Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

Strange issue caused by BP Ajax Registration

  • Participant
    Level: Master
    Posts: 413
    Venutius on October 17, 2016 at 9:10 pm #6042

    I have a user sign up today on a site where I’d inadvertently left BP Ajax Registration running.

    They signed up with a username of choo and a name of 🙂 (colon, close brackets)

    Following registration I found that I was unable to see that user in Dashboard>>Users>>All Users so in future I will be unable to manage that account.

    I set up my test system and registered using the username of george and the name of 🙂 this user also became invisible to the admin user list. Takng Ajax Registration down meant that a new user registration with the same name was visible.

    So I conclude there is a problem with BP Ajax Registration, where it allows the creation of partially invisible users.

  • Keymaster
    (BuddyDev Team)
    Posts: 24715
    Brajesh Singh on October 17, 2016 at 10:49 pm #6044

    Hi George,
    That is a strange thing. You said disabling the plugin made the user visible? Now that is even more strange since the Ajax registration plugin does not filter on the users list.

    Which other plugin are you using? May I get access to the install?

    Thank you
    Brajesh

  • Participant
    Level: Master
    Posts: 413
    Venutius on October 18, 2016 at 2:37 am #6052
    This reply has been marked as private.
  • Participant
    Level: Master
    Posts: 413
    Venutius on October 18, 2016 at 3:17 am #6054

    What I discovered on my main site was that BP Ajax Registration was setting these new members up as user type participant, rather than my default of a custom member type I had configured.

    Changing the member type for that user back to my customer configured role did not cause the user to be displayed in the All Users list.

    I conclude therefore that this issue has nothing to do with the actual user name but it is something odd about the way BP Ajax Registration sets up the new users.

  • Keymaster
    (BuddyDev Team)
    Posts: 24715
    Brajesh Singh on October 18, 2016 at 9:05 am #6056

    Hi George,
    That makes sense. On multisite BuddyPress Ajax registration plugin allows you to select a role for the new user(since BuddyPress does not assign any role). You can select the role from Settings->BuddyPress->setting screen

    It seems, somehow the role was selected to be participant(It is a forum role, by default the plugin should have used ‘subscriber’ role).

    Can you please update the role and let me know if it allows new users to be visible. Exiting users will have no effect.

    Thank you
    Brajesh

You must be logged in to reply to this topic.

This topic is: not resolved