Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

Branded login support

  • Participant
    Level: Guru
    Posts: 900
    Tosin on June 11, 2019 at 12:42 pm #23468

    I would prefer to use email address to login into a buddypress site as communication using @mention reveals other members usernames which can be used for brute force login attempts, but email addresses are unique and more secure except if the user decides to reveal it publicly.

  • Keymaster
    Level: Yogi
    (BuddyDev Team)
    Posts: 3115
    Ravi on June 13, 2019 at 7:37 am #23494

    Hello Tosin,

    Please download the latest version of plugin and use the following code.

    
add_filter( 'wp_authenticate_user', function( $user ) {

	if ( isset( $_POST['log'] ) && ! is_email( $_POST['log'] ) ) {
		return new WP_Error( 'invalid_email' );
	}

	return $user;
}, 10 );

    It will only allow login by email address.

    Regards
    Ravi

  • Participant
    Level: Guru
    Posts: 900
    Tosin on June 13, 2019 at 9:45 am #23496

    AWESOME!!!!

    Just one more thing how to change the login error to (Invalid Email or Password!) for both wrong username or email and password input.

    Thanks

  • Keymaster
    Level: Yogi
    (BuddyDev Team)
    Posts: 3115
    Ravi on June 14, 2019 at 5:11 am #23505

    Hello Tosin,

    Please find out the following function in plugin “bl_get_error_message” and there you can modify the message.

    Regards
    Ravi

  • Participant
    Level: Guru
    Posts: 900
    Tosin on June 14, 2019 at 2:31 pm #23511

    Thanks I have changed the errors

    Is it possible to make the workflow for lost password to be the user changing his password after clicking the password reset link in the mail instead of auto generated passwords.

    I don’t want auto generated passwords sent to the user, but the user actually setting his own password on the login page just like how the default wp-login.php password reset workflow works.

    The problem is when a user resets his password and receives a new generated password in his mail, the user will still need to login again to buddypress and change the password again in his settings to something he can remember unlike the complex generated password.

    Now changing of password has now become a two stage process instead of a single stage which should occur immediately after clicking the password reset link in the mail.

    Thanks

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on June 17, 2019 at 4:16 am #23545

    Hi Tosin,
    Thank you for reporting about the reset password workflow. We are unable to provide a quick solution on this. It will be improved in our next major update.

    Regards
    Brajesh

  • Participant
    Level: Guru
    Posts: 900
    Tosin on July 5, 2019 at 10:23 am #23866

    Hello,

    How can I add a loading spinning icon to the login button and the register link when both have been clicked upon on the branded login plugin. Users need to know that the login process has been initiated and is currently loading.

    Thanks

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on July 5, 2019 at 7:52 pm #23868

    Hi Tosin,
    Branded login does not use ajax to handle login. You do not need to add a loading icon. That will not make any sense as the complete page is reloaded on click without any delay.

    If you still want to add the loading indicator, please feel free to use any loading icon and hide them by default. Use a javascript snippet to make them visible when the button is clicked.

    PS:- In future, Please start a new topic for new questions/support request. That helps us keep the support forums more organized(and searchable for others looking for the same thing).

    Regards
    Brajesh

You must be logged in to reply to this topic.

This topic is: not resolved