Merge branch 'master' into stable

Author: gau1991

CHANGELOG.txt

@@ -1,3 +1,6 @@
+v 3.1.4 - May 7, 2015
+- Fixed XSS Vulnerability found in some WordPress themes and plugins
+
 v 3.1.3 - May 6, 2015
 - EasyEngine now fixes missing GPG keys automatically, fixes #470
 - Fixed Nginx hash bucket issue, fixes #449

ee/cli/templates/locations.mustache

@@ -33,8 +33,8 @@ location ~* ^.+\.(bak|log|old|orig|original|php#|php~|php_bak|save|swo|swp|sql)$
   access_log off;
   log_not_found off;
 }
-# Return 403 forbidden for readme.(txt|html) or license.(txt|html)
-if ($request_uri ~* "^.+(readme|license)\.(txt|html)$") {
+# Return 403 forbidden for readme.(txt|html) or license.(txt|html) or example.(txt|html)
+if ($request_uri ~* "^.+(readme|license|example)\.(txt|html)$") {
   return 403;
 }
 # Status pages

ee/core/variables.py

@@ -12,7 +12,7 @@ class EEVariables():
     """Intialization of core variables"""
 
     # EasyEngine version
-    ee_version = "3.1.3"
+    ee_version = "3.1.4"
 
     # EasyEngine packages versions
     ee_wp_cli = "0.19.0"

install

@@ -48,7 +48,7 @@ fi
 # Define variables for later use
 ee_branch=$1
 readonly ee_version_old="2.2.3"
-readonly ee_version_new="3.1.3"
+readonly ee_version_new="3.1.4"
 readonly ee_log_dir=/var/log/ee/
 readonly ee_install_log=/var/log/ee/install.log
 readonly ee_linux_distro=$(lsb_release -i | awk '{print $3}')
@@ -305,6 +305,14 @@ function ee_update_latest()
     if [ $? -eq 0 ]; then
         update-rc.d hhvm defaults &>> /dev/null
     fi
+
+    # Fix WordPress example.html issue
+    # Ref: http://wptavern.com/xss-vulnerability-in-jetpack-and-the-twenty-fifteen-default-theme-affects-millions-of-wordpress-users
+    dpkg --get-selections | grep -v deinstall | grep nginx &>> /dev/null
+    if [ $? -eq 0 ]; then
+        cp /usr/lib/ee/templates/locations.mustache /etc/nginx/common/locations.conf &>> /dev/null
+    fi
+
 }
 
 # Do git intialisation
@@ -361,8 +369,8 @@ else
             ee_install_dep | tee -ai $ee_install_log
             ee_sync_db 2&>>1 $EE_INSTALL_LOG
             secure_ee_db | tee -ai $EE_INSTALL_LOG
-            ee_update_latest | tee -ai $ee_install_log
             ee_install | tee -ai $ee_install_log
+            ee_update_latest | tee -ai $ee_install_log
             ee_git_init | tee -ai $ee_install_log
             service nginx reload &>> /dev/null
             service php5-fpm restart &>> /dev/null

setup.py

@@ -54,7 +54,7 @@
     os.system("git config --global user.email {0}".format(ee_email))
 
 setup(name='ee',
-      version='3.1.3',
+      version='3.1.4',
       description=long_description,
       long_description=long_description,
       classifiers=[],