Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[bitnami/wordpress] Add env var to disable XML-RPC #51077

Merged
merged 8 commits into from
Nov 16, 2023
Merged

Conversation

kimdre
Copy link
Contributor

@kimdre kimdre commented Oct 4, 2023

Description of the change

This PR implements a new environment variable to the (Apache) Wordpress image called WORDPRESS_ENABLE_XML_RPC, that lets you disable/block access to the Wordpress XML-RPC endpoint at xmlrpc.php, as this endpoint is deprecated in favor of the now used Wordpress Rest API and may have security vulnerabilities.
The current best-practice is to disable access to it alltogether if you don't need it, so you should have the abillity to do so in my opinion.

To disable access to the XML-RPC endpoint you can set WORDPRESS_ENABLE_XML_RPC=no.
This will create a new htaccess rule when WordPress is initialized:

# Disable the oudated WordPress XML-RPC endpoint to prevent security vulnerabilities.
<Files xmlrpc.php>
Order Allow,Deny
Deny from all
</Files>

Benefits

By blocking the XML-RPC endpoint you now have one thing less to worry about as a site administrator.
There are also some plugins that do the same, or you could use a filter in the child theme. However, for me, using the htaccess file is the best and safest approach.

Possible drawbacks

Blocking the endpoint could cause problems for users who still use it for access through third-party software.
However, the endpoint has long been deprecated, so further use is already discouraged and it will likely be removed altogether somewhere in the future.

Applicable issues

Signed-off-by: Kim Oliver Drechsel <kim@drechsel.xyz>
@github-actions github-actions bot added the triage Triage is needed label Oct 4, 2023
@carrodher carrodher added the verify Execute verification workflow for these changes label Oct 4, 2023
@github-actions github-actions bot added in-progress and removed triage Triage is needed labels Oct 4, 2023
@bitnami-bot bitnami-bot removed the request for review from carrodher October 4, 2023 17:21
Copy link
Contributor

@joancafom joancafom left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for your PR! I left you some comments as a review, could you please check them?

Signed-off-by: Kim Oliver Drechsel <kim@drechsel.xyz>
Signed-off-by: Kim Oliver Drechsel <kim@drechsel.xyz>
Signed-off-by: Kim Oliver Drechsel <kim@drechsel.xyz>
…iliar to wordpress-nginx

Signed-off-by: Kim Oliver Drechsel <kim@drechsel.xyz>
Signed-off-by: Kim Oliver Drechsel <kim@drechsel.xyz>
Signed-off-by: Kim Oliver Drechsel <kim@drechsel.xyz>
@kimdre
Copy link
Contributor Author

kimdre commented Oct 28, 2023

Now both the Apache and Nginx images support this option and use the same code. This also has the advantage that the option is no longer static in the .htaccess configuration, but can now be toggled by changing the environment variable value and a container restart.

Copy link

This Pull Request has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thank you for your contribution.

@github-actions github-actions bot added the stale 15 days without activity label Nov 13, 2023
@kimdre
Copy link
Contributor Author

kimdre commented Nov 13, 2023

@joancafom Could you please check the latest changes to my PR if you have time? :)

Copy link
Contributor

@joancafom joancafom left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you so much for your contribution, the approach you followed was brilliant! I added a small comment, could you please take a look at it when you have a chance? 😁

bitnami/wordpress-nginx/README.md Outdated Show resolved Hide resolved
Signed-off-by: Kim Oliver Drechsel <kim@drechsel.xyz>
@github-actions github-actions bot removed the stale 15 days without activity label Nov 14, 2023
Copy link
Contributor

@joancafom joancafom left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! Thanks for your changes 🚀

@joancafom joancafom merged commit 3ec7424 into bitnami:main Nov 16, 2023
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
solved verify Execute verification workflow for these changes wordpress
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[bitnami/wordpress] Add env var to disable XML-RPC
3 participants