Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

Buddyblog, images/media support.

Tagged: ,

  • Participant
    Level: Enlightened
    Posts: 55
    Peter Blom on December 13, 2015 at 2:22 pm #2017

    Nope, not using CPT.

    Yes, I’m able to choose image, visually, as well as the featured image link below post is back again, but it still doesn’t seem to register/save the selections when doing it from front end as subscriber.

    Edit: Tested a little more
    If I go in as admin and set the featured image, it does indeed show up underneath the post when editing post as subscriber in front end as well.

    Test 2: You can’t edit/change the by admin set featured image in frontend as subscriber either, or delete it. If removing it shows just the message “-1”, and upon update obviously the image is till there.

    Thinking some kind of user restriction? Or as you said before some kind of id problem.

    • This reply was modified 9 years ago by Peter Blom.
    • This reply was modified 9 years ago by Peter Blom.
  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on December 13, 2015 at 2:38 pm #2020

    Hi Peter,
    Most probably the included js is not loading. Please try this and let me know what you see

    1. Click Add New in BuddyBlog menu
    2. On that screen, click “Set Featured Image link” which is just below the Content Area
    3. Does that link open a popup? If yes, select an image and click the button “Set featured image”, Now, that image should be inserted in the area below post content. Is that happening?

    That’s all I need to know.

    PS: And admin uploaded image can not be deleted/removed by subscribers.

  • Participant
    Level: Enlightened
    Posts: 55
    Peter Blom on December 13, 2015 at 3:10 pm #2021

    All the popups and things are working, the media manager comes up, and I can select a featured image, it does not seem to save the selection. Clicking the “set featured” and exits the mediamanager etc as it should but there is no featured image showing/set.

    Edit, see the post I made above as well for a little more info, some of it answerd there allready 🙂

    • This reply was modified 9 years ago by Peter Blom.
  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on December 13, 2015 at 4:29 pm #2023

    If that is not happening, The javascript file is not loading. Can you please check if bsfep.js is being loaded?

    It should be loaded in the footer on the page where form is displayed. If it does not load, you will see featured image option but that won’t be set. It overrides some of the media model/view settings for post id/nonces to make them work.

  • Participant
    Level: Enlightened
    Posts: 55
    Peter Blom on December 13, 2015 at 8:41 pm #2025

    If I just pull up the sourcecode I can find the script there yes (though I’m not sure that’s proof its loading properly?), is there something else I can do to doublecheck it (when we go into scripts/php my knowledge starts to diminish quite rapidly)

    I did try a couple of things, across browsers. When I finally tried to upload a new image for the featured image, instead of just selecting a allready existing image using firefox this time, I do get this error in the media-manager:
    “You don’t have permission to attach files to this post.”

    So either that scripts not running, and its not enough to just check the sourcecode, or its not working as intended.

    I tried turning on define(‘SCRIPT_DEBUG’, true); and running the error console in FF and Chrome but didn’t catch any errors.

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on December 13, 2015 at 8:53 pm #2026

    Hi Peter,
    I am sorry. May be you are right as I just realized I was doing the tests with an author account and forgot to do the final test with subscriber. Please give me an hour and I will have more details. I am sorry for all the trouble. It is most probably an issue on my end.

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on December 13, 2015 at 8:58 pm #2027

    Ok, A huge mistake on my end. I was not handling the ajax actions and WordPress was not allowing subscriber to set post thumbnail.

  • Participant
    Level: Enlightened
    Posts: 55
    Peter Blom on December 13, 2015 at 9:25 pm #2028

    Np, the one thing you learn working with webdevelopment is that there’s always an error ^^ Just as long as its solved in the end.

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on December 13, 2015 at 11:53 pm #2029

    Hi Peter,
    Thank you. Finally, I have uploaded 1.2.7 that will work for posts. I haven’t tested it with custom post type though. If any of you notice any issue, please do let me know.

    Thank you
    Brajesh

  • Participant
    Level: Enlightened
    Posts: 55
    Peter Blom on December 13, 2015 at 11:58 pm #2030

    Will give it a run down right away and report back, thank you sir!

You must be logged in to reply to this topic.

This topic is: not resolved