block XML-RPC

abra.sh

@@ -1,5 +1,5 @@
 export PHP_UPLOADS_CONF_VERSION=v4
-export ENTRYPOINT_CONF_VERSION=v7
+export ENTRYPOINT_CONF_VERSION=v8
 export ENTRYPOINT_MAILRELAY_CONF_VERSION=v2
 export MSMTP_CONF_VERSION=v4
 export HTACCESS_CONF_VERSION=v3
@@ -42,11 +42,11 @@ core_install(){
 }
 
 enable_auto_updates(){
-  wp plugin deactivate disable-update-notifications --allow-root
-  wp plugin uninstall disable-update-notifications --allow-root
-  wp option delete disable_notification_setting --allow-root
-  wp plugin auto-updates enable --all --allow-root
-  wp theme auto-updates enable --all --allow-root
+  wp "plugin deactivate disable-update-notifications --allow-root"
+  wp "plugin uninstall disable-update-notifications --allow-root"
+  wp "option delete disable_notification_setting --allow-root"
+  wp "plugin auto-updates enable --all --allow-root"
+  wp "theme auto-updates enable --all --allow-root"
 }
 
 disable_auto_updates(){

compose.yml

@@ -62,7 +62,7 @@ services:
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.replacement=https://${DOMAIN}/$${2}"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.permanent=true"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
-        - "coop-cloud.${STACK_NAME}.version=2.19.1+6.9.4"
+        - "coop-cloud.${STACK_NAME}.version=2.19.2+6.9.4"
 
   db:
     image: "mariadb:12.2"

entrypoint.sh.tmpl

@@ -42,6 +42,19 @@ define('FORCE_SSL_ADMIN', true );
 define('COOKIE_DOMAIN', \$_SERVER['HTTP_HOST']);"
 {{ end }}
 
+
+UPLOADS_HTACCESS=/var/www/html/wp-content/uploads/.htaccess
+if [ ! -f "$UPLOADS_HTACCESS" ]; then
+    mkdir -p /var/www/html/wp-content/uploads
+    cat > "$UPLOADS_HTACCESS" <<'EOF'
+# Prevent PHP execution in uploads directory
+<FilesMatch "\.(?i:php|phtml|phar)$">
+    Require all denied
+</FilesMatch>
+EOF
+    chown www-data:www-data "$UPLOADS_HTACCESS"
+fi
+
 if [ -n "$@" ]; then
 	"$@"
 fi

htaccess.tmpl

@@ -3,13 +3,6 @@
     Require all denied
 </FilesMatch>
 
-# Prevent PHP execution in uploads directory
-<Directory /var/www/html/wp-content/uploads>
-    <FilesMatch "\.(?i:php|phtml|phar)$">
-        Require all denied
-    </FilesMatch>
-</Directory>
-
 {{ if eq (env "MULTISITE") "" -}}
 # BEGIN WordPress
 
@@ -67,3 +60,8 @@ RewriteRule . index.php [L]
 
 # END WordPress Multisite
 {{- end }}
+
+# Block XML-RPC
+<Files xmlrpc.php>
+    Require all denied
+</Files>