Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

[Resolved] Auto Activate Autologin Redirect To Profile On Signup not working

  • Participant
    Level: Enlightened
    Posts: 25
    cléa Rozenblum on May 12, 2020 at 9:11 pm #29733

    Hi Brajesh,

    I just bought your plugin for autoactivating users on signup.
    However, the plugin is not working properly as users are not being redirected upon sign up.
    Instead, they go to the page where they are redirected by default where it says that they will received a validation code by email. However, on that page, a new message appears that says that the account has been properly activated (screen pic enclosed in a private follow up response).
    Moreover, after sign-up, after manually logging in, the user is not redirected accordingly to his role, even though the plugin settings attributes a special redirection for his member role.
    The user is redirected to the home page (default behavior without the plugin), and not even to his user page.

    On the back end however, the user role is properly attributed to “en moderation” upon signup.

    I have prepared screenshots of my back end that shows the following :
    – back-end screen shot : users have the “en moderation” role by default
    – back-end screen shot : the plugin is supposed to redirect “en moderation” roles to a particular page
    – back-end screen shot : the plugin is supposed to redirect users to their profile page
    – front end : after sign up, user is redirected to page telling him that he will receive an activation code by email + message indicating that his account has been activated.

    Kind regards,

    Clea

  • Participant
    Level: Enlightened
    Posts: 25
    cléa Rozenblum on May 12, 2020 at 9:15 pm #29734
    This reply has been marked as private.
  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on May 12, 2020 at 11:33 pm #29737

    Hi Clea,
    Thank you for using the plugin. That plugin is tested to work with BuddyBoss properly.

    Are you using any other code related to account activation redirection/login redirection, Please remove that.

    Also, is there any chance that you are using some option to hold registration as pending(BP registration options?)

    The redirection settings are currently for account activation redirection(automatic account activation and redirection), They don’t have any bearing on manual activation or login currently.

    If you want the option for normal logins too, Please let me know, I can add them.

    PS:- If you are unable to find the conflicting ode, May I take a look at the site?

    Regards
    Brajesh

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on May 12, 2020 at 11:33 pm #29738

    Also, If possible, Please share me a screenshot of the settings panels(General & Role based redirects).

    Thank you
    Brajesh

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on May 12, 2020 at 11:34 pm #29739

    Sorry, I found that you have already shared the screenshot. Taking a look now.

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on May 12, 2020 at 11:38 pm #29740

    Hi Clea,
    Thank you.

    I can see the reason now.

    The redirects use safe redirect. They will only work on the same domain as currently installed WordPress. This was for security purpose.

    For example, if your WordPress is on example.com, It will work for example.com/x or example.com/y but not for anything.example.com/x or someothersite.com

    Similarly, if your WordPress is on a subdomain, It will work for redirects on that sub domains only.

    Please give it a try.

    Regards
    Brajesh

  • Participant
    Level: Enlightened
    Posts: 25
    cléa Rozenblum on May 13, 2020 at 7:59 am #29758
    This reply has been marked as private.
  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on May 13, 2020 at 8:43 am #29762

    Hi Clea,
    Thank you.

    From the screenshot, It seems the security plugin you are using is preventing automatic login.

    You will need someway to allow login via code(we are using wp_signon() ). Which plugin you are using for security and can you please contact their support for this?

    Also, on the staging site, Can you please temporarily disable the security plugin and check that it is working or not? I have tested it and it is working well for BuddyPress.

    I am adding the login redirection option today.

    Regards
    Brajesh

  • Participant
    Level: Enlightened
    Posts: 25
    cléa Rozenblum on May 13, 2020 at 9:45 am #29767

    Hi Brajesh !!

    I disabled the security plugin (using Wordfence) and the email wasn’t sent, which is perfect.
    Do you have a security plugin recommendation that would work with the plugin to replace Wordfence ?

    After deactivating wordfence and signinup, the user wasn’t redirected, instead he landed on a blank page.

    There, I identified where the bug was : in my general wordpress settings, I had chosen “en moderation” as the default role for new users. “En moderation” is a role created using paid membership pro plugin, so not a wordpress role.
    I changed to “contribuor” as default role for new users and it solved the issue !
    Now everything is fine 🙂

    Thanks for your help and looking forward to being able to redirect existing users login in based on their role with your next release.

    Kind regards,
    Clea

    • This reply was modified 4 years, 7 months ago by cléa Rozenblum. Reason: Added info about user redirected to blank page
  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on May 13, 2020 at 10:11 am #29769

    Hi Clea,
    Thank you for confirming.

    I am glad you found the reason.
    Thank you for sharing. It will help us troubleshot for other members in future.

    I will post back after adding the login redirection too.

    Regards
    Brajesh

The topic ‘ [Resolved] Auto Activate Autologin Redirect To Profile On Signup not working’ is closed to new replies.

This topic is: resolved