SimpleXMLRPCServer and DocXMLRPCServer don't look at
the path of the HTTP request at all; you can POST or
GET from / or /RPC2 or /blahblahblah with the same results.

One minor problem with this liberality is that a
security scanner that looks for vulnerable scripts such
as /cgi-bin/phf will report the server as vulnerable. 
Nessus, for example, reports dozens of security holes
on a SimpleXMLRPCServer for this reason.

Fix: add a check that only allows '/' or '/RPC2' (maybe
just /RPC2?).

Logged In: YES 
user_id=11375

The attached patch adds a .rpc_paths attribute that's a
tuple of legal paths, and a .is_rpc_path_valid() method that
returns True if a path is OK.

A .report_404() method generates a 404 error message, and
SimpleXMLRPCServer and DocXMLRPCServer are modified to check
for legal paths.  (Perhaps it should be ._report_404?)

Logged In: YES 
user_id=11375

I've applied this patch in rev. 46578.