-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[bitnami/wordpress] Add env var to disable XML-RPC #51077
Conversation
Signed-off-by: Kim Oliver Drechsel <kim@drechsel.xyz>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for your PR! I left you some comments as a review, could you please check them?
bitnami/wordpress/6/debian-11/rootfs/opt/bitnami/scripts/libwordpress.sh
Outdated
Show resolved
Hide resolved
bitnami/wordpress/6/debian-11/rootfs/opt/bitnami/scripts/libwordpress.sh
Outdated
Show resolved
Hide resolved
Signed-off-by: Kim Oliver Drechsel <kim@drechsel.xyz>
Signed-off-by: Kim Oliver Drechsel <kim@drechsel.xyz>
Signed-off-by: Kim Oliver Drechsel <kim@drechsel.xyz>
…iliar to wordpress-nginx Signed-off-by: Kim Oliver Drechsel <kim@drechsel.xyz>
Signed-off-by: Kim Oliver Drechsel <kim@drechsel.xyz>
Signed-off-by: Kim Oliver Drechsel <kim@drechsel.xyz>
Now both the Apache and Nginx images support this option and use the same code. This also has the advantage that the option is no longer static in the .htaccess configuration, but can now be toggled by changing the environment variable value and a container restart. |
This Pull Request has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thank you for your contribution. |
@joancafom Could you please check the latest changes to my PR if you have time? :) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you so much for your contribution, the approach you followed was brilliant! I added a small comment, could you please take a look at it when you have a chance? 😁
Signed-off-by: Kim Oliver Drechsel <kim@drechsel.xyz>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM! Thanks for your changes 🚀
Description of the change
This PR implements a new environment variable to the (Apache) Wordpress image called
WORDPRESS_ENABLE_XML_RPC
, that lets you disable/block access to the Wordpress XML-RPC endpoint atxmlrpc.php
, as this endpoint is deprecated in favor of the now used Wordpress Rest API and may have security vulnerabilities.The current best-practice is to disable access to it alltogether if you don't need it, so you should have the abillity to do so in my opinion.
To disable access to the XML-RPC endpoint you can set
WORDPRESS_ENABLE_XML_RPC=no
.This will create a new htaccess rule when WordPress is initialized:
Benefits
By blocking the XML-RPC endpoint you now have one thing less to worry about as a site administrator.
There are also some plugins that do the same, or you could use a filter in the child theme. However, for me, using the htaccess file is the best and safest approach.
Possible drawbacks
Blocking the endpoint could cause problems for users who still use it for access through third-party software.
However, the endpoint has long been deprecated, so further use is already discouraged and it will likely be removed altogether somewhere in the future.
Applicable issues