remove ftp container from selfmanaged

abra.sh

@@ -2,7 +2,7 @@ export PHP_UPLOADS_CONF_VERSION=v4
 export ENTRYPOINT_CONF_VERSION=v8
 export ENTRYPOINT_MAILRELAY_CONF_VERSION=v2
 export MSMTP_CONF_VERSION=v4
-export HTACCESS_CONF_VERSION=v5
+export HTACCESS_CONF_VERSION=v4
 export USERS_CONF_VERSION=v1
 
 wp() {
@@ -107,10 +107,3 @@ fix_mysql() {
 show_plugins() {
   wp "plugin list --fields=name,status,wporg_status,version,update_version,auto_update,tested_up_to,wporg_last_updated"
 }
-
-rotate_db_pass() {
-  DB_PASS=$(cat /run/secrets/db_password)
-  DB_ROOT_PASS=$(cat /run/secrets/db_root_password)
-  echo "ALTER USER 'root'@'localhost' IDENTIFIED BY '${DB_ROOT_PASS}'; ALTER USER 'root'@'%' IDENTIFIED BY '${DB_ROOT_PASS}'; ALTER USER 'wordpress'@'%' IDENTIFIED BY '${DB_PASS}'; FLUSH PRIVILEGES;" | mariadb -u root --skip-password 2>/dev/null \
-    || echo "ALTER USER 'root'@'localhost' IDENTIFIED BY '${DB_ROOT_PASS}'; ALTER USER 'root'@'%' IDENTIFIED BY '${DB_ROOT_PASS}'; ALTER USER 'wordpress'@'%' IDENTIFIED BY '${DB_PASS}'; FLUSH PRIVILEGES;" | mariadb -u root -p"${DB_ROOT_PASS}"
-}

compose.selfmanaged.yml

@@ -3,7 +3,6 @@ version: "3.8"
 
 services:
   app:
-    image: "wordpress:latest"
     volumes:
       - "wordpress:/var/www/html/"
     environment:
@@ -13,9 +12,9 @@ services:
         define( 'FS_METHOD', 'direct' );
         ${WORDPRESS_CONFIG_EXTRA}
 
-  ftp:
-    volumes:
-      - "wordpress:/home/ftp_user/"
+  #ftp:
+  #  volumes:
+  #    - "wordpress:/home/ftp_user/"
 
 volumes:
   wordpress:

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: "wordpress:6.9.5"
+    image: "wordpress:6.9.4"
     volumes:
       - "wordpress_content:/var/www/html/wp-content/"
     networks:
@@ -62,7 +62,7 @@ services:
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.replacement=https://${DOMAIN}/$${2}"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.permanent=true"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
-        - "coop-cloud.${STACK_NAME}.version=2.19.5+6.9.5"
+        - "coop-cloud.${STACK_NAME}.version=2.19.4+6.9.4"
 
   db:
     image: "mariadb:12.2"

htaccess.tmpl

@@ -8,6 +8,14 @@
     Require all denied
 </Files>
 
+# Block wp2shell CVE-2026-63030
+<IfModule mod_rewrite.c>
+RewriteEngine On
+RewriteCond %{QUERY_STRING} rest_route=.*/batch/v1 [NC]
+RewriteRule .* - [F,L]
+RewriteRule ^wp-json/batch/v1 - [F,L]
+</IfModule>
+
 {{ if eq (env "MULTISITE") "" -}}
 # BEGIN WordPress