Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

[Resolved] Upload photo or document is broken in activity

  • Participant
    Level: Initiated
    Posts: 19
    doog2229 on April 7, 2022 at 7:33 am #44317

    Hi,

    I have a problem with your plugin. I want to upload a photo or other document in activity feed of buddypress.

    I can see your buttons for upload any documents or photos but when i post my text with photo, my photo is not visible in the feed of activity

    In the form post of buddypress i have a tiny MCE with this code

    
add_action('whats_new_textarea', function () {
    // deactivation of the visual tab, so user can't play with template styles
    // add_filter('user_can_richedit', create_function('$a', 'return false;'), 50);

    $content = '';
    // building the what's new textarea
    if (isset($_GET['r'])) :
        $content = esc_textarea($_GET['r']);
    endif;

    // adding tinymce tools
    $editor_id = 'whats-new';
    $settings = array(
        'textarea_name' => 'whats-new',
        'teeny' => false,
        'media_buttons' => false,
        'drag_drop_upload' => true,
        'tinymce'       => array(
            'setup' => 'function (ed) {
                tinymce.documentBaseURL = "' . get_admin_url() . '";
            }',
        ),
        'quicktags' => array(
            'buttons' => 'strong,em,link,block,del,ins,img,ul,ol,li,code,close'
        )
    );

    // get the editor
    wp_editor($content, $editor_id, $settings);
});

    And i’m override the template of post form activity

    
<div id="bp-nouveau-activity-form" class="activity-update-form">
    <form action="<?php bp_activity_post_form_action(); ?>" method="post" id="whats-new-form" name="whats-new-form">

        <?php

        /**
         * Fires before the activity post form.
         *
         * @since 1.2.0
         */
        do_action('bp_before_activity_post_form'); ?>

        <div id="whats-new-avatar">
            <a href="<?php echo bp_loggedin_user_domain(); ?>">
                <?php bp_loggedin_user_avatar('width=' . bp_core_avatar_thumb_width() . '&height=' . bp_core_avatar_thumb_height()); ?>
            </a>
        </div>

        <div id="whats-new-content">
            <div id="whats-new-textarea">
                <label for="whats-new" class="bp-screen-reader-text">
                    <?php _e('Post what\'s new', 'buddypress'); ?>
                </label>
                <?php do_action('whats_new_textarea'); ?>
            </div>

            <div id="whats-new-options">
                <div id="whats-new-submit">
                    <input type="submit" name="aw-whats-new-submit" id="aw-whats-new-submit" value="<?php esc_attr_e('Post Update', 'buddypress'); ?>" />
                </div>

                <?php if (bp_is_active('groups') && !bp_is_my_profile() && !bp_is_group()) : ?>

                    <div id="whats-new-post-in-box">

                        <?php _e('Post in', 'buddypress'); ?>:

                        <label for="whats-new-post-in" class="bp-screen-reader-text"><?php
                                                                                        /* translators: accessibility text */
                                                                                        _e('Post in', 'buddypress');
                                                                                        ?></label>
                        <select id="whats-new-post-in" name="whats-new-post-in">
                            <option selected="selected" value="0"><?php _e('My Profile', 'buddypress'); ?></option>

                            <?php if (bp_has_groups('user_id=' . bp_loggedin_user_id() . '&type=alphabetical&max=100&per_page=100&populate_extras=0&update_meta_cache=0')) :
                                while (bp_groups()) : bp_the_group(); ?>

                                    <option value="<?php bp_group_id(); ?>"><?php bp_group_name(); ?></option>

                            <?php endwhile;
                            endif; ?>

                        </select>
                    </div>
                    <input type="hidden" id="whats-new-post-object" name="whats-new-post-object" value="groups" />

                <?php elseif (bp_is_group_activity()) : ?>

                    <input type="hidden" id="whats-new-post-object" name="whats-new-post-object" value="groups" />
                    <input type="hidden" id="whats-new-post-in" name="whats-new-post-in" value="<?php bp_group_id(); ?>" />

                <?php endif; ?>

                <?php

                /**
                 * Fires at the end of the activity post form markup.
                 *
                 * @since 1.2.0
                 */
                do_action('bp_activity_post_form_options'); ?>

            </div><!-- #whats-new-options -->
        </div><!-- #whats-new-content -->

        <?php wp_nonce_field('post_update', '_wpnonce_post_update'); ?>
        <?php

        /**
         * Fires after the activity post form.
         *
         * @since 1.2.0
         */
        do_action('bp_after_activity_post_form'); ?>

    </form><!-- #whats-new-form -->
</div>

    perhaps i have a problem with this custom code ? Your plugin is compatible with tiny MCE

    Thanks

  • Keymaster
    (BuddyDev Team)
    Posts: 24712
    Brajesh Singh on April 11, 2022 at 12:49 am #44358

    Hi,
    Welcome to BuddyDev support forums.

    Is it about MediaPress or Activity Plus reloaded?

    Our plugins are currently tested with the default post form. You have a customized form that uses visual text editor and that might be the reason.

    Please let me know which plugin you are using and our team will try to test it within a week a get back to you(sorry, we are short on support for this week).

    Regards
    Brajesh

  • Participant
    Level: Initiated
    Posts: 19
    doog2229 on April 13, 2022 at 12:13 pm #44391

    Hi,

    Sorry for the late. I test again your plugin with the default form of buddypress and i can’t post a photo or media library in activity feed.

    Here my plugins :

    – BP Groups CiviCRM Sync
    – BuddyPress Group Email Subscription
    – CiviCRM
    – CiviCRM Admin Utilities
    – CiviCRM Mailer
    – CiviCRM WordPress Member Sync
    – MediaPress
    – Members
    – Reset password front end (custom plugin)
    – Starter Templates
    – User Switching
    – WPForms Lite

    my theme is astra (child theme)

    I’m searching an incompatibility with other plugin today perhaps ??

    Thanks so lot

  • Participant
    Level: Initiated
    Posts: 19
    doog2229 on April 13, 2022 at 12:45 pm #44392

    i test the upload with 3 plugins activate : civicrm, buddypress and mediapress

    with this minimal installation i can’t put an image in feed activity

    I change the theme for wordpress default theme and it’s good. I can use your plugin

    For resume, perhaps, your plugin is not compatible with astra theme or astra child

    have you got a feedback with this compatibility problem with à wordpress theme ? Because for my use case, i must use astra theme

    Thanks

  • Keymaster
    (BuddyDev Team)
    Posts: 24712
    Brajesh Singh on April 14, 2022 at 11:16 am #44402

    Hi,
    Thank you for the reply and your effort in finding the conflict.

    Please allow us to check with the astra theme and get back to you in next 2 days.

    Regards
    Brajesh

  • Participant
    Level: Initiated
    Posts: 19
    doog2229 on April 14, 2022 at 12:45 pm #44408

    Hi,
    Thanks for your reply

    Regards

  • Keymaster
    (BuddyDev Team)
    Posts: 24712
    Brajesh Singh on April 21, 2022 at 3:55 am #44505

    Hi,
    Thank you for the patience.
    I have tested the plugin with Astra and the activity upload is working fine.

    https://i.ibb.co/cb9q0mN/Selection-477.png
    https://i.ibb.co/tXp9521/Selection-478.png

    It seems the problem arises due to your change on the activity text area to tinymce editor.

    We send our media ids by atatching it to the ajax request when the form is submitted. My guess is that part is not working.

    Do you have custom js for sending the activity update or is there any chance you are handling it differently server side?

    Also, Can you please remove the mediapress and use the development version from here and see if it works.
    This one has a different interface, so just trying to see if it does work for you or not?
    https://github.com/buddydev/mediapress

    Regards
    Brajesh

  • Participant
    Level: Initiated
    Posts: 19
    doog2229 on April 22, 2022 at 9:15 am #44527

    Hi,

    Thanks so lot for your reply.

    It’s very strange. I’m testing with default form of buddypress and it doesn’t works and i don’t understand why

    I don’t use a specific js for send the activity update

    Here my configuration of my website :

    

// Generated by the MediaPress Debug tool //

Multisite:                No

WordPress Version:        5.9.2
Permalink Structure:      /%postname%/
			
Active Theme:             cptssudgoelo astra child 1.0.0
Parent Theme:             cptssudgoelo astra child 1.0.0

Registered Post Stati:    publish, future, draft, pending, private, trash, auto-draft, inherit, request-pending, request-confirmed, request-failed, request-completed

// Browser Details //
Browser Name: Chrome
Browser Version: 100.0.4896.127
Browser User Agent String: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Platform: Windows
// End Browser Section //

PHP Version:              7.3.33-1+0~20211119.91+debian10~1.gbp618351
PHP Extensions:              Core,date,libxml,openssl,pcre,zlib,filter,hash,Reflection,SPL,sodium,session,standard,cgi-fcgi,mysqlnd,PDO,xml,bcmath,calendar,ctype,curl,dom,mbstring,fileinfo,ftp,gd,gettext,iconv,imagick,intl,json,ldap,exif,mysqli,pdo_mysql,Phar,posix,readline,shmop,SimpleXML,soap,sockets,sysvmsg,sysvsem,sysvshm,tokenizer,wddx,xmlreader,xmlwriter,xsl,zip,Zend OPcache
GD enabled:              Yes

//GD Info
GD Version: 2.2.5
FreeType Support: 1
FreeType Linkage: with freetype
GIF Read Support: 1
GIF Create Support: 1
JPEG Support: 1
PNG Support: 1
WBMP Support: 1
XPM Support: 1
XBM Support: 1
WebP Support: 1
BMP Support: 1
JIS-mapped Japanese Font Support: 
// End GD Info

MySQL Version:            5.5.5-10.3.34-MariaDB-1:10.3.34+maria~buster
Web Server Info:          nginx/1.14.2

WordPress Memory Limit:   40M
PHP Safe Mode:            No
PHP Memory Limit:         1024M
PHP Upload Max Size:      80M
PHP Post Max Size:        100M
PHP Upload Max Filesize:  80M
PHP Time Limit:           600
PHP Max Input Vars:       9000
PHP Arg Separator:        &
PHP Allow URL File Open:  Yes
WP_DEBUG:                 Disabled
SCRIPT_DEBUG:             Disabled
						  	
// Table Prefix //
Table Prefix:             wp_

Show On Front:            page
Page On Front:            Accueil (#119)
Page For Posts:            (#0)

Session:                  Enabled
Session Name:             PHPSESSID
Cookie Path:              /
Save Path:                /var/lib/php/sessions
Use Cookies:              On
Use Only Cookies:         On

DISPLAY ERRORS:           N/A
FSOCKOPEN:                Your server supports fsockopen.
cURL:                     Your server supports cURL.
SOAP Client:              Your server has the SOAP Client enabled.
SUHOSIN:                  Your server does not have SUHOSIN installed.

ACTIVE PLUGINS:

BP Groups CiviCRM Sync: 0.4
BuddyPress: 10.2.0
BuddyPress Group Email Subscription: 4.0.1
CiviCRM: 5.44.0
CiviCRM Admin Utilities: 0.9.2
CiviCRM Mailer: 1.0.0
CiviCRM WordPress Member Sync: 0.5.2
MediaPress: 1.5.2
Members: 3.1.7
Reset password front end: 0.1.0
Starter Templates: 3.1.7
Taskbuilder: 1.0.3
User Switching: 1.5.8
Wbcom Designs - BuddyPress Activity Filter: 2.8.1
WPForms Lite: 1.7.3

// MediaPress Settings //

active_components:		members,groups
default_status:		groupsonly
active_statuses:		public,private,loggedin
active_types:		photo,video,audio,doc
extensions:		jpeg,jpg,gif,png,mp4,flv,mpeg,mp3,wmv,midi,zip,gz,doc,pdf,docx,xls
size_thumbnail:		200,200,1
size_mid:		350,350,1
size_large:		600,600
single_media_size:		large
lightbox_media_size:		large
mpp_upload_space:		10
mpp_upload_space_groups:		10
show_upload_quota:		0
show_max_upload_file_size:		1
default_storage:		local
enable_file_upload:		1
enable_remote:		1
enable_remote_file:		0
download_remote_file:		1
enable_oembed:		1
enable_debug:		1
has_gallery_directory:		1
activity_upload:		1
activity_disable_auto_file_browser:		1
autopublish_activities:		create_gallery,add_media
activity_photo_default_view:		default
activity_video_default_view:		default
activity_audio_default_view:		default
activity_doc_default_view:		default
show_orphaned_media:		0
delete_orphaned_media:		0
activity_media_display_limit:		50
members_active_types:		photo,video,audio,doc
members_enable_type_filters:		0
members_photo_gallery_default_view:		default
members_video_gallery_default_view:		default
members_audio_gallery_default_view:		default
members_doc_gallery_default_view:		default
groups_active_types:		photo,video,audio,doc
groups_photo_gallery_default_view:		default
groups_video_gallery_default_view:		default
groups_audio_gallery_default_view:		default
groups_doc_gallery_default_view:		default
enable_group_galleries_default:		yes
contributors_can_edit:		1
contributors_can_delete:		1
groups_enable_my_galleries:		1
galleries_per_page:		12
media_per_page:		20
media_columns:		4
gallery_columns:		4
show_gallery_description:		0
show_media_description:		0
enable_audio_playlist:		1
enable_video_playlist:		1
gdoc_viewer_enabled:		1
enable_media_comment:		1
enable_gallery_comment:		1
load_lightbox:		1
lightbox_media_only:		0
enable_activity_lightbox:		1
enable_gallery_lightbox:		1
enable_lightbox_in_gallery_media_list:		1

// End of MediaPress Settings //

    i will search again

    Thanks so lot

  • Keymaster
    (BuddyDev Team)
    Posts: 24712
    Brajesh Singh on April 22, 2022 at 7:51 pm #44534

    Hi,
    Please disable the Activity filter plugin by Wbcom temporarily and check? There is a small chance that it might be filtering the stream.

    Regards
    Brajesh

  • Participant
    Level: Initiated
    Posts: 19
    doog2229 on April 23, 2022 at 2:35 pm #44549

    Hi,

    I test an upload file in activity without Activity filter plugin by Wbcom without results.

    But i can see an upgrade for astra theme. In my website i have a 3.7.9 version. In repository WP i can see a new version of astra 3.7.10

    What version of astra use for your test please ?

    Thanks so lot

The topic ‘ [Resolved] Upload photo or document is broken in activity’ is closed to new replies.

This topic is: resolved