An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If …
Problem reports (0) · open in Bugzilla, most recently changed first
None.
Commits (232)
Xin LI (delphij) · 7.1.3,1
*/wordpress*: deprecate localized variants
Localized WordPress tarballs are regenerated in place by upstream
whenever translations are updated, so the distfile checksums keep
breaking without a version change. The language packs have the same
problem, and other distributions only ship the English core and let
WordPress download language packs on its own.
Mark the localized ports deprecated, expiring on 2026-12-31. Users
should switch to www/wordpress and choose the site language in
WordPress.
*/wordpress: update to 7.1.1
Mark chinese/wordpress-zh_CN, french/wordpress, and russian/wordpress
IGNORE as localized distfiles are not yet available upstream.
*/wordpress*: update to 7.1
chinese/wordpress-zh_TW is temporarily marked IGNORE as the localized
distfile is not yet available upstream. Also fix MASTER_SITES for zh_TW
to use tw.wordpress.org instead of cn.wordpress.org.
www/wordpress: upgrade to 7.0.4 (security)
Upstream does not offer localized tarballs for 7.0.4, so download the
7.0.3 tarballs and apply files/patch-7.0.3-to-7.0.4 instead.
*/*php86*: Sunrise
Please DO NOT use this version in production, it is an early test version.
For upgrade notes please visit:
https://github.com/php/php-src/blob/php-8.6.0alpha1/UPGRADING
Changelog: https://github.com/php/php-src/blob/php-8.6.0alpha1/NEWS
*/wordpress*: upgrade to 7.0
WordPress 7.0 "Billie" ships localized tarballs directly, so drop the
6.9.1+patch workaround and return to the clean DISTVERSION approach.
www/wordpress: upgrade to 6.9.4 (security)
Upstream does not offer localized tarballs for 6.9.4, so download the
6.9.1 tarballs and apply files/patch-6.9.1-to-6.9.4 instead.
Security fixes in 6.9.2:
- Blind SSRF
- PoP-chain weakness in HTML API and Block Registry
- Regex DoS in Numeric Character References
- Stored XSS in Nav Menus
- AJAX query-attachments Authorization Bypass
- Stored XSS via data-wp-bind directive
- XSS allowing override of client-side templates in admin area
- PclZip Path Traversal
- Authorization Bypass on Notes feature
- XXE in external getID3 library
Bug fix in 6.9.3:
- Restore compatibility for themes using stringable objects with the
template_include filter (regression introduced in 6.9.2)
Security fixes in 6.9.4 (incomplete fixes from 6.9.2 re-addressed):
- PclZip Path Traversal
- Authorization Bypass on Notes feature
- XXE in external getID3 library
*/wordpress*: Upgrade to WordPress 6.9 "Gene"
This release introduces major collaboration features, developer APIs,
and performance improvements.
Key Changes:
* Collaboration: Introduced "Notes" for block-level commenting and
feedback directly in the editor.
* Dashboard: Expanded Command Palette to support navigation and actions
across the entire admin interface.
* APIs: Added the Abilities API to standardize permissions for AI and
automation workflows.
* Design: Added "Fit text to container" typography option for Paragraph
and Heading blocks.
* Performance: Improved LCP with on-demand block styles, optimized
database queries, and refined caching.
* Accessibility: Fixed over 30 issues related to screen readers, focus
handling, and assistive tech.
* UI/UX: Enhanced visual drag-and-drop and introduce new blocks
(Accordion, Terms Query)
Release notes:
https://wordpress.org/news/2025/12/gene/
MFH: 2025Q4
www/wordpress: Fix "call to undefined function filter_var()"
WordPress needs USE_PHP=filter installed, otherwise some things will
fail complaining about "call to undefined function filter_var()".
PR: 278330
Approved by: joneum (maintainer, timeout > 1.5 years)
MFH: 2025Q4
*/wordpress*: Update 6.8.2 => 6.8.3 (with security fixes)
Security updates included in this release:
* A data exposure issue where authenticated users could access some
restricted content.
* A cross-site scripting (XSS) vulnerability requiring an authenticated
user role that affects the nav menus.
Release notes:
https://wordpress.org/news/2025/09/wordpress-6-8-3-release/
PR: 290366 288378
Approved by: joneum (maintainer)
MFH: 2025Q4
graphics/pecl-imagick: Update/bump consumers
www/nextcloud, www/piwigo and www/wordpress had some custom logic to
select the pecl-imagick port based on the default ImageMagick version.
This is now obsolete with the removal of pecl-imagick-im7 and must be
removed. As this changes dependencies, also bump PORTREVISION in these
ports.
Other consumers of pecl-imagick don't need a bump because they only use
ImageMagick through the PHP API, they don't directly link any shared
libs.
PR: 268833
Approved by: portmgr (blanket)
*/*: Remove merged or non-existent USE_PHP directives
- Remove USE_PHP=hash which is available in default php installation of
all versions of php
* security/pear-Horde_Crypt_Blowfish: Remove OPTION MHASH
- Remove USE_PHP=json which is available in default php installation of
all versions of php
* devel/pear-PHPTAL: Remove OPTION JSON
* www/ilias: Remove OPTION SCORM2004
- Remove USE_PHP=mssql which is no longer available in php from php80
and later and has been replaced with sqlsrv module which is Windows
only
* www/codeigniter: Remove OPTION MSSQL
* www/moodle311: Remove OPTION MSSQL
* www/moodle39: Remove OPTION MSSQL
* www/moodle40: Remove OPTION MSSQL
* www/moodle41: Remove OPTION MSSQL
- Remove USE_PHP=openssl which is available in default php installation
of all versions of php
* databases/phpmyadmin: Remove OPTION OPENSSL
* databases/phpmyadmin5: Remove OPTION OPENSSL
* security/pear-Horde_Crypt_Blowfish: Remove OPTION OPENSSL
* www/nextcloud: Remove OPTION SSL
* www/owncloud: Remove OPTION SSL
- Remove USE_PHP=pcre which is available in default php installation of
all versions of php
* sysutils/racktables: Remove OPTION PCRE
- Remove USE_PHP=postgresql which should be USE_PHP=pgsql and update
following ports
* www/typo3-11
* www/typo3-12
- Remove USE_PHP=pdf which is no longer available as php module
* databases/phpmyadmin: Remove OPTION PDF
- Remove USE_PHP=spl which is available in default php installation of
all versions of php
- Remove USE_PHP=sqlsrv which was never imported into FreeBSD as that is
Windows only php module
* www/typo3-11: Remove OPTION SQLSRV
* www/typo3-12: Remove OPTION SQLSRV
- Bump where DEFAULT OPTIONS are affected
Sponsored by: Bounce Experts
Approved by: portmgr(blanket)
www/wordpress: Transform into master port
* Simplify language ports
* Removes differences in pkg-message and pkg-descr
* Reduce files to manage on updates
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
*/wordpress*: Update to Version 6.0
Welcome to “Arturo”
Say hello to “Arturo” and WordPress 6.0, inspired by Grammy-winning jazz musician, Arturo O’Farrill. Known for his influence on contemporary Latin jazz, Arturo has pressed more than 15 albums spanning a body of work across five decades.
Take some time to explore WordPress 6.0, built to help you unlock your creative aspirations and make your site-building experience more intuitive. And check out some of Arturo’s inspirational sounds that span Afro Cuban jazz, contemporary Latin jazz, and so much more.
With nearly 1,000 enhancements and bug fixes, the second major release of 2022 is here. Download it now! As of today, WordPress powers more than 42% of websites worldwide.1
Site owners and administrators should upgrade to take full advantage of the many stability, performance, and usability enhancements today. WordPress content creators will enjoy a suite of new features geared toward improving the writing and designing experiences.
Full Changelog see: https://wordpress.org/news/2022/05/arturo/
Sponsored by: Netzkommune GmbH
*/wordpress*: Update to 5.8.2
For all languages:
Make the port portlint(1),portclippy(1) compliant.
For www,french,german,japanese,russian:
Fix pkg-message.in to only show upgrade message when upgrading.
For www,zh_CN,zh_TW,french,german:
Use do-install-DOCS-on for documentation.
For zh_CN,zh_TW:
Add CPE information
PR: 260013
Approved by: maintainer timeout