5

How is xmlrpc.php from Drupal core affecting functionality?

Given the fact that a vulnerability was discovered for it, details in this article

  • is it safe to remove xmlrpc.php file?

  • Is it bad practice? If so, why?

  • Is there any way to neutralize this security risk without removing this file?

Improve this question

1 Answer 1

Reset to default
6

is it safe to remove xmlrpc.php file?

Yes, if you're not expecting anyone to use it.

Is it bad practice? If so, why?

Could be construed as such; any change to core creates an additional step when updating (I'm sure we're all aware of the dangers of 'hacking core' by now, but if not: Never Hack Core).

Is there any way to neutralize this security risk without removing this file?

Update your core to 7.31, where the vulnerability has been fixed.

Improve this answer
4
  • Thank you for your answer, I am well aware that hacking core is something to be avoided, and I know you should take extra measures when updating. One thing I forgot to ask is, if that file is removed, will it solve the security threat?
    – Dragos Damian
    Aug 7, 2014 at 18:14
  • As far as I'm aware the vulnerability was only in that file, so yes, getting rid of it should solve the problem
    – Clive ♦
    Aug 8, 2014 at 16:11
  • Actually strike that, other files have also changed related to the limit for ddos - so upgrading is the safest option
    – Clive ♦
    Aug 12, 2014 at 14:03
  • Removing xmlrpc.php and ditching some .txt files is less hacky than actually changing robots.txt and .htaccess, which I often find necessary already in moderately complex projects.
    – the
    Sep 17, 2014 at 12:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.