WordPress 5.7.2 Security Release

(cherry picked from commit 4ea211141f)

sources

@@ -1 +1 @@
-SHA512 (wordpress-5.3.2.tar.gz) = d766d485d9a6a6efb2b92ffaec2ba1f773e55a6e018759bb6b196469b73db2857c34a3dfca1ac406e2b7066072a35c070c99f24b285a47b050e3d21317785198
+SHA512 (wordpress-5.7.2.tar.gz) = 84d41dddba5c4c59a0ceb3ef2e04760c27ae811e9db5cb43484f91973dd9c5acfb66affd8f76db06dfefd77e1bd90acad1eba7ba176a5f43b28ec806f3861edb

wordpress-5.3-systemlibs.patch

@@ -1,21 +0,0 @@
-diff -up wordpress/wp-admin/includes/media.php.no wordpress/wp-admin/includes/media.php
---- wordpress/wp-admin/includes/media.php.no	2019-11-13 08:01:19.298917453 +0100
-+++ wordpress/wp-admin/includes/media.php	2019-11-13 08:02:18.118385610 +0100
-@@ -3447,7 +3447,7 @@ function wp_read_video_metadata( $file )
- 	}
- 
- 	if ( ! class_exists( 'getID3', false ) ) {
--		require( ABSPATH . WPINC . '/ID3/getid3.php' );
-+		require( '/usr/share/php/getid3/getid3.php' );
- 	}
- 
- 	$id3  = new getID3();
-@@ -3558,7 +3558,7 @@ function wp_read_audio_metadata( $file )
- 	}
- 
- 	if ( ! class_exists( 'getID3', false ) ) {
--		require( ABSPATH . WPINC . '/ID3/getid3.php' );
-+		require( '/usr/share/php/getid3/getid3.php' );
- 	}
- 
- 	$id3  = new getID3();

wordpress-5.4-config.patch

@@ -1,6 +1,6 @@
-diff -up wordpress/wp-config.php.orig wordpress/wp-config.php
---- wordpress/wp-config.php.orig	2019-02-21 15:07:29.558863904 +0100
-+++ wordpress/wp-config.php	2019-02-21 15:07:37.024901925 +0100
+diff -up wordpress/wp-config.php.old wordpress/wp-config.php
+--- wordpress/wp-config.php.old	2020-03-25 16:41:04.241482906 +0100
++++ wordpress/wp-config.php	2020-03-25 16:42:03.677209804 +0100
 @@ -66,6 +66,19 @@ define( 'NONCE_SALT',       'put your un
  $table_prefix = 'wp_';
  
@@ -25,7 +25,7 @@ diff -up wordpress/wp-config.php.orig wordpress/wp-config.php
  
  /** Absolute path to the WordPress directory. */
  if ( ! defined( 'ABSPATH' ) ) {
--	define( 'ABSPATH', dirname( __FILE__ ) . '/' );
+-	define( 'ABSPATH', __DIR__ . '/' );
 +	define('ABSPATH', '/usr/share/wordpress');
  }
  

wordpress-5.4-no_swfupload.patch

@@ -1,11 +1,11 @@
-diff -up wordpress/wp-includes/script-loader.php.orig wordpress/wp-includes/script-loader.php
---- wordpress/wp-includes/script-loader.php.orig	2019-02-21 14:57:23.338776485 +0100
-+++ wordpress/wp-includes/script-loader.php	2019-02-21 14:57:25.832789185 +0100
-@@ -1098,12 +1098,6 @@ function wp_default_scripts( &$scripts )
+diff -up wordpress/wp-includes/script-loader.php.old wordpress/wp-includes/script-loader.php
+--- wordpress/wp-includes/script-loader.php.old	2020-03-25 16:34:50.606199762 +0100
++++ wordpress/wp-includes/script-loader.php	2020-03-25 16:35:59.409883628 +0100
+@@ -892,12 +892,6 @@ function wp_default_scripts( $scripts )
  	$scripts->add( 'wp-plupload', "/wp-includes/js/plupload/wp-plupload$suffix.js", array( 'plupload', 'jquery', 'json2', 'media-models' ), false, 1 );
  	did_action( 'init' ) && $scripts->localize( 'wp-plupload', 'pluploadL10n', $uploader_l10n );
  
--	// keep 'swfupload' for back-compat.
+-	// Keep 'swfupload' for back-compat.
 -	$scripts->add( 'swfupload', '/wp-includes/js/swfupload/swfupload.js', array(), '2201-20110113' );
 -	$scripts->add( 'swfupload-all', false, array( 'swfupload' ), '2201' );
 -	$scripts->add( 'swfupload-handlers', "/wp-includes/js/swfupload/handlers$suffix.js", array( 'swfupload-all', 'jquery' ), '2201-20110524' );

wordpress-5.4-noupdate.patch

@@ -1,6 +1,6 @@
-diff -up wordpress/wp-admin/includes/admin-filters.php.no wordpress/wp-admin/includes/admin-filters.php
---- wordpress/wp-admin/includes/admin-filters.php.no	2019-05-26 22:50:53.000000000 +0200
-+++ wordpress/wp-admin/includes/admin-filters.php	2019-11-13 08:04:53.832484254 +0100
+diff -up wordpress/wp-admin/includes/admin-filters.php.old wordpress/wp-admin/includes/admin-filters.php
+--- wordpress/wp-admin/includes/admin-filters.php.old	2020-01-29 01:45:18.000000000 +0100
++++ wordpress/wp-admin/includes/admin-filters.php	2020-03-25 16:44:02.126665533 +0100
 @@ -111,7 +111,6 @@ add_action( 'personal_options_update', '
  add_action( 'load-plugins.php', 'wp_plugin_update_rows', 20 ); // After wp_update_plugins() is called.
  add_action( 'load-themes.php', 'wp_theme_update_rows', 20 ); // After wp_update_themes() is called.
@@ -9,22 +9,22 @@ diff -up wordpress/wp-admin/includes/admin-filters.php.no wordpress/wp-admin/inc
  add_action( 'admin_notices', 'paused_plugins_notice', 5 );
  add_action( 'admin_notices', 'paused_themes_notice', 5 );
  add_action( 'admin_notices', 'maintenance_nag', 10 );
-diff -up wordpress/wp-admin/includes/class-core-upgrader.php.no wordpress/wp-admin/includes/class-core-upgrader.php
---- wordpress/wp-admin/includes/class-core-upgrader.php.no	2019-09-03 02:41:05.000000000 +0200
-+++ wordpress/wp-admin/includes/class-core-upgrader.php	2019-11-13 08:04:53.832484254 +0100
-@@ -269,6 +269,9 @@ class Core_Upgrader extends WP_Upgrader
+diff -up wordpress/wp-admin/includes/class-core-upgrader.php.old wordpress/wp-admin/includes/class-core-upgrader.php
+--- wordpress/wp-admin/includes/class-core-upgrader.php.old	2020-03-25 16:44:02.126665533 +0100
++++ wordpress/wp-admin/includes/class-core-upgrader.php	2020-03-25 16:44:38.649497710 +0100
+@@ -270,6 +270,9 @@ class Core_Upgrader extends WP_Upgrader
  	 * @return bool True if we should update to the offered version, otherwise false.
  	 */
  	public static function should_update_to_version( $offered_ver ) {
 +		// RPM: nether allow core update
 +		return false;
 +
- 		include( ABSPATH . WPINC . '/version.php' ); // $wp_version; // x.y.z
+ 		require ABSPATH . WPINC . '/version.php'; // $wp_version; // x.y.z
  
- 		$current_branch                 = implode( '.', array_slice( preg_split( '/[.-]/', $wp_version ), 0, 2 ) ); // x.y
-diff -up wordpress/wp-admin/includes/class-wp-automatic-updater.php.no wordpress/wp-admin/includes/class-wp-automatic-updater.php
---- wordpress/wp-admin/includes/class-wp-automatic-updater.php.no	2019-09-03 02:41:05.000000000 +0200
-+++ wordpress/wp-admin/includes/class-wp-automatic-updater.php	2019-11-13 08:04:53.832484254 +0100
+ 		$current_branch = implode( '.', array_slice( preg_split( '/[.-]/', $wp_version ), 0, 2 ) ); // x.y
+diff -up wordpress/wp-admin/includes/class-wp-automatic-updater.php.old wordpress/wp-admin/includes/class-wp-automatic-updater.php
+--- wordpress/wp-admin/includes/class-wp-automatic-updater.php.old	2020-02-09 17:55:09.000000000 +0100
++++ wordpress/wp-admin/includes/class-wp-automatic-updater.php	2020-03-25 16:44:02.126665533 +0100
 @@ -38,7 +38,7 @@ class WP_Automatic_Updater {
  		}
  
@@ -34,13 +34,13 @@ diff -up wordpress/wp-admin/includes/class-wp-automatic-updater.php.no wordpress
  
  		/**
  		 * Filters whether to entirely disable background updates.
-diff -up wordpress/wp-admin/includes/update.php.no wordpress/wp-admin/includes/update.php
---- wordpress/wp-admin/includes/update.php.no	2019-11-13 08:04:53.833484244 +0100
-+++ wordpress/wp-admin/includes/update.php	2019-11-13 08:06:54.383296231 +0100
-@@ -314,12 +314,7 @@ function update_right_now_message() {
+diff -up wordpress/wp-admin/includes/update.php.old wordpress/wp-admin/includes/update.php
+--- wordpress/wp-admin/includes/update.php.old	2020-03-25 16:44:02.127665528 +0100
++++ wordpress/wp-admin/includes/update.php	2020-03-25 16:45:28.396269123 +0100
+@@ -338,12 +338,7 @@ function update_right_now_message() {
  		$cur = get_preferred_from_update_core();
  
- 		if ( isset( $cur->response ) && $cur->response == 'upgrade' ) {
+ 		if ( isset( $cur->response ) && 'upgrade' === $cur->response ) {
 -			$msg .= sprintf(
 -				'<a href="%s" class="button" aria-describedby="wp-version">%s</a> ',
 -				network_admin_url( 'update-core.php' ),
@@ -51,10 +51,10 @@ diff -up wordpress/wp-admin/includes/update.php.no wordpress/wp-admin/includes/u
  		}
  	}
  
-diff -up wordpress/wp-includes/load.php.no wordpress/wp-includes/load.php
---- wordpress/wp-includes/load.php.no	2019-09-19 14:02:58.000000000 +0200
-+++ wordpress/wp-includes/load.php	2019-11-13 08:04:53.833484244 +0100
-@@ -1422,7 +1422,7 @@ function wp_is_file_mod_allowed( $contex
+diff -up wordpress/wp-includes/load.php.old wordpress/wp-includes/load.php
+--- wordpress/wp-includes/load.php.old	2020-02-25 19:33:06.000000000 +0100
++++ wordpress/wp-includes/load.php	2020-03-25 16:44:02.127665528 +0100
+@@ -1435,7 +1435,7 @@ function wp_is_file_mod_allowed( $contex
  	 * @param bool   $file_mod_allowed Whether file modifications are allowed.
  	 * @param string $context          The usage context.
  	 */
@@ -63,10 +63,10 @@ diff -up wordpress/wp-includes/load.php.no wordpress/wp-includes/load.php
  }
  
  /**
-diff -up wordpress/wp-includes/update.php.no wordpress/wp-includes/update.php
---- wordpress/wp-includes/update.php.no	2019-09-03 02:41:05.000000000 +0200
-+++ wordpress/wp-includes/update.php	2019-11-13 08:04:53.833484244 +0100
-@@ -781,10 +781,6 @@ function _maybe_update_themes() {
+diff -up wordpress/wp-includes/update.php.old wordpress/wp-includes/update.php
+--- wordpress/wp-includes/update.php.old	2020-02-10 04:30:06.000000000 +0100
++++ wordpress/wp-includes/update.php	2020-03-25 16:44:02.127665528 +0100
+@@ -782,10 +782,6 @@ function _maybe_update_themes() {
   * @since 3.1.0
   */
  function wp_schedule_update_checks() {

wordpress-5.4-systemlibs.patch

@@ -0,0 +1,21 @@
+diff -up wordpress/wp-admin/includes/media.php.old wordpress/wp-admin/includes/media.php
+--- wordpress/wp-admin/includes/media.php.old	2020-03-25 16:39:05.484028608 +0100
++++ wordpress/wp-admin/includes/media.php	2020-02-11 00:47:04.000000000 +0100
+@@ -3477,7 +3477,7 @@ function wp_read_video_metadata( $file )
+ 	}
+ 
+ 	if ( ! class_exists( 'getID3', false ) ) {
+-		require ABSPATH . WPINC . '/ID3/getid3.php';
++		require '/usr/share/php/getid3/getid3.php';
+ 	}
+ 
+ 	$id3  = new getID3();
+@@ -3588,7 +3588,7 @@ function wp_read_audio_metadata( $file )
+ 	}
+ 
+ 	if ( ! class_exists( 'getID3', false ) ) {
+-		require ABSPATH . WPINC . '/ID3/getid3.php';
++		require '/usr/share/php/getid3/getid3.php';
+ 	}
+ 
+ 	$id3  = new getID3();

wordpress-5.6-mediaelement_no_swf.patch

@@ -1,7 +1,7 @@
 diff -up wordpress/wp-includes/js/mediaelement/mediaelement-and-player.js.no wordpress/wp-includes/js/mediaelement/mediaelement-and-player.js
---- wordpress/wp-includes/js/mediaelement/mediaelement-and-player.js.no	2019-10-08 18:06:02.000000000 +0200
-+++ wordpress/wp-includes/js/mediaelement/mediaelement-and-player.js	2019-11-13 07:59:39.418787150 +0100
-@@ -6410,6 +6410,7 @@ if (hasFlash) {
+--- wordpress/wp-includes/js/mediaelement/mediaelement-and-player.js.no	2020-09-29 17:53:06.000000000 +0200
++++ wordpress/wp-includes/js/mediaelement/mediaelement-and-player.js	2020-12-09 09:44:27.954254919 +0100
+@@ -6135,6 +6135,7 @@ if (hasFlash) {
  		}
  	});
  
@@ -9,18 +9,18 @@ diff -up wordpress/wp-includes/js/mediaelement/mediaelement-and-player.js.no wor
  	var FlashMediaElementVideoRenderer = {
  		name: 'flash_video',
  		options: {
-@@ -6494,6 +6495,7 @@ if (hasFlash) {
+@@ -6219,6 +6220,7 @@ if (hasFlash) {
  		create: FlashMediaElementRenderer.create
  	};
  	_renderer.renderer.add(FlashMediaElementAudioOggRenderer);
 +*/
  }
  
- },{"10":10,"2":2,"27":27,"29":29,"3":3,"30":30,"7":7,"9":9}],23:[function(_dereq_,module,exports){
+ },{"2":2,"25":25,"27":27,"28":28,"3":3,"5":5,"7":7,"8":8}],21:[function(_dereq_,module,exports){
 diff -up wordpress/wp-includes/js/mediaelement/mediaelement.js.no wordpress/wp-includes/js/mediaelement/mediaelement.js
---- wordpress/wp-includes/js/mediaelement/mediaelement.js.no	2019-10-08 18:06:02.000000000 +0200
-+++ wordpress/wp-includes/js/mediaelement/mediaelement.js	2019-11-13 07:59:45.601728069 +0100
-@@ -2108,6 +2108,7 @@ if (hasFlash) {
+--- wordpress/wp-includes/js/mediaelement/mediaelement.js.no	2020-09-29 17:53:06.000000000 +0200
++++ wordpress/wp-includes/js/mediaelement/mediaelement.js	2020-12-09 09:44:38.532227178 +0100
+@@ -1842,6 +1842,7 @@ if (hasFlash) {
  		}
  	});
  
@@ -28,11 +28,11 @@ diff -up wordpress/wp-includes/js/mediaelement/mediaelement.js.no wordpress/wp-i
  	var FlashMediaElementVideoRenderer = {
  		name: 'flash_video',
  		options: {
-@@ -2192,6 +2193,7 @@ if (hasFlash) {
+@@ -1926,6 +1927,7 @@ if (hasFlash) {
  		create: FlashMediaElementRenderer.create
  	};
  	_renderer.renderer.add(FlashMediaElementAudioOggRenderer);
 +*/
  }
  
- },{"10":10,"18":18,"2":2,"20":20,"21":21,"3":3,"7":7,"9":9}],14:[function(_dereq_,module,exports){
+ },{"16":16,"18":18,"19":19,"2":2,"3":3,"5":5,"7":7,"8":8}],12:[function(_dereq_,module,exports){

wordpress.spec

@@ -13,20 +13,15 @@
 %else
 %global with_nginx 0
 %endif
-%if 0%{?fedora} >= 28 || 0%{?rhel} >= 8
-%global clean_compat 1
-%else
-%global clean_compat 0
-%endif
-%global upstream_version 5.3.2
-#global upstream_prever  RC1
-#global upstream_lower   rc1
+%global upstream_version 5.7.2
+#global upstream_prever  RC5
+#global upstream_lower   rc5
 
 Summary:    Blog tool and publishing platform
 URL:        http://www.wordpress.org
 Name:       wordpress
 Version:    %{upstream_version}%{?upstream_prever:~%upstream_lower}
-Release:    2%{?dist}
+Release:    1%{?dist}
 License:    GPLv2
 
 Source0:    https://wordpress.org/%{name}-%{upstream_version}%{?upstream_prever:-%{upstream_prever}}.tar.gz
@@ -44,24 +39,24 @@ Patch0: wordpress-5.2-hello.patch
 # This patch doesn’t work well, see bugzilla.redhat.com/522897
 Patch1: wordpress-move-wp-content.patch
 # Drop swfupload: not built from source, not reasonably possible to do
-Patch2: wordpress-5.1-no_swfupload.patch
+Patch2: wordpress-5.4-no_swfupload.patch
 # Adjust tinymce's media plugin not to use its SWF plugin. This changes
 # 'p.getParam("flash_video_player_url",u.convertUrl(u.url+"/moxieplayer.swf"))'
 # to 'false'
 Patch3: wordpress-5.1-tinymce_noflash.patch
 # We drop the SWF files from mediaelement
-Patch4: wordpress-5.3-mediaelement_no_swf.patch
+Patch4: wordpress-5.6-mediaelement_no_swf.patch
 # RPM configuration:
 # Path to installation
 # Disable auto-updater
-Patch5: wordpress-5.1-config.patch
+Patch5: wordpress-5.4-config.patch
 # RPM are readonly
 # disable version check and updated
 # change DISALLOW_FILE_MODS default value to true
 # ignore WP_AUTO_UPDATE_CORE (always false)
-Patch6: wordpress-5.3-noupdate.patch
+Patch6: wordpress-5.4-noupdate.patch
 # Use system libraries
-Patch7: wordpress-5.3-systemlibs.patch
+Patch7: wordpress-5.4-systemlibs.patch
 # Debian patch for jshint
 Patch8: wordpress-5.1-remove-jshint-refs.patch
 
@@ -69,11 +64,7 @@ Patch8: wordpress-5.1-remove-jshint-refs.patch
 BuildArch: noarch
 BuildRequires: php-cli
 BuildRequires: php-patchwork-jsqueeze
-%if %{clean_compat}
 BuildRequires: php(language) >= 7.2
-%else
-BuildRequires: php(language) >= 5.6.20
-%endif
 
 %if %{with_nginx}
 Requires: webserver
@@ -85,12 +76,8 @@ Requires: nginx-filesystem
 %else
 Requires: php
 %endif
-%if %{clean_compat}
 Requires: php(language) >= 7.2
 Requires: php-sodium
-%else
-Requires: php(language) >= 5.6.20
-%endif
 Requires: php-simplepie >= 1.3.1
 Requires: php-getid3
 Requires: php-ctype
@@ -120,7 +107,7 @@ Requires: php-xmlreader
 Requires: php-zip
 Requires: php-zlib
 # Unbundled libraries
-Requires: php-PHPMailer
+Requires: php-phpmailer6
 Requires: httpd
 Requires: ca-certificates
 Provides: wordpress-mu = %{version}-%{release}
@@ -142,12 +129,10 @@ rm -rf wp-includes/js/swfupload
 # remove .htaccess, protected by httpd config file
 rm wp-content/plugins/akismet/.htaccess
 
-%if %{clean_compat}
 # only for PHP < 7.0 without random_int
 rm -rf wp-includes/random_compat
 # only for PHP < 7.2 without sodium_crypto_box
 rm -rf wp-includes/sodium_compat
-%endif
 
 %patch0 -p1 -b .dolly
 #patch1 -p1 -b .rhbz522897
@@ -234,12 +219,9 @@ ln -s /usr/share/php/php-simplepie/autoloader.php \
        ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/class-simplepie.php
 
 # Remove bundled PHPMailer and link to system one
-# Note POP3 is not from PHPMailer but from SquirrelMail
-for fic in phpmailer smtp; do
-  rm     ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/class-$fic.php
-  ln -sf /usr/share/php/PHPMailer/class.$fic.php \
-         ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/class-$fic.php
-done
+rm -r ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/PHPMailer
+ln -s /usr/share/php/PHPMailer/PHPMailer6 \
+      ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/PHPMailer
 
 # Remove bundled php-getid3
 rm -r ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/ID3
@@ -296,6 +278,46 @@ find ${RPM_BUILD_ROOT} \( -name \*.dolly -o -name \*.rhbz522897 -o -name \*.orig
 
 
 %changelog
+* Thu May 13 2021 Remi Collet <remi@remirepo.net> - 5.7.2-1
+- WordPress 5.7.2 Security Release
+
+* Thu Apr 15 2021 Remi Collet <remi@remirepo.net> - 5.7.1-1
+- WordPress 5.7.1 Security and Maintenance Release
+
+* Wed Mar 10 2021 Remi Collet <remi@remirepo.net> - 5.7-1
+- WordPress 5.7 “Esperanza”
+
+* Tue Feb 23 2021 Remi Collet <remi@remirepo.net> - 5.6.2-1
+- WordPress 5.6.2 Maintenance Release
+
+* Fri Feb  5 2021 Remi Collet <remi@remirepo.net> - 5.6.1-1
+- WordPress 5.6.1 Maintenance Release
+
+* Wed Dec  9 2020 Remi Collet <remi@remirepo.net> - 5.6-1
+- WordPress 5.6 “Simone”
+
+* Sat Oct 31 2020 Remi Collet <remi@remirepo.net> - 5.5.3-1
+- WordPress 5.5.3 Maintenance Release
+
+* Fri Oct 30 2020 Remi Collet <remi@remirepo.net> - 5.5.2-1
+- WordPress 5.5.2 Security and Maintenance Release
+
+* Wed Sep  2 2020 Remi Collet <remi@remirepo.net> - 5.5.1-1
+- WordPress 5.5.1 Maintenance Release
+
+* Wed Aug 12 2020 Remi Collet <remi@remirepo.net> - 5.5-1
+- WordPress 5.5 “Eckstine”
+- requires php-phpmailer6 instead of old php-PHPMailer
+
+* Thu Jun 11 2020 Remi Collet <remi@remirepo.net> - 5.4.2-1
+- WordPress 5.4.2 Security and Maintenance Release
+
+* Thu Apr 30 2020 Remi Collet <remi@remirepo.net> - 5.4.1-1
+- WordPress 5.4.1 Security and Maintenance Release
+
+* Wed Apr  1 2020 Remi Collet <remi@remirepo.net> - 5.4-1
+- WordPress 5.4 “Adderley”
+
 * Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 5.3.2-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild