Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

BuddyBlog Pro Groups tabs

  • Participant
    Level: Master
    Posts: 279
    NikB on November 2, 2022 at 4:05 pm #47185

    Hi Brajesh

    I currently have things set up so that all groups are set up the same ie. posts should be viewable by “everyone” as long as it’s a public group, but only group members can submit posts and approval by group admin is required before posts are published.

    This seems to be working fine (for standard post types at least) however I’ve recently noticed that all group members can see ALL pending and draft posts not just their own

    These tabs are required so that group members are able to keep track of posts that they have submitted but are still awaiting approval, however, would it make more sense if they could only see their OWN posts at this point?

    Example scenario: group member has submitted (or drafted) a potentially offensive post which group admin has yet to approve, and yet all group members can already see it under “pending”.

    Is there some way of avoiding the above scenario, perhaps by filtering the draft and pending group posts so that only the author (and group admin) can see them in the tab?

    With many thanks in advance.
    Nik

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on November 2, 2022 at 8:43 pm #47186

    Hi Nik,
    Do you have some template override for the group posts?
    Our default implementation will only show all pending/draft posts to group admin/moderators(if allowed). Other users will only see their own.

    If that is not happening, something on your setup is conflicting/interfering with WP_Query.

    I will suggest disabling some of the plugins to check it.

    Regards
    Brajesh

  • Participant
    Level: Master
    Posts: 279
    NikB on November 3, 2022 at 10:52 am #47189

    Hi Brajesh

    I was really hoping you were right but unfortunately, I’ve done some testing and I’m not sure…

    I deactivated all plugins except BuddyBoss Platform, BuddyBoss Platform Pro, BuddyBlog Pro & BuddyBlog Groups.
    Even using the Twenty Twenty One theme, all group members are seeing ALL draft/pending posts under the respective tabs in the group.

    If it makes any difference, if they actually try to view a post which is shown under draft or pending by clicking on the link, all they see is a blank page (even if it’s their own) … which does make some sense as the post obviously isn’t actually published yet however… that doesn’t explain why they can still see a list of ALL the posts.

    If you are unable to replicate this, I’m not sure what to investigate next. Any suggestions?

    Regards
    Nik

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on November 3, 2022 at 12:41 pm #47193

    Hi Nik,
    I am sorry, I had another look.

    We actually got confused with the names used there( $args, $query_args and missed to merge these 2 arrays). This is infact a bug in bblgroups_get_posts_query_args
    The code is there but the merging is needed.

    I will have the update in 1-2 days with other changes.

    Regards
    Brajesh

  • Participant
    Level: Master
    Posts: 279
    NikB on November 3, 2022 at 3:23 pm #47195

    Hi Brajesh

    Ah that makes sense and glad it’s not just me.

    Really hope you can indeed get this and the other changes sorted within the next 1 – 2 days, timing is getting a bit critical for me on this project now 😉

    Fingers crossed and will look forward to hearing from you.
    Nik

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on November 3, 2022 at 5:06 pm #47198

    Thank you Nik.

    Regards
    Brajesh

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on November 5, 2022 at 10:17 pm #47219

    Hi Nik,
    Please upgrade to 1.3.2 for BuddyBlog Pro and then BuddyBlog Group 1.0.0-rc-1.
    Activity for new posts(after this update) will work for group/user fine. older activity may behave inconsistently for group posts.

    Regards
    Brajesh

  • Participant
    Level: Master
    Posts: 279
    NikB on November 6, 2022 at 8:56 am #47224

    Hi Brajesh

    Thank you so much for this. I’ve been doing some testing accordingly and results as follows –

    Groups activity now seems to be working well ie. entries appear as follows –

    “Nik wrote a new post My Post Title in the group My Group”
    “Nik wrote a new event My Event Name in the group My Group”

    (From a pedantic point of view, I think using the word “added” or “created” would possibly work better than “wrote” and be more relevant for a wider variety of post types, but I can always translate that myself so not an issue at this stage.)

    User activity is unfortunately not working so well ie. for an event post type, I get TWO entries as follows –

    “Nik posted a new post” (with no link) – I think this one is coming from BuddyBlog Pro?
    “Nik added the event My Event Name” – I suspect this one is coming from the Events Manager plugin?

    Any idea what is going wrong here? Maybe I need to disable the Events Manager entry but since that’s the one that reads correctly, that doesn’t seem ideal.

    With many thanks in advance for any thoughts.
    Nik

  • Participant
    Level: Master
    Posts: 279
    NikB on November 6, 2022 at 9:03 am #47225

    PS. Oh I think I’m confused now… are the updates mentioned above intended to address the activity entry issues OR the issues with bblgroups_get_posts_query_args?

    Because you mentioned activity, I was assuming it was the former, although I’ve now noticed this was posted on my query about the latter 😉

    I’ll do a bit more testing and await to hear from you.

    Regards
    Nik

  • Participant
    Level: Master
    Posts: 279
    NikB on November 6, 2022 at 11:17 am #47231

    Hi Brajesh

    Sorry for the third post but after further testing, I can see that the issue actually mentioned does indeed seem to be fixed ie. users can now only see their own draft and pending posts (unless they are a group admin) so that part does indeed appear to be fixed now.

    As mentioned above, unfortunately activity entries still don’t seem to be quite right.

    Regards
    Nik

You must be logged in to reply to this topic.

This topic is: not resolved