Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

BP Autologin at activation

Tagged: 

  • Participant
    Level: Enlightened
    Posts: 21
    Jon on February 29, 2016 at 10:12 pm #2810

    Hey Brajesh

    Apparently some of my users are getting redirected to the activation page asking for an activation key after clicking the link in their email. I have no idea why this is happening because I tried it many times myself and cannot reproduce this error.

    Any ideas?

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on February 29, 2016 at 10:20 pm #2813

    Hi Jon,
    I am sorry for the inconvenience. Can you please ask one of those users to forward the activation email to you so that we can check the url and see if there is something to do with that?

    are you using any registration related plugin?

  • Participant
    Level: Enlightened
    Posts: 21
    Jon on February 29, 2016 at 10:58 pm #2818

    Hey Brajesh I got the email and I was able to recreate the issue.

    This is what happens:
    I create an account.
    I click the link in my email
    Get redirected to my profile page
    Log out
    Click the link again
    Get the invalid activation page.

    Your plugin works perfectly for auto-logging in and redirecting to profile. But once someone logs out and tries to click the link again. They get the invalid activation key page.

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on February 29, 2016 at 11:00 pm #2819

    Hi Jon,
    Thank you.

    That is the default BuddyPress behavior. Once the account is activated, The key becomes used and hence the error when clicked again on the same link.

  • Participant
    Level: Enlightened
    Posts: 21
    Jon on February 29, 2016 at 11:32 pm #2820

    So my user claims she got the invalid activation key the first time. She tried it again with gmail and it works but when she tried it with outlook it doesn’t work.

    Is that possible?

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on February 29, 2016 at 11:37 pm #2821

    Yes, It is possible.

    1. There were issues earlier where the mail software used to strip the ?key= some value

    2. since she could not use the key earlier, she was able to use it again.

    A key which was used once, will not allow reusing.

    See this topic deals with exact same
    https://core.trac.wordpress.org/ticket/25350

    Hope that clarifies.

  • Participant
    Level: Enlightened
    Posts: 21
    Jon on March 1, 2016 at 12:14 am #2822

    Thanks for the information. Unfortunately I have no idea how to implement this and not sure if its worth doing. Is there even a way?

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on March 1, 2016 at 1:27 am #2823

    Hi Jon,
    Looking at the ticket again, I am not sure if it is still an issue with outlook. It seems the last two comments confirm that the MS team has fixed it.

    So, Please try getting the email that she had on her outlook and see if it has broken link or anything?

  • Participant
    Level: Enlightened
    Posts: 21
    Jon on March 1, 2016 at 3:18 am #2824

    Hey Brajesh I just created an outlook account and tried it myself. I got the same issue. It seems Outlook is the problem. It seems I have 2 options. Fix the email somehow or edit the activate page to add a “log in” button. Don’t know if that will work but will see.

    You have any ideas to fix this?

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on March 1, 2016 at 7:59 am #2834

    A fix is coming in BuddyPress 2.5 hopefully(not fully confirmed).
    Also, BuddyPress 2.5 contains a very easy way to customize your emails(using theme customizer), so you won’t have to worry about including the login link. It is just a couple of weeks before the 2.5 stable coms out(RC is is already out).

    I am hoping that will resolve the issue for you.

You must be logged in to reply to this topic.

This topic is: not resolved