Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

BP Autologin on Activation – You must log in to access the page you requested

Tagged: 

  • Participant
    Level: Initiated
    Posts: 19
    Brett on November 4, 2016 at 5:06 am #6246

    I have this plugin installed, and when I use a custom redirection to bring the user straight to editing, it had been working. Now I am getting a screen, asking to login.
    If I remove my custom redirect, it doesn’t login, but activates the account.

    I have recently had the site migrated to a different server, so not sure what is going on.
    I am not sure what has occurred to make the plugin behave like this

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on November 4, 2016 at 9:49 am #6250

    Hi Brett,
    I am sorry but I am not sure about the issue. I will test on a multisite tonight and report back if it a plugin issue or something else.

    Thank you
    Brajesh

  • Participant
    Level: Initiated
    Posts: 19
    Brett on November 7, 2016 at 12:50 am #6292

    I have recently added a staging site as sub-domain of the current, would this cause any issues?

  • Participant
    Level: Initiated
    Posts: 19
    Brett on November 25, 2016 at 6:06 am #6492

    Brajesh – I haven’t heard anything back from you yet, let me know if you need a list of plugins so see what may have caused this to stop logging in on activation as expected.

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on November 25, 2016 at 12:14 pm #6494

    HI Brett,
    Please try disabling other plugins and test. I have tested it with WordPress multisite 4.6.1, BuddyPress 2.7.1 and It worked fine for me.

    I am sorry but I can not make a wild guess here as it is quiet possible that some theme/plugin may be making a redirect on login/activation.

    The only way to find out is to try disabling the plugins one by one. Btw, which theme are you using?

  • Participant
    Level: Initiated
    Posts: 19
    Brett on November 28, 2016 at 12:14 am #6518

    What it is not doing, is log in. I removed the custom redirect, and then removed some code to make the profiles private, and it will activate, but not login. So what I get is it showing the user’s profile information as if I was a visitor, hence why it is asking to log the user in.

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on November 28, 2016 at 11:55 am #6524

    Hi Brett,
    Thank you. I do understand. In other words, this plugin is not doing anything since activation is part of BuddyPress.

    The thing is there is most probably a redirect set up on the activation hook, most probably on the action “bp_core_activated_user” and the code is redirecting before this plugin can log in the user.

    Please search for the above hook in your wp-content directory(plugin/themes) and let me know if you find any info.

    Thank you
    Brajesh

  • Participant
    Level: Initiated
    Posts: 19
    Brett on November 29, 2016 at 12:52 am #6536

    I have quite a few plugins that appear to work on that hook. Here is my list
    public_html/wp-content/plugins/bp-xprofile-location/inc/pp-field-type-location.php: add_action( ‘bp_core_activated_user’, array($this, ‘pp_loc_activated_user’), 15, 3 );
    public_html/wp-content/plugins/conditional-profile-fields-for-buddypress/bp-conditional-profile-fields.php: add_action( ‘bp_core_activated_user’, array( $this, ‘update_saved_fields’ ) );
    public_html/wp-content/plugins/buddypress/bp-xprofile/bp-xprofile-functions.php:
    add_action( ‘bp_core_activated_user’, ‘xprofile_sync_wp_profile’ );
    public_html/wp-content/plugins/buddypress/bp-members/bp-members-functions.php: do_action( ‘bp_core_activated_user’, $user_id, $key, $user );
    public_html/wp-content/plugins/buddypress/bp-members/bp-members-functions.php: do_action( ‘bp_core_activated_user’, $user_id, $key, $user );
    public_html/wp-content/plugins/buddypress/bp-members/bp-members-activity.php: *@param array $user Array of userdata passed to bp_core_activated_user hook.
    public_html/wp-content/plugins/buddypress/bp-members/bp-members-activity.php:
    add_action( ‘bp_core_activated_user’, ‘bp_core_new_user_activity’ );
    public_html/wp-content/plugins/buddypress/bp-core/bp-core-cache.php:add_action( ‘bp_core_activated_user’, ‘bp_core_clear_member_count_caches’ );
    public_html/wp-content/plugins/bp-member-type-manager/includes/bp-member-type-manager-actions.php:add_action(‘bp_core_activated_user’,’bmtm_assign_role_on_registration_activation’, 10, 3);
    public_html/wp-content/plugins/bp-auto-login-on-activation/bp-autologin-on-activ ation.php:add_action( ‘bp_core_activated_user’, ‘bp_autologin_on_activation’, 40, 3 );

    I have removed the BP Member Type Manager, as I no longer need it, but your Autologin on activation is one of them, and the other two – BP xProfile Location and Conditional Profile Fields for BuddyPress were both disabled.
    The rest look to be core files of BuddyPress

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on November 29, 2016 at 11:09 am #6540

    Hi Brett,
    Can you please try changing this

    

add_action( 'bp_core_activated_user', 'bp_autologin_on_activation', 40, 3 );

    to

    

add_action( 'bp_core_activated_user', 'bp_autologin_on_activation', 0, 3 );

    We have made it the highest priority. Let me know if that makes any difference?

  • Participant
    Level: Initiated
    Posts: 19
    Brett on November 29, 2016 at 10:36 pm #6552

    That has made no difference, user is still not logged in when they activate.
    BTW, it is not sending an email when the account is activated either, in case this makes any difference to what might be occuring.

    For now I will disable the plugin due to release pressures, but I would like it to work like this to allow users an easier activation and profile filling process

    • This reply was modified 8 years ago by Brett.

You must be logged in to reply to this topic.

This topic is: not resolved