Dockerfile.wordpress

FROM wordpress:6-php8.2-apache

# Install wp-cli from a pinned release, verified against the sha512 published
# with that release. The previous source (the wp-cli/builds gh-pages branch)
# is a mutable path with no version and no checksum, so every image rebuild
# pulled whatever that branch happened to hold. -f makes curl fail on an HTTP
# error instead of writing the error body to disk and chmod +x'ing it.
ARG WP_CLI_VERSION=2.12.0
ARG WP_CLI_SHA512=be928f6b8ca1e8dfb9d2f4b75a13aa4aee0896f8a9a0a1c45cd5d2c98605e6172e6d014dda2e27f88c98befc16c040cbb2bd1bfa121510ea5cdf5f6a30fe8832
RUN set -eux; \
    curl -fsSL -o /tmp/wp-cli.phar \
      "https://github.com/wp-cli/wp-cli/releases/download/v${WP_CLI_VERSION}/wp-cli-${WP_CLI_VERSION}.phar"; \
    echo "${WP_CLI_SHA512}  /tmp/wp-cli.phar" | sha512sum -c -; \
    chmod +x /tmp/wp-cli.phar; \
    mv /tmp/wp-cli.phar /usr/local/bin/wp

# Apache strips the Authorization header by default -- needed for WP REST API Basic auth
RUN echo 'SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1' > /etc/apache2/conf-available/pass-authorization.conf \
    && a2enconf pass-authorization \
    && a2enmod rewrite headers

# Allow Application Passwords over HTTP (dev only -- WP requires SSL by default)
RUN mkdir -p /usr/src/wordpress/wp-content/mu-plugins \
    && echo '<?php add_filter("wp_is_application_passwords_available", "__return_true");' \
       > /usr/src/wordpress/wp-content/mu-plugins/allow-app-pw.php

# Disable wpautop / wptexturize on the_content so signed-section HTML stays
# intact. wpautop wraps loose text in <p> tags and closes them prematurely
# when it encounters a block element nested inside a custom element, which
# breaks the wrapped signed-section form used by HTMLTrust (the <article>
# child of <signed-section> ends up as a DOM sibling of the <p>-wrapped
# signed-section, empty of the signed content). The filters must be removed
# after WP core registers them, so we hook into 'init' at a late priority.
RUN printf '%s\n' \
      '<?php' \
      'add_action("init", function() {' \
      '  remove_filter("the_content", "wpautop");' \
      '  remove_filter("the_content", "wptexturize");' \
      '  remove_filter("the_content", "wp_filter_content_tags");' \
      '  remove_filter("the_content", "convert_smilies");' \
      '  remove_filter("the_content", "convert_chars");' \
      '  remove_filter("the_content", "do_blocks");' \
      '  remove_filter("the_excerpt", "wpautop");' \
      '}, 99);' \
    > /usr/src/wordpress/wp-content/mu-plugins/disable-content-filters.php