Can we finally put to rest the problem of the forced RSS feed? Will Drupal 6 include the ability to enable/disable RSS syndication?

After all the complaints going back to version 4, I still can't believe it's part of the core without the option to disable. I run a closed, members-only website, and I'd really rather the content not be broadcast over RSS.

Comments

GreenLED’s picture

I'm amazed that this has not been addressed. It should be as simple
as disabling a module called "RSS" or something. Almost every other
feature has this functionality. I think maybe they have setup the RSS
to be prevalent throughout the system and are trying to find all the
pieces. That is my best guess on this. I hope this gets resolved. I will
have to revert to other methods now, since I really don't like that icon
on my site. I feel like a complaining machine. We should be more
thankful for all the free functionality it DOES have. :) But, I still hope it
gets resolved.

» Respectfully, GreenLED
» Stable Files . net

mammoth’s picture

I found your post when I was looking for a way to enable my RSS. I'm not sure what went wrong but my site just doesn't have the feed. Is it supposed to be www.xxx.com/node/feed?

rrabbit’s picture

I too am building a small private community site and don't want RSS. As well as broadcasting confidential stuff, it is bound to puzzle and annoy the less net-savvy members of the community. I'm amazed there is no easy way of disabling this. With my limited knowledge, I'll have to invent some horrible bodge to stop it appearing, thus destroying Drupal's hard-won elegance.

It's a bit of a deal-breaker: it's still not too late for me to switch to a different CMS, and I might have to.

Anybody found a not-too-horrible way of killing RSS?

jp.stacey’s picture

I've just uploaded a D5 module that might help, to http://www.jpstacey.info/blog/files/drupal/modules/disable_pages.tgz .

It returns a drupal_not_found() page for requests that match a particular regular expression. You can change the regex by enabling the module and navigating to Site Configuration -> Disable Pages.

To get rid of rss.xml, you'll want "/rss.xml/" . For something like e.g. node/feed, then "/node\/feed/" should work (note the surrounding slashes, and the \ in front of the literal / in node/feed).

WARNING: specifying too generous a regex could lock down your site if you're not careful: there's a line in the module you can uncomment to reset the regex.

Would appreciate feedback.

--
J-P Stacey, software gardener, Magnetic Phield

cinephos’s picture

http://snippetsnap.com/snippets/1161-Disable-RSS-logo-in-Drupal

This link gives the solution. I tested it and it works

kerstin80’s picture

well that seems to be a nice solution. but it only removes the link to the rss feed -> the xml file still exists and so it gets indexed by search engines. this is a serious problem. and it forces me to search for another cms. bye drupal

kazgor’s picture

I too am creating a private site.. I would assume you could use HTACCESS to stop search engines indexing the site..

Would also assume if the site as no public nodes it will be fine.. as you have to login in before you get any posts.

??

ktleow’s picture

I removed the print $feed_icons; from page.tpl.php theme file and the RSS icon and feeds are disabled too. Walla?

newtoid’s picture

surely that just disables the icons?

jkmickelson’s picture

(cross-posted for other users benefit since this is the first search result for "disable RSS")

Note To Core Developers: This should be already be included in the Drupal Core

I am using the simple combination of two techniques from above:
"Turn RSS off the simple way... - dfrake - July 23, 2007"
"On second thoughts, I - menneke - July 25, 2007"

in ./modules/system/system.admin.inc, after line 1433 "function system_rss_feeds_settings() {",

I added the following lines:

  $form['feed_enabled'] = array(
      '#type' => 'checkbox',
      '#title' => t('RSS Feed enabled'),
      '#default_value' => variable_get('feed_enabled', 1),
      '#tree' => FALSE,
      '#description' => t('Check here if you want the RSS Feed to be enabled.')
    );

in ./includes/common.inc, after line 163 "static $stored_feed_links = array();",

I added the following lines:


  if (variable_get('feed_enabled', 1) != 1) {
    return $stored_feed_links;
  }

Now, go to Administer -> Content management -> RSS publishing
Uncheck "RSS Feed enabled" and click "Save configuration"

RSS Feeds are now disabled for Drupal 6.4.

Note to Drupal Users: It has been stated that no new features are being added to Drupal 6, only bugs fixes and security patches. This certainly is a security issue for one site of mine, while also being a desired feature on other sites. Hopefully, someone can get this issue recognized a security issue and get it addressed with the Core group. Thank you.

WorldFallz’s picture

i agree with the feature, but posting it here and leaving random forum notes to "drupal developers" is a complete waste of time.

Hopefully, someone can...

"someone" is us-- all of us in the community. If you feel strongly about this particular feature/request you should submit an issue to the drupal project issue queue (even better if it includes a patch) after searching to be sure there isn't one already.

===
"Give a man a fish and you feed him for a day.
Teach a man to fish and you feed him for a lifetime."
-- Lao Tzu
"God helps those who help themselves." -- Benjamin Franklin
"Search is your best friend." -- Worldfallz

jkmickelson’s picture

There are already duplicate requests on file for this functionality. Hence, the request for someone to raise the awareness of this security related issue. The earliest request I saw (and solution) was for 4.7.

I'll post a report via HOWTO: Report a security issue

Leeteq’s picture

Ref. this issue:
"Add permissions to disable RSS feeds"
http://drupal.org/node/28337

.
--
( Evaluating the long-term route for Drupal 7.x via BackdropCMS at https://www.CMX.zone )

mainebob’s picture

This is a *SECURITY ISSUE* for me, as others have mentioned...
I would hope that Drupal 6.7 has this patch... but apparently
it's not on the feature list the next drupal 6 upgrade.

In the meantime, I'll patch my own code.

BTW, I have a site that has a Public Front that can be and
wants to be seen by the world... and when logged on, it
is a PRIVATE world.

The IDEAL is RSS feed that RESPECTS permissions like
Anon, Authenticated, Admin, Mod, etc...

Thanks!

-Bob

mainebob’s picture

I took the initiative to post the Feature Request to the Drupal Project as a 6.6 request...
http://drupal.org/node/339069

David Reid answers:

Status: active » duplicate (of a 7.x request)

Please don't make a duplicate issue since 6.x and 5.x only accept bug fixes. Concentrate efforts in #28337: Add permissions to disable RSS feeds so we can get it fixed in 7.x and possibly backport to a contrib module.

Bob Replies:

Thanks Dave, AND Aren't "SECURITY" issues bugs? Doesn't it make sense to fix this for the version used by the largest number of the Drupal community (V6) so that they can benefit NOW.....and then PORT IT FORWARD to version 7 which my guess is it will be at least 6 months until it is ready for most of the community to use? -Bob

David Replies quickly (Thanks):
It's not a security issue in regards that it allows someone can hack and damage your site, it's a feature request. Unfortunately the policy is that feature requests and API changes (like this would be) can only be accepted into the development version of Drupal. This could easily be accomplished as a contrib module.

======
Bob's COMMENT

I am not at a level to be able to make a contrib module for Version 6 to accomplish what David suggests.

*** Is there anyone who is capable of making such a module?

It is true that defined as security where someone can hack my site... One could argue (unsuccessfully it seems)
that leaking PRIVATE information with all the proper permissions set to restrict is ALSO a security issue.

Thanks for letting me vent! -Bob O

jkmickelson’s picture

The instructions above for Drupal 6.4 also work with Drupal 6.6

synth3tk’s picture

I can confirm that the above 6.4 instructions also work well for 6.6, and I really don't see why the developers couldn't include this quick fix in the core, but it's their project, so whatever floats their boats.

micol72’s picture

sorry for my english...I m italian!
I've tried your code and it works really well.. but I've another problem with RSS feed. I'd like to see it on every content(pages) even with module's pages.
i've installed the module sitemap and now in the block management i find Syndicate(site map) and I see the rss feed icon only in the pages /taxonomy/term/4(number)... how can i enable it also for /node/...? any help?
is it clear?

thanks to all

not_Dries_Buytaert’s picture

I suggest, changing the code
'#description' => t('Check here if you want the RSS Feed to be enabled.')
to
'#description' => t('Check here if you want the RSS Feed to be enabled on the frontpage.')
in order clarify to admins that this option doesn't affect any other RSS-icons on the website.

ken.wakefield’s picture

Thankyou for a great solution, don't understand the code but implemented perfectly!!

wyocrook’s picture

jkmickelson's php code still works on Drupal 6.22. Thanks for the fix.

ktleow’s picture

That temp solution worked, but really hope this feature request goes into D7.

-----
Drupal theming services, PSD to Drupal
http://kahthong.com

greta_drupal’s picture

I get this error in 6.9:

warning: implode() [function.implode]: Invalid arguments passed in /home/username/public_html/URL/includes/common.inc on line 188.

function drupal_get_feeds($delimiter = "\n") {
  $feeds = drupal_add_feed();
  return implode($feeds, $delimiter);
}

Do I need to run update.php for this patch?

Suggestions?

napoly’s picture

works for me.. and I'm using 6.9 as well

not_Dries_Buytaert’s picture

@greta_drupal: Please, make sure you add the second piece of extra code in './includes/common.inc' BETWEEN
function system_rss_feeds_settings() {
and
if (!is_null($url) && !isset($stored_feed_links[$url])) {
The patch works fine for me (using Drupal 6.12).

radhika.w’s picture

thanks a ton jkmickelson!

this works so well for me .. !! .. exactly what i wanted ! :)

Nice work!!

Btw, not FYI, but for everyones information, I use 6.8

Radhika

not_Dries_Buytaert’s picture

Add the following CSS rule to prevent all (!) RSS icons from appearing:

a.feed-icon {
	display: none;
}

NB: Users can reveal and use elements that are hidden this way, by altering the CSS on the client side. Hence, aforementioned solution is an unsecure workaround only!

Takaratiki’s picture

jkmickelson's trick works in 6.13 and solved a major issue with security in my intranet site. Concur with the general sentiment of this post; this is a security issue in the vein of "privileged data leaking out of the permissions structure via RSS is a catastrophic failure of security", no question about it. If RSS feeds can't obey the permission roles that we lay out for our users, then Drupal fails to provide for the needs of a significant client base of site operators who need to maintain hierarchical sanity. The fix seems simple and consistently stable, why can't it be inserted into the official code?

I suppose on a similar vein, is there any impetus to modulize this work around so that we can avoid futzing about with the core code manually? Thanks to jkm for the assist.

canen’s picture

In Drupal 6 you can use hook_menu_alter to remove the rss.xml menu item:

function mymodule_menu_alter(&$items) {
   unset($items['rss.xml']);
}

May be an overkill but it works.

Alexander Kosarev’s picture

This will remove path and will disable link, but link will exist and will be shown, as result this will be invalid links

thealchemist’s picture

Sounds good, but where exactly do I add this?

Thanks!

WorldFallz’s picture

you need to create a little custom module for it.

khan2ims’s picture

Thanks. This worked perfectly.

Imran Khan
Project Manager
New Earth Marketing

jgknight’s picture

Forgive me if I'm wrong, but RSS articles will only be included in the feed if the Anonymous role has access to them. For Drupal 6, there's the Content Access module that lets you limit access by role to each content type.

mswillis’s picture

I have been wondering how to go about doing this as I do not use RSS feeds for my website, works perfectly!

wik’s picture

Subscribe

alesr’s picture

Just remove $feed_icons from page.tpl.php..

        <?php if ($feed_icons): ?>
          <div class="feed-icons"><?php print $feed_icons; ?></div>
        <?php endif; ?>

Remove this code from your theme's page.tpl.php and you won't see RSS icon again!
Easy way.

WorldFallz’s picture

Just keep in mind that removing the icons does not actually disable the feed. Anyone familiar with drupal will know what the path is and the feed will still be available. The only way to actually disable the feed is described up at http://drupal.org/node/198129#comment-1924346.

YarDYar’s picture

I'm a total n00b, and just installed Drupal. I'm trying to disable RSS feeds following jkmickelson's patch, but system.module seems to have changed a bit.
I might be reading this wrong, but system_rss_feeds_settings() is not a "method", but an "array"?
has system_rss_feeds_settings() been moved to a different file?

the contents of system.module for 6.14:

  $items['admin/content/rss-publishing'] = array(
    'title' => 'RSS publishing',
    'description' => 'Configure the number of items per feed and whether feeds should be titles/teasers/full-text.',
    'page callback' => 'drupal_get_form',
    'page arguments' => array('system_rss_feeds_settings'),
    'access arguments' => array('administer site configuration'),
    'file' => 'system.admin.inc',
  );

How do i modify it to include the patch:

    $form['feed_enabled'] = array(
      '#type' => 'checkbox',
      '#title' => t('RSS Feed enabled'),
      '#default_value' => variable_get('feed_enabled', 1),
      '#tree' => FALSE,
      '#description' => t('Check here if you want the RSS Feed to be enabled.')
    );

Any assistance would be appreciated.

WorldFallz’s picture

There's no need to hack core modules (which creates a fork that you now need to maintain on your own ad infinitum) to do this. The link I posted above has a much simpler method that does not require core hacks.

mradcliffe’s picture

It's still a static fix, and doesn't cover the problem entirety.

In reality, this should have been fixed in Drupal 4, 5, 6, 7... and I guess now 8.

WorldFallz’s picture

Absolutely-- but as one of the people who've worked on the patch, you know better than anyone how slow fixing non critical items can be :-(

EDIT:

FYI for anyone following this thread:

#28337: Add permissions to disable RSS feeds (checkout that nid!)
#230710: Centralized module to control feeds and feed types

xibun’s picture

-> http://drupal.org/project/rss_permissions
(and the bad news: that module will also be necessary in D7)

anshuman’s picture

Alternatively, one could extend the list of values of "options" in the form section in system_rss_feeds_settings function in system.admin.inc - add '0' as a value in the array.
This will then expose 0 as a value of "Number of items in each feed" in Admin -> Content Management -> RSS Publishing, select zero and this will thereby suppress the RSS feed generation.

not_Dries_Buytaert’s picture

The "Feed Icon Jammer" submodule (http://drupal.org/project/jammer) removes (without requiring configuration) the feed icon from themes that use the PHPTemplate engine.

phpdiva’s picture

There is a contributed module for that for Drupal 6: http://drupal.org/project/rss_permissions

Leeteq’s picture

FYI (all) - There is also a 7.x-dev version of rss_permissions module available from "View all releases" on its project page (unfortunately not (yet) visible on the main project page).

.
--
( Evaluating the long-term route for Drupal 7.x via BackdropCMS at https://www.CMX.zone )

batigolix’s picture