version ), 0, 2 ) ); // x.y
 diff -up wordpress/wp-admin/includes/class-wp-automatic-updater.php.rpm wordpress/wp-admin/includes/class-wp-automatic-updater.php
---- wordpress/wp-admin/includes/class-wp-automatic-updater.php.rpm	2017-10-18 19:48:49.000000000 +0200
-+++ wordpress/wp-admin/includes/class-wp-automatic-updater.php	2017-11-16 08:46:52.340794957 +0100
-@@ -36,7 +36,7 @@ class WP_Automatic_Updater {
- 			return true;
+--- wordpress/wp-admin/includes/class-wp-automatic-updater.php.rpm	2018-08-30 15:36:25.000000000 +0200
++++ wordpress/wp-admin/includes/class-wp-automatic-updater.php	2019-03-28 15:12:21.158820502 +0100
+@@ -38,7 +38,7 @@ class WP_Automatic_Updater {
+ 		}
  
  		// More fine grained control can be done through the WP_AUTO_UPDATE_CORE constant and filters.
 -		$disabled = defined( 'AUTOMATIC_UPDATER_DISABLED' ) && AUTOMATIC_UPDATER_DISABLED;
@@ -35,21 +35,21 @@ diff -up wordpress/wp-admin/includes/class-wp-automatic-updater.php.rpm wordpres
  		/**
  		 * Filters whether to entirely disable background updates.
 diff -up wordpress/wp-admin/includes/update.php.rpm wordpress/wp-admin/includes/update.php
---- wordpress/wp-admin/includes/update.php.rpm	2017-08-22 13:52:48.000000000 +0200
-+++ wordpress/wp-admin/includes/update.php	2017-11-16 08:46:52.340794957 +0100
-@@ -279,7 +279,7 @@ function update_right_now_message() {
+--- wordpress/wp-admin/includes/update.php.rpm	2019-03-22 02:08:51.000000000 +0100
++++ wordpress/wp-admin/includes/update.php	2019-03-28 15:12:21.158820502 +0100
+@@ -301,7 +301,7 @@ function update_right_now_message() {
  		$cur = get_preferred_from_update_core();
  
- 		if ( isset( $cur->response ) && $cur->response == 'upgrade' )
+ 		if ( isset( $cur->response ) && $cur->response == 'upgrade' ) {
 -			$msg .= '<a href="' . network_admin_url( 'update-core.php' ) . '" class="button" aria-describedby="wp-version">' . sprintf( __( 'Update to %s' ), $cur->current ? $cur->current : __( 'Latest' ) ) . '</a> ';
 +			$msg .= '';
+ 		}
  	}
  
- 	/* translators: 1: version number, 2: theme name */
 diff -up wordpress/wp-includes/load.php.rpm wordpress/wp-includes/load.php
---- wordpress/wp-includes/load.php.rpm	2017-11-16 08:46:52.340794957 +0100
-+++ wordpress/wp-includes/load.php	2017-11-16 08:47:47.535067259 +0100
-@@ -1112,7 +1112,7 @@ function wp_is_file_mod_allowed( $contex
+--- wordpress/wp-includes/load.php.rpm	2019-03-27 01:03:51.000000000 +0100
++++ wordpress/wp-includes/load.php	2019-03-28 15:12:21.158820502 +0100
+@@ -1418,7 +1418,7 @@ function wp_is_file_mod_allowed( $contex
  	 * @param bool   $file_mod_allowed Whether file modifications are allowed.
  	 * @param string $context          The usage context.
  	 */
@@ -59,15 +59,16 @@ diff -up wordpress/wp-includes/load.php.rpm wordpress/wp-includes/load.php
  
  /**
 diff -up wordpress/wp-includes/update.php.rpm wordpress/wp-includes/update.php
---- wordpress/wp-includes/update.php.rpm	2017-10-22 00:42:51.000000000 +0200
-+++ wordpress/wp-includes/update.php	2017-11-16 08:46:52.340794957 +0100
-@@ -707,9 +707,6 @@ function _maybe_update_themes() {
+--- wordpress/wp-includes/update.php.rpm	2019-01-16 04:38:49.000000000 +0100
++++ wordpress/wp-includes/update.php	2019-03-28 15:12:21.158820502 +0100
+@@ -770,10 +770,6 @@ function _maybe_update_themes() {
   * @since 3.1.0
   */
  function wp_schedule_update_checks() {
--	if ( ! wp_next_scheduled( 'wp_version_check' ) && ! wp_installing() )
--		wp_schedule_event(time(), 'twicedaily', 'wp_version_check');
+-	if ( ! wp_next_scheduled( 'wp_version_check' ) && ! wp_installing() ) {
+-		wp_schedule_event( time(), 'twicedaily', 'wp_version_check' );
+-	}
 -
- 	if ( ! wp_next_scheduled( 'wp_update_plugins' ) && ! wp_installing() )
- 		wp_schedule_event(time(), 'twicedaily', 'wp_update_plugins');
- 
+ 	if ( ! wp_next_scheduled( 'wp_update_plugins' ) && ! wp_installing() ) {
+ 		wp_schedule_event( time(), 'twicedaily', 'wp_update_plugins' );
+ 	}

wordpress.spec

@@ -13,59 +13,67 @@
 %else
 %global with_nginx 0
 %endif
-
-#global prever RC1
+%if 0%{?fedora} >= 28 || 0%{?rhel} >= 8
+%global clean_compat 1
+%else
+%global clean_compat 0
+%endif
+%global upstream_version 5.2.4
+#global upstream_prever  RC1
+#global upstream_lower   rc1
 
 Summary:    Blog tool and publishing platform
 URL:        http://www.wordpress.org
 Name:       wordpress
-Version:    5.0.3
-Group:      Applications/Publishing
+Version:    %{upstream_version}%{?upstream_prever:~%upstream_lower}
 Release:    1%{?dist}
 License:    GPLv2
 
-Source0:    %{name}-%{version}%{?prever:-%{prever}}-strip.tar.xz
+Source0:    https://wordpress.org/%{name}-%{upstream_version}%{?upstream_prever:-%{upstream_prever}}.tar.gz
 Source1:    wordpress-httpd-conf
 Source2:    README.fedora.wordpress
 Source3:    README.fedora.wordpress-mu
 Source4:    wordpress-nginx-conf
 # To minify JS assets
 Source5:    wordpress-minify.php
-# To generate the tarball without non-free files
-Source6:    strip.sh
 
 # Patch out copyrighted text of Hello, Dolly
 # (and replace it with Free Software Song)
-Patch0: wordpress-debian_patches_hello.patch
+Patch0: wordpress-5.2-hello.patch
 # Move wp-content to /var/www/wordpress/
 # This patch doesn’t work well, see bugzilla.redhat.com/522897
 Patch1: wordpress-move-wp-content.patch
 # Drop swfupload: not built from source, not reasonably possible to do
-Patch2: wordpress-4.9-no_swfupload.patch
+Patch2: wordpress-5.1-no_swfupload.patch
 # Adjust tinymce's media plugin not to use its SWF plugin. This changes
 # 'p.getParam("flash_video_player_url",u.convertUrl(u.url+"/moxieplayer.swf"))'
 # to 'false'
-Patch3: wordpress-4.9-tinymce_noflash.patch
+Patch3: wordpress-5.1-tinymce_noflash.patch
 # We drop the SWF files from mediaelement
 Patch4: wordpress-4.9-mediaelement_no_swf.patch
 # RPM configuration:
 # Path to installation
 # Disable auto-updater
-Patch5: wordpress-4.0-config.patch
+Patch5: wordpress-5.1-config.patch
 # RPM are readonly
 # disable version check and updated
 # change DISALLOW_FILE_MODS default value to true
 # ignore WP_AUTO_UPDATE_CORE (always false)
-Patch6: wordpress-4.9-noupdate.patch
+Patch6: wordpress-5.2-noupdate.patch
 # Use system libraries
-Patch7: wordpress-4.4-systemlibs.patch
+Patch7: wordpress-5.1-systemlibs.patch
 # Debian patch for jshint
-Patch8: wordpress-4.9.4-remove-jshint-refs.patch
+Patch8: wordpress-5.1-remove-jshint-refs.patch
 
 
 BuildArch: noarch
 BuildRequires: php-cli
 BuildRequires: php-patchwork-jsqueeze
+%if %{clean_compat}
+BuildRequires: php(language) >= 7.2
+%else
+BuildRequires: php(language) >= 5.6.20
+%endif
 
 %if %{with_nginx}
 Requires: webserver
@@ -74,9 +82,14 @@ Suggests: httpd
 # For directory ownership
 Requires: httpd-filesystem
 Requires: nginx-filesystem
-
 %else
-Requires: php >= 5.2.4
+Requires: php
+%endif
+%if %{clean_compat}
+Requires: php(language) >= 7.2
+Requires: php-sodium
+%else
+Requires: php(language) >= 5.6.20
 %endif
 Requires: php-simplepie >= 1.3.1
 Requires: php-getid3
@@ -129,6 +142,13 @@ rm -rf wp-includes/js/swfupload
 # remove .htaccess, protected by httpd config file
 rm wp-content/plugins/akismet/.htaccess
 
+%if %{clean_compat}
+# only for PHP < 7.0 without random_int
+rm -rf wp-includes/random_compat
+# only for PHP < 7.2 without sodium_crypto_box
+rm -rf wp-includes/sodium_compat
+%endif
+
 %patch0 -p1 -b .dolly
 #patch1 -p1 -b .rhbz522897
 %patch2 -p1
@@ -152,9 +172,7 @@ php %{SOURCE5} \
 
 # Re-Generated the archive
 arc=wp-includes/js/tinymce/wp-tinymce.js
-gunzip -dc $arc.gz | \
-  grep "^// Source" | \
-  while read a b c
+grep "^// Source" $arc | while read a b c
 do
   if [ -f $c ]; then
     echo -e "\n$a $b $c"
@@ -162,9 +180,14 @@ do
   else
     exit 1
   fi
-done >$arc
-gzip --force $arc
-ls -l $arc.gz
+done >$arc.tmp
+if [ -s $arc.tmp ]; then
+  gzip -c $arc > $arc.gz
+  ls -l $arc*
+  mv $arc.tmp $arc
+else
+  exit 1
+fi
 
 # Create RPM configuration
 sed -e 's/\r//' wp-config-sample.php >wp-config.php
@@ -273,6 +296,31 @@ find ${RPM_BUILD_ROOT} \( -name \*.dolly -o -name \*.rhbz522897 -o -name \*.orig
 
 
 %changelog
+* Tue Oct 15 2019 Remi Collet <remi@remirepo.net> - 5.2.4-1
+- WordPress 5.2.4 Security Release
+
+* Thu Sep  5 2019 Remi Collet <remi@remirepo.net> - 5.2.3-1
+- WordPress 5.2.3 Security and Maintenance Release
+
+* Wed Jun 19 2019 Remi Collet <remi@remirepo.net> - 5.2.2-1
+- WordPress 5.2.2 Maintenance Release
+
+* Wed May 22 2019 Remi Collet <remi@remirepo.net> - 5.2.1-1
+- WordPress 5.2.1 Maintenance Release
+
+* Wed May  8 2019 Remi Collet <remi@remirepo.net> - 5.2.0-1
+- WordPress 5.2 “Jaco”
+- raise dependency on PHP 7.2
+
+* Fri Mar 22 2019 Remi Collet <remi@remirepo.net> - 5.1.1-4
+- fix wp-tinymce.js is missing, wp-tinymce.js.gz is empty #1691524
+
+* Wed Mar 13 2019 Remi Collet <remi@remirepo.net> - 5.1.1-1
+- WordPress 5.1.1 Security and Maintenance Release
+
+* Fri Feb 22 2019 Remi Collet <remi@remirepo.net> - 5.1-1
+- WordPress 5.1 “Betty”
+
 * Fri Jan 11 2019 Remi Collet <remi@remirepo.net> - 5.0.3-1
 - WordPress 5.0.3 Maintenance Release