[pkgsrc/trunk]: pkgsrc/www/wordpress Security and maintenance update to versi...

[morr <morr%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/dddbd5a197a3
branches:  trunk
changeset: 441330:dddbd5a197a3
user:      morr <morr%pkgsrc.org@localhost>
date:      Sun Nov 01 15:06:08 2020 +0000

description:
Security and maintenance update to version 5.5.3.

5.5.3:

This maintenance release fixes an issue introduced in WordPress 5.5.2
which makes it impossible to install WordPress on a brand new website
that does not have an existing database connection configuration.
This release does not affect sites where a database connection is
already configured, for example, via one-click installers or
an existing wp-config.php file.

5.5.2:

Security updates:
- Props to Alex Concha of the WordPress Security Team for their work in hardening deserialization requests.
- Props to David Binovec on a fix to disable spam embeds from disabled sites on a multisite network.
- Thanks to Marc Montas from Sucuri for reporting an issue that could lead to XSS from global variables.
- Thanks to Justin Tran who reported an issue surrounding privilege escalation in XML-RPC. He also found and disclosed an issue around privilege escalation around post commenting via XML-RPC.
- Props to Omar Ganiev who reported a method where a DoS attack could lead to RCE.
- Thanks to Karim El Ouerghemmi from RIPS who disclosed a method to store XSS in post slugs.
- Thanks to Slavco for reporting, and confirmation from Karim El Ouerghemmi, a method to bypass protected meta that could lead to arbitrary file deletion.
- And a special thanks to @zieladam who was integral in many of the releases and patches during this release.

Maintenance updates:
#51130 Events displayed in venue timezone instead of user’s
#51659 Update Gutenberg Dependencies for WordPress 5.5.2
#50861 Remove Facebook and Instagram as an oEmbed Source
#50903 Set the local environment to a development environment type by default
#50949 Posts show wrong time when user is in a different time zone than the site’s
#51053 Video Embeds set to align left disappear in Gutenberg editor
#51175 Wrong reply box title
#51219 Theme editor page showing undefined variable notice
#51251 Fix PHP notice when opening the edit image popup
#51263 PHP warning when editing comments in the administration comment edit screen
#51320 PHP Notice while moving post to trash (post_type has 2 registered taxonomies both with default_term set)
#51400 Undefined index during automatic plugin/theme updates
#51595 Unable to make anonymous comments via XML-RPC
#51645 Undefined index: echo in core files

diffstat:

 www/wordpress/Makefile |   4 ++--
 www/wordpress/distinfo |  10 +++++-----
 2 files changed, 7 insertions(+), 7 deletions(-)

diffs (28 lines):

diff -r 8f667f775d2e -r dddbd5a197a3 www/wordpress/Makefile
--- a/www/wordpress/Makefile    Sun Nov 01 14:54:45 2020 +0000
+++ b/www/wordpress/Makefile    Sun Nov 01 15:06:08 2020 +0000
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.94 2020/09/19 12:29:15 morr Exp $
+# $NetBSD: Makefile,v 1.95 2020/11/01 15:06:08 morr Exp $
 
 DISTNAME=              wordpress-${VERSION}
-VERSION=               5.5.1
+VERSION=               5.5.3
 CATEGORIES=            www
 MASTER_SITES=          https://wordpress.org/
 
diff -r 8f667f775d2e -r dddbd5a197a3 www/wordpress/distinfo
--- a/www/wordpress/distinfo    Sun Nov 01 14:54:45 2020 +0000
+++ b/www/wordpress/distinfo    Sun Nov 01 15:06:08 2020 +0000
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.76 2020/09/19 12:29:15 morr Exp $
+$NetBSD: distinfo,v 1.77 2020/11/01 15:06:08 morr Exp $
 
-SHA1 (wordpress-5.5.1.tar.gz) = d3316a4ffff2a12cf92fde8bfdd1ff8691e41931
-RMD160 (wordpress-5.5.1.tar.gz) = 3bf7930b3faa21a0f88395942b899c7397eeac68
-SHA512 (wordpress-5.5.1.tar.gz) = 11285e6e776756185814cde905986ce01f586d159fb06de5d16463cec544c8b3b85a695af51e9de71cbcd79f039ed8f6da233a8e82f5ee797d5124983b6ff0d3
-Size (wordpress-5.5.1.tar.gz) = 12983648 bytes
+SHA1 (wordpress-5.5.3.tar.gz) = 61015720c679a6cbf9ad51701f0f3fedb51b3273
+RMD160 (wordpress-5.5.3.tar.gz) = 88e39d79ce49bb4be5a85d97aa1ced5780844d01
+SHA512 (wordpress-5.5.3.tar.gz) = acc96987e792c85f1a1e4fbc434dc10e6c648ba51d0239354d8ee398604db90c6dfa075b565ddb4ab15cb36d9e06095c93ce30027b3cb61b04ffe5986069da03
+Size (wordpress-5.5.3.tar.gz) = 12987499 bytes