Quick news

Drupalcon Copenhagen 2010

Drupal coder: writing a Drupal XML-RPC service

Submitted by fgm on Sat, 2005-12-17 17:05

XML-RPC is a very simple RPC service, but it may not be obvious how to provide it from Drupal. Here's how.

The API reference about XML-RPC within Drupal is fairly extensive, but with no clear README starting point, and may leave a very unwarranted an impression of complexity, although it is actually very simple to write XML-RPC services in Drupal, as chx explained on #drupal recently.

Here is the shortest XML-RPC server you can create in Drupal:

<?php
function rpc_xmlrpc()
  {
  return array ( 'drupal.info'  => drupal_info ) ;
  }
?>

This one-liner is all you need for a minimal server! Now take the usual install steps:

  1. Save this as rpc.module
  2. Upload it to <drupal>/modules/rpc.module or <drupal>/modules/rpc/rpc.module
  3. Go to /admin/modules and enable the new, title-less, module
  4. You now have a working XML-RPC server ready to return an XML-RPC array with two elements. See function drupal_info() in drupal.module for the details.

You'll find more details in the API spec for hook_xmlrpc().

A word of warning

With all this simplicity comes a risk factor. Your RPC server will run just like any other module code, without builtin security checks like regular web pages, under whichever user account your module chooses (or anonymously if you don't choose one).

This means that you must at all costs include security checks in your new server module if you want it to access any data, otherwise you're ready to be exploited.

For the (rather common) EAI situation where RPC calls will be coming from just one IP address, limiting access to that address provides a good first level of protection without undue complexity. Here is an improved version of our small module, for Drupal 4.7:

<?php
/**
* Provide a few help tips
*/
function rpc_help($section)
  {
  switch ($section)
    {
    case 'admin/modules#name':
      $ret = 'Foo XML-RPC module' ; break ;
    case 'admin/modules#description':
      $ret = 'Module enabling integration with the Foo client' ; break ;
    case 'admin/help#rpc':
      $ret =  'Help for the Foo XML-RPC module' ; break ;
    }
  return $ret ;
  }
 
/**
* Define a drupal setting for the allowed IP address
*/
function rpc_settings()
  {
  $form['rpc_allowed_ip'] = array
    (
    '#type'          => 'textfield',
    '#title'         => t('Allowed IP address in canonical format'),
    '#default_value' => variable_get('rpc_allowed_ip', '127.0.0.1'),
    '#size'          => 15,
    '#maxlength'     => 15,
    '#description' => t('RPC calls to this module from any other IP will be rejected. ')
      . t('This does NOT affect other XML-RPC modules')
    );

  return $form ;
  }

/**
* Implementation of hook_xmlrpc
*/
function rpc_xmlrpc()
  {
  $ret = array (
    'drupal.info'    => drupal_info);

  if (variable_get('rpc_allowed_ip', '') != $_SERVER['REMOTE_ADDR'])
    {
    foreach ($ret as $methodname => $methodfun)
      { $ret[$methodname] = _rpc_ip_ban; }
    }

  return $ret ;
  }

/**
* Return an error message.
*/
function _rpc_ip_ban()
  {
  return t("This address is not allowed to access this RPC service");
  } 
?>

The nice trick is the use of the foreach loop on $ret, which remaps the method pointers to an error function from within just one hook, without having to install safety checks anywhere in the actual code performing the work with Drupal work. This could of course be much diversified, for a variety of access conditions.

Tagged for , , , .

XML-RPC Tutorial ?

Submitted by Steve (not verified) on Tue, 2006-06-20 17:00.

I'm breaking into developing for drupal/php. I understand what you're doing but in the context of the whole drupal api I agree about the information overload and no start page. Can you recommend a site or link with a more thorough tutorial for creating xml-rpc calls in drupal? Are there other ways to interface drupal with outside services other than xml-rpc or soap? Thanks

@IP : 70.91.81.142

Tutorial is here

Submitted by fgm on Tue, 2006-06-20 21:03.

Thanks for your comment. I found no such info on drupal.org myself, which is why I posted this tip here, when I was finally ready to admit it was that simple.

Actually, once you understand the first paragraph on the post, you're good to go, as long as you are developing XML-RPC server functionality within Drupal. Client functionality is built within PHP in most configurations anyway, and most XML-RPC related functions within Drupal are only there for Drupal core itself.

But it never hurts to type xmlrpc in the search form on api.drupal.org.

Are you for hire?

Submitted by TDave (not verified) on Fri, 2007-07-06 07:05.
I found your site from a drupal search about a scraper module. Are you for hire? Thanks, Trai Davenport

Paid support

Submitted by fgm on Sun, 2007-07-08 21:43.

Yes indeed, OSInet provides paid support and development for Drupal, including by me.

For whomever is looking for custom module development or support around Drupal, please contact OSInet at sales [at] osinet.fr or use the french contact form, and we'll get in touch directly with you: I'd rather not mix this, my personal blog, with company business questions.

I've been doing some looking

Submitted by Jeremiah (not verified) on Tue, 2008-09-30 01:33.

I've been doing some looking into xml-rpc and drupal, and I stumbled across this post.

It seems that everything I have found is geared towards using drupal as the database. Is it possible to use xml-rpc and drupal to pull live information out of another database? Or am I misunderstanding the point of xml-rpc?

If this is possible, are there any resources you could point me to?

Thanks!

Great tip, by the way.

XML-RPC is not Drupal-related

Submitted by fgm on Tue, 2008-09-30 09:21.

Hi Jeremiah,

This post shows how to provide a service over XML-RPC to clients, which can themselves be written in just about anything. As you can see, it is not related to the database features, but of course can use it since the functions are in a module.

It is also possible to use XML-RPC within Drupal as a client but, again, this is in no way database-related: the client and server have to agree on predefined functions which will be made available remotely. Typically, these are at a higher abstraction level than database access, and have to implement access control, since Drupal does not use any form of in-database access control after the connection: all code can access all tables in the Drupal DB.

Note that it is (a little bit) less simple to write clients than servers.

How to invoke the referred xml-rpc procedure?

Submitted by Carlos (not verified) on Thu, 2009-09-10 11:58.

Hi, I had just found your info about xml-rpc module, but I am afraid I am not sure how would I consume/invoke this server.

Does it have any URL I should get from or post to?
How do I invoke it?, which xml I need to post to it?

Regards

Accessing a Drupal XML-RPC service

Submitted by fgm on Sun, 2009-09-13 14:23.

Once you installed this module on your server, it will be available to any XML-RPC client, at the endpoint (example): http://www.example.com/xmlrpc.php and using the method name drupal.info.

You can then invoke the method with the XML-RPC client library of your choice, or create your own: it's just a matter of serializing the data and POSTing them over HTTP.

You can find several examples of how to implement a PHP XML-RPC client to a Drupal XML-RPC service on the PHP-GTK community site at: http://php-gtk.eu/site/geo-nick, with 4 different client implementations of a client to the same XML-RPC service. These are built in PHP-GTK, but it doesn't change anything to the XML-RPC part, just the UI.