Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[bitnami/wordpress] Add env var to disable XML-RPC #51077

Merged
merged 8 commits into from
Nov 16, 2023
Merged

[bitnami/wordpress] Add env var to disable XML-RPC #51077

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
ffb3d90
Add configuration for Wordpress XML-RPC endpoint
kimdre Oct 4, 2023
d53c6a1
Move htaccess_file var computation to function
kimdre Oct 17, 2023
44d252d
Remove unneeded function argument
kimdre Oct 17, 2023
bcf359e
Add XML-RPC disable for wordpress-nginx
kimdre Oct 28, 2023
f64bb46
Move XML-RPC function for apache wordpress to server config to be sim…
kimdre Oct 28, 2023
c8a9866
Fix broken command
kimdre Oct 28, 2023
2dcc329
Remove comments
kimdre Oct 28, 2023
9649be4
Change `WORDPRESS_ENABLE_XML_RPC` default value to `no`
kimdre Nov 13, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions bitnami/wordpress-nginx/6/debian-11/rootfs/opt/bitnami/scripts/libwordpress.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,7 @@ wordpress_validate() {
check_yes_no_value "WORDPRESS_SKIP_BOOTSTRAP"
check_multi_value "WORDPRESS_AUTO_UPDATE_LEVEL" "major minor none"
check_yes_no_value "WORDPRESS_ENABLE_REVERSE_PROXY"
check_yes_no_value "WORDPRESS_ENABLE_XML_RPC"

# Multisite validations
check_yes_no_value "WORDPRESS_ENABLE_MULTISITE"
Expand Down Expand Up @@ -726,6 +727,12 @@ wordpress_generate_web_server_configuration() {
error "Unknown WordPress Multisite network mode"
return 1
fi

if ! is_boolean_yes "$WORDPRESS_ENABLE_XML_RPC"; then
apache_config+=$'\n'"$(render-template "${template_dir}/apache-wordpress-disable-xml-rpc.tpl")"
nginx_config+=$'\n'"$(render-template "${template_dir}/nginx-wordpress-disable-xml-rpc.tpl")"
fi

web_server_config_create_flags+=("--apache-extra-directory-configuration" "$apache_config" "--nginx-additional-configuration" "$nginx_config")
[[ -n "$nginx_external_config" ]] && web_server_config_create_flags+=("--nginx-external-configuration" "$nginx_external_config")
ensure_web_server_app_configuration_exists "wordpress" --type "php" "${web_server_config_create_flags[@]}"
Expand Down
2 changes: 2 additions & 0 deletions bitnami/wordpress-nginx/6/debian-11/rootfs/opt/bitnami/scripts/wordpress-env.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,7 @@ wordpress_env_vars=(
WORDPRESS_LOGGED_IN_SALT
WORDPRESS_NONCE_SALT
WORDPRESS_ENABLE_REVERSE_PROXY
WORDPRESS_ENABLE_XML_RPC
WORDPRESS_USERNAME
WORDPRESS_PASSWORD
WORDPRESS_EMAIL
Expand Down Expand Up @@ -144,6 +145,7 @@ export WORDPRESS_SECURE_AUTH_SALT="${WORDPRESS_SECURE_AUTH_SALT:-}"
export WORDPRESS_LOGGED_IN_SALT="${WORDPRESS_LOGGED_IN_SALT:-}"
export WORDPRESS_NONCE_SALT="${WORDPRESS_NONCE_SALT:-}"
export WORDPRESS_ENABLE_REVERSE_PROXY="${WORDPRESS_ENABLE_REVERSE_PROXY:-no}" # only used during the first initialization
export WORDPRESS_ENABLE_XML_RPC="${WORDPRESS_ENABLE_XML_RPC:-no}"

# WordPress credentials
export WORDPRESS_USERNAME="${WORDPRESS_USERNAME:-user}" # only used during the first initialization
Expand Down
8 changes: 8 additions & 0 deletions ...otfs/opt/bitnami/scripts/wordpress/bitnami-templates/apache-wordpress-disable-xml-rpc.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
# BEGIN Disable WordPress XML-RPC endpoint
# Disable the outdated WordPress XML-RPC endpoint to prevent security vulnerabilities.
# https://github.com/bitnami/containers/pull/51077
<Files xmlrpc.php>
Order Allow,Deny
Deny from all
</Files>
# END Disable WordPress XML-RPC endpoint
7 changes: 7 additions & 0 deletions ...ootfs/opt/bitnami/scripts/wordpress/bitnami-templates/nginx-wordpress-disable-xml-rpc.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
# BEGIN Disable WordPress XML-RPC endpoint
# Disable the outdated WordPress XML-RPC endpoint to prevent security vulnerabilities.
# https://github.com/bitnami/containers/pull/51077
location = /xmlrpc.php {
deny all;
}
# END Disable WordPress XML-RPC endpoint
1 change: 1 addition & 0 deletions bitnami/wordpress-nginx/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -240,6 +240,7 @@ Available environment variables:
- `WORDPRESS_SKIP_BOOTSTRAP`: Skip the WordPress installation wizard. This is necessary when providing a database with existing WordPress data. Default: **no**
- `WORDPRESS_AUTO_UPDATE_LEVEL`: Level of auto-updates to allow for the WordPress core installation. Valid values: `major`, `minor`, `none`. Default: **none**
- `WORDPRESS_ENABLE_REVERSE_PROXY`: Enable WordPress support for reverse proxy headers. Default: **no**
- `WORDPRESS_ENABLE_XML_RPC`: Enable the WordPress XML-RPC endpoint. Default: **no**

#### Multisite configuration

Expand Down
7 changes: 7 additions & 0 deletions bitnami/wordpress/6/debian-11/rootfs/opt/bitnami/scripts/libwordpress.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,7 @@ wordpress_validate() {
check_yes_no_value "WORDPRESS_SKIP_BOOTSTRAP"
check_multi_value "WORDPRESS_AUTO_UPDATE_LEVEL" "major minor none"
check_yes_no_value "WORDPRESS_ENABLE_REVERSE_PROXY"
check_yes_no_value "WORDPRESS_ENABLE_XML_RPC"

# Multisite validations
check_yes_no_value "WORDPRESS_ENABLE_MULTISITE"
Expand Down Expand Up @@ -726,6 +727,12 @@ wordpress_generate_web_server_configuration() {
error "Unknown WordPress Multisite network mode"
return 1
fi

if ! is_boolean_yes "$WORDPRESS_ENABLE_XML_RPC"; then
apache_config+=$'\n'"$(render-template "${template_dir}/apache-wordpress-disable-xml-rpc.tpl")"
nginx_config+=$'\n'"$(render-template "${template_dir}/nginx-wordpress-disable-xml-rpc.tpl")"
fi

web_server_config_create_flags+=("--apache-extra-directory-configuration" "$apache_config" "--nginx-additional-configuration" "$nginx_config")
[[ -n "$nginx_external_config" ]] && web_server_config_create_flags+=("--nginx-external-configuration" "$nginx_external_config")
ensure_web_server_app_configuration_exists "wordpress" --type "php" "${web_server_config_create_flags[@]}"
Expand Down
2 changes: 2 additions & 0 deletions bitnami/wordpress/6/debian-11/rootfs/opt/bitnami/scripts/wordpress-env.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,7 @@ wordpress_env_vars=(
WORDPRESS_LOGGED_IN_SALT
WORDPRESS_NONCE_SALT
WORDPRESS_ENABLE_REVERSE_PROXY
WORDPRESS_ENABLE_XML_RPC
WORDPRESS_USERNAME
WORDPRESS_PASSWORD
WORDPRESS_EMAIL
Expand Down Expand Up @@ -144,6 +145,7 @@ export WORDPRESS_SECURE_AUTH_SALT="${WORDPRESS_SECURE_AUTH_SALT:-}"
export WORDPRESS_LOGGED_IN_SALT="${WORDPRESS_LOGGED_IN_SALT:-}"
export WORDPRESS_NONCE_SALT="${WORDPRESS_NONCE_SALT:-}"
export WORDPRESS_ENABLE_REVERSE_PROXY="${WORDPRESS_ENABLE_REVERSE_PROXY:-no}" # only used during the first initialization
export WORDPRESS_ENABLE_XML_RPC="${WORDPRESS_ENABLE_XML_RPC:-no}"

# WordPress credentials
export WORDPRESS_USERNAME="${WORDPRESS_USERNAME:-user}" # only used during the first initialization
Expand Down
8 changes: 8 additions & 0 deletions ...otfs/opt/bitnami/scripts/wordpress/bitnami-templates/apache-wordpress-disable-xml-rpc.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
# BEGIN Disable WordPress XML-RPC endpoint
# Disable the outdated WordPress XML-RPC endpoint to prevent security vulnerabilities.
# https://github.com/bitnami/containers/pull/51077
<Files xmlrpc.php>
Order Allow,Deny
Deny from all
</Files>
# END Disable WordPress XML-RPC endpoint
7 changes: 7 additions & 0 deletions ...ootfs/opt/bitnami/scripts/wordpress/bitnami-templates/nginx-wordpress-disable-xml-rpc.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
# BEGIN Disable WordPress XML-RPC endpoint
# Disable the outdated WordPress XML-RPC endpoint to prevent security vulnerabilities.
# https://github.com/bitnami/containers/pull/51077
location = /xmlrpc.php {
deny all;
}
# END Disable WordPress XML-RPC endpoint
1 change: 1 addition & 0 deletions bitnami/wordpress/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -246,6 +246,7 @@ Available environment variables:
- `WORDPRESS_SKIP_BOOTSTRAP`: Skip the WordPress installation wizard. This is necessary when providing a database with existing WordPress data. Default: **no**
- `WORDPRESS_AUTO_UPDATE_LEVEL`: Level of auto-updates to allow for the WordPress core installation. Valid values: `major`, `minor`, `none`. Default: **none**
- `WORDPRESS_ENABLE_REVERSE_PROXY`: Enable WordPress support for reverse proxy headers. Default: **no**
- `WORDPRESS_ENABLE_XML_RPC`: Enable the WordPress XML-RPC endpoint. Default: **no**

#### Salt and keys configuration

Expand Down
Loading