From d4f081ea189fde47f1de3a88954021b9f592867c Mon Sep 17 00:00:00 2001
From: Bitnami Bot <bitnami.bot@broadcom.com>
Date: Thu, 11 Jun 2026 10:54:17 +0200
Subject: [PATCH] [bitnami/wordpress-nginx] Release 7.0.0-debian-12-r7 (#94748)

Signed-off-by: Bitnami Bot <bitnami.bot@broadcom.com>
---
 .../wordpress-nginx/7/debian-12/Dockerfile    |  4 ++--
 .../opt/bitnami/scripts/libpersistence.sh     | 10 +++++-----
 .../opt/bitnami/scripts/libwordpress.sh       | 20 ++++++++++++-------
 3 files changed, 20 insertions(+), 14 deletions(-)

diff --git a/bitnami/wordpress-nginx/7/debian-12/Dockerfile b/bitnami/wordpress-nginx/7/debian-12/Dockerfile
index c24209fb244d..befc8402d0f8 100644
--- a/bitnami/wordpress-nginx/7/debian-12/Dockerfile
+++ b/bitnami/wordpress-nginx/7/debian-12/Dockerfile
@@ -7,7 +7,7 @@ ARG DOWNLOADS_URL="https://downloads.bitnami.com/files/stacksmith"
 ARG TARGETARCH
 
 LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \
-      org.opencontainers.image.created="2026-06-11T03:39:47Z" \
+      org.opencontainers.image.created="2026-06-11T08:34:08Z" \
       org.opencontainers.image.description="Application packaged by Broadcom, Inc." \
       org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/wordpress-nginx/README.md" \
       org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/wordpress-nginx" \
@@ -58,7 +58,7 @@ RUN /opt/bitnami/scripts/nginx-php-fpm/postunpack.sh
 RUN /opt/bitnami/scripts/wordpress/postunpack.sh
 ENV APP_VERSION="7.0.0" \
     BITNAMI_APP_NAME="wordpress-nginx" \
-    IMAGE_REVISION="6" \
+    IMAGE_REVISION="7" \
     LD_LIBRARY_PATH="/opt/bitnami/postgresql/lib" \
     NGINX_HTTPS_PORT_NUMBER="" \
     NGINX_HTTP_PORT_NUMBER="" \
diff --git a/bitnami/wordpress-nginx/7/debian-12/prebuildfs/opt/bitnami/scripts/libpersistence.sh b/bitnami/wordpress-nginx/7/debian-12/prebuildfs/opt/bitnami/scripts/libpersistence.sh
index 18445e7d27fa..833ee5ab1d65 100644
--- a/bitnami/wordpress-nginx/7/debian-12/prebuildfs/opt/bitnami/scripts/libpersistence.sh
+++ b/bitnami/wordpress-nginx/7/debian-12/prebuildfs/opt/bitnami/scripts/libpersistence.sh
@@ -39,7 +39,7 @@ persist_app() {
     fi
     pushd "$install_dir" >/dev/null || exit
     local file_to_persist_relative file_to_persist_destination file_to_persist_destination_folder
-    local -r tmp_file="/tmp/perms.acl"
+    local -r acl_file="$(mktemp "${TMPDIR:-/tmp}"/acl.XXXXXXXXXX)"
     for file_to_persist in "${files_to_persist[@]}"; do
         if [[ ! -f "$file_to_persist" && ! -d "$file_to_persist" ]]; then
             error "Cannot persist '${file_to_persist}' because it does not exist"
@@ -50,22 +50,22 @@ persist_app() {
         file_to_persist_destination_folder="$(dirname "$file_to_persist_destination")"
         # Get original permissions for existing files, which will be applied later
         # Exclude the root directory with 'sed', to avoid issues when copying the entirety of it to a volume
-        getfacl -R "$file_to_persist_relative" | sed -E '/# file: (\..+|[^.])/,$!d' > "$tmp_file"
+        getfacl -R "$file_to_persist_relative" | sed -E '/# file: (\..+|[^.])/,$!d' > "$acl_file"
         # Copy directories to the volume
         ensure_dir_exists "$file_to_persist_destination_folder"
         cp -Lr --preserve=links "$file_to_persist_relative" "$file_to_persist_destination_folder"
         # Restore permissions
         pushd "$persist_dir" >/dev/null || exit
         if am_i_root; then
-            setfacl --restore="$tmp_file"
+            setfacl --restore="$acl_file"
         else
             # When running as non-root, don't change ownership
-            setfacl --restore=<(grep -E -v '^# (owner|group):' "$tmp_file")
+            setfacl --restore=<(grep -E -v '^# (owner|group):' "$acl_file")
         fi
         popd >/dev/null || exit
     done
     popd >/dev/null || exit
-    rm -f "$tmp_file"
+    rm -f "$acl_file"
     # Install the persisted files into the installation directory, via symlinks
     restore_persisted_app "$@"
 }
diff --git a/bitnami/wordpress-nginx/7/debian-12/rootfs/opt/bitnami/scripts/libwordpress.sh b/bitnami/wordpress-nginx/7/debian-12/rootfs/opt/bitnami/scripts/libwordpress.sh
index c2adf9f55a4b..81422f4c3ce6 100644
--- a/bitnami/wordpress-nginx/7/debian-12/rootfs/opt/bitnami/scripts/libwordpress.sh
+++ b/bitnami/wordpress-nginx/7/debian-12/rootfs/opt/bitnami/scripts/libwordpress.sh
@@ -597,20 +597,26 @@ EOF
 #   None
 #########################
 wordpress_configure_reverse_proxy() {
-    wordpress_conf_append "$(
-        cat <<"EOF"
+    local xfh_condition
+    if ! is_empty_value "$WORDPRESS_HOSTNAME"; then
+        # Only accept XFH that exactly matches the configured canonical hostname
+        xfh_condition="! empty( \$_SERVER['HTTP_X_FORWARDED_HOST'] ) && strtolower( trim( \$_SERVER['HTTP_X_FORWARDED_HOST'] ) ) === strtolower( '${WORDPRESS_HOSTNAME}' )"
+    else
+        xfh_condition="! empty( \$_SERVER['HTTP_X_FORWARDED_HOST'] )"
+    fi
+    wordpress_conf_append "$(cat <<PHPEOF
 /**
  * Handle potential reverse proxy headers. Ref:
  *  - https://wordpress.org/support/article/faq-installation/#how-can-i-get-wordpress-working-when-im-behind-a-reverse-proxy
  *  - https://wordpress.org/support/article/administration-over-ssl/#using-a-reverse-proxy
  */
-if ( ! empty( $_SERVER['HTTP_X_FORWARDED_HOST'] ) ) {
-	$_SERVER['HTTP_HOST'] = $_SERVER['HTTP_X_FORWARDED_HOST'];
+if ( ${xfh_condition} ) {
+	\$_SERVER['HTTP_HOST'] = \$_SERVER['HTTP_X_FORWARDED_HOST'];
 }
-if ( ! empty( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) \&\& 'https' === $_SERVER['HTTP_X_FORWARDED_PROTO'] ) {
-	$_SERVER['HTTPS'] = 'on';
+if ( ! empty( \$_SERVER['HTTP_X_FORWARDED_PROTO'] ) \&\& 'https' === \$_SERVER['HTTP_X_FORWARDED_PROTO'] ) {
+	\$_SERVER['HTTPS'] = 'on';
 }
-EOF
+PHPEOF
     )"
 }