Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

BuddyPress Block Users – Restricting Blocked Users through REST API

Tagged: ,

  • Participant
    Level: Enlightened
    Posts: 72
    Nifty on March 7, 2022 at 8:33 am #43715

    Hi,

    Hope you’re all going well. 🙂

    We’ve enabled the “Disable profile view” and “Hide profile from directory listing” options for restrictions that apply on the blocked user. Is there a way we can reflect these blocks, while using the REST API? In this case, searches by the blocked user would return results without the blocker and they won’t be able to visit the blocker’s profile through any means?

    Thank you!

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on March 7, 2022 at 9:15 pm #43730

    Hi Nifty,
    Thank you for using the plugin.

    There is no way to know if the request is for profile view or directory while using REST API.

    We can not apply the restrictions on the single profile view without co-ordination from the client app. For the listing, I will try to enforce it on members query and update you in next couple of days.

    Regards
    Brajesh

  • Participant
    Level: Enlightened
    Posts: 72
    Nifty on March 8, 2022 at 10:05 am #43740

    Hi Brajesh,

    Thank you for looking into this. Regarding the client co-ordination, are you able to give us some advice on how we would go about achieving that?

    We’ve had a quick chat with our app developer and he says (verbatim) :

    “If BuddyDev can change the /wp-json/buddypress/v1/members API call to exclude the blocker’s profile when a blocked person does a search then we could do the following;
    – Anywhere in the app where a person (e.g. Tim) tries to open the another person’s profile (e.g Jill), the app will do a /wp-json/buddypress/v1/members API call with Jill’s “user_login” in the “search” field as part of the API call
    – The app will go through any returned results to check if the “user_login” matches, if there is a matching “user_login” that means Jill has not blocked Tim, and the app will proceed to Jill’s profile.
    – If there is no matching “user_login”, that means Jill has blocked Tim, and the app will display a notification to say the user’s profile cannot be viewed (or something like that).”

    Does this seem like a feasible approach?

    We will look forward to hearing back from you. 🙂

    Thanks.

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on March 9, 2022 at 12:09 pm #43750

    Hi Nifty,
    Please try putting this in your bp-custom.php

    

// filter blocked and blocked by user ids.
add_filter( 'bp_rest_members_get_items_query_args', function( $args ) {

	if ( ! is_user_logged_in() || is_super_admin() || ! function_exists( 'bublock_get_blocked_user_ids_for_user' ) ) {
		return $args;
	}

	$excluded_users = isset( $args['exclude'] ) ? wp_parse_id_list( $args['exclude'] ) : array();

	// All user ids blocked by me. only if blocker can not list blocked user profile.

	$blocked_users = bublock_get_blocked_user_ids_for_user( bp_loggedin_user_id() );

	if ( $blocked_users ) {
		$excluded_users = array_merge( $excluded_users, $blocked_users );
	}

	// All user ids who has blocked logged in user only if blocked user profile not available.

	$blocked_by_user_ids = bublock_get_blocked_by_user_ids_for_user( bp_loggedin_user_id() );
	$excluded_users      = array_merge( $excluded_users, $blocked_by_user_ids );

	if ( $excluded_users ) {
		$args['exclude'] = array_unique( $excluded_users );
	}

	return $args;
});

    Let me know if it works for you or not? This will filter out the blocked users/blocked by users.

    Regards
    Brajesh

  • Participant
    Level: Enlightened
    Posts: 72
    Nifty on March 10, 2022 at 10:57 am #43775

    Hi Brajesh,

    Thank you for your work on this.
    So far, the change is looking really good. We’ll do a bit more testing, and get back to you to confirm. 🙂

    Thanks again!

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on March 11, 2022 at 10:46 am #43780

    Thank you.
    I am looking forward to your feedback.

    Regards
    Brajesh

  • Participant
    Level: Enlightened
    Posts: 72
    Nifty on March 15, 2022 at 8:09 am #43821

    Hi Brajesh,

    We’re still doing some testing. Would it be possible to still have the blocker be able to access the blocked person’s profile? This would be for unblocking purposes, and would also keep how the plugin works on the API and website consistent.

    Thank you. 🙂

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on March 18, 2022 at 7:22 pm #43910

    Hi,
    Please consult your app developer and let me know what kind of changes they need from me. I will be glad to assist.

    Regards
    Brajesh

  • Participant
    Level: Enlightened
    Posts: 72
    Nifty on March 22, 2022 at 8:45 am #44010

    Hi Brajesh,

    We’d like to be able to fetch the information on blocked users (such as their user IDs). Ultimately, we’d also really like to be able to block a user and unblock a user, as well. We understand this will likely require multiple API endpoints for the plugin, though. Would you have an alternative method to achieve this (i.e. fetching user IDs)?

    Thank you. 🙂

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on March 22, 2022 at 11:29 pm #44050

    Hi Nifty,

    I am sorry, the whole thing will depend on the app developer. If I was the App developer, I might have extended the end point with some kind of scope to exclude/include the banned users.

    We need to know which end points they are accessing and how do we differentiate between their calls for fetching the members list or single user. I added the previous filter as per the details you shared. can you please ask them and provide me more details on how do we differentiate the 2 requests?

    Thank you
    Brajesh

You must be logged in to reply to this topic.

This topic is: not resolved