chore: publish 3.0.0+7.0.0 release

Reviewed-on: #57

abra.sh

@@ -1,8 +1,8 @@
 export PHP_UPLOADS_CONF_VERSION=v4
-export ENTRYPOINT_CONF_VERSION=v8
+export ENTRYPOINT_CONF_VERSION=v9
 export ENTRYPOINT_MAILRELAY_CONF_VERSION=v2
 export MSMTP_CONF_VERSION=v4
-export HTACCESS_CONF_VERSION=v5
+export HTACCESS_CONF_VERSION=v3
 export USERS_CONF_VERSION=v1
 
 wp() {
@@ -107,10 +107,3 @@ fix_mysql() {
 show_plugins() {
   wp "plugin list --fields=name,status,wporg_status,version,update_version,auto_update,tested_up_to,wporg_last_updated"
 }
-
-rotate_db_pass() {
-  DB_PASS=$(cat /run/secrets/db_password)
-  DB_ROOT_PASS=$(cat /run/secrets/db_root_password)
-  echo "ALTER USER 'root'@'localhost' IDENTIFIED BY '${DB_ROOT_PASS}'; ALTER USER 'root'@'%' IDENTIFIED BY '${DB_ROOT_PASS}'; ALTER USER 'wordpress'@'%' IDENTIFIED BY '${DB_PASS}'; FLUSH PRIVILEGES;" | mariadb -u root --skip-password 2>/dev/null \
-    || echo "ALTER USER 'root'@'localhost' IDENTIFIED BY '${DB_ROOT_PASS}'; ALTER USER 'root'@'%' IDENTIFIED BY '${DB_ROOT_PASS}'; ALTER USER 'wordpress'@'%' IDENTIFIED BY '${DB_PASS}'; FLUSH PRIVILEGES;" | mariadb -u root -p"${DB_ROOT_PASS}"
-}

compose.selfmanaged.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: "wordpress:latest"
+    image: "wordpress:7.0.0"
     volumes:
       - "wordpress:/var/www/html/"
     environment:

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: "wordpress:6.9.5"
+    image: "wordpress:7.0.0"
     volumes:
       - "wordpress_content:/var/www/html/wp-content/"
     networks:
@@ -62,10 +62,10 @@ services:
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.replacement=https://${DOMAIN}/$${2}"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.permanent=true"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
-        - "coop-cloud.${STACK_NAME}.version=2.19.5+6.9.5"
+        - "coop-cloud.${STACK_NAME}.version=3.0.0+7.0.0"
 
   db:
-    image: "mariadb:12.2"
+    image: "mariadb:12.3"
     volumes:
       - "mariadb:/var/lib/mysql"
     networks:

entrypoint.sh.tmpl

@@ -52,9 +52,10 @@ if [ ! -f "$UPLOADS_HTACCESS" ]; then
     Require all denied
 </FilesMatch>
 EOF
-    chown www-data:www-data "$UPLOADS_HTACCESS"
 fi
 
+chown -R www-data:www-data /var/www/html/wp-content/uploads/
+
 if [ -n "$@" ]; then
 	"$@"
 fi

htaccess.tmpl

@@ -3,11 +3,6 @@
     Require all denied
 </FilesMatch>
 
-# Block XML-RPC
-<Files xmlrpc.php>
-    Require all denied
-</Files>
-
 {{ if eq (env "MULTISITE") "" -}}
 # BEGIN WordPress
 
@@ -64,4 +59,4 @@ RewriteRule ^(.*\.php)$ $1 [L]
 RewriteRule . index.php [L]
 
 # END WordPress Multisite
-{{- end }}
+{{- end }}

release/2.19.3+6.9.4

@@ -1 +0,0 @@
-patch to block XML-RPC via htaccess

release/2.19.4+6.9.4

@@ -1 +0,0 @@
-temporarily block rest api against wp2shell CVE

release/3.0.0+7.0.0

@@ -0,0 +1,6 @@
+- WordPress upgraded from 6.9.4 to 7.0 (major! test before deploying)
+- MariaDB upgraded from 10.x to 11.4 (major! SSL now enabled by default)
+- ENTRYPOINT_CONF_VERSION bumped to v9
+- Breaking: MariaDB 11.4 enables SSL by default — if clients don't support SSL, add --disable-ssl to db command
+- Breaking: WordPress 7.0 introduces new AI features and admin theme changes
+- Backup database and files before upgrading