Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

[Resolved] Buddypress Deactivate Account Issue with logging user out?

Tagged: , , ,

  • Keymaster
    (BuddyDev Team)
    Posts: 24712
    Brajesh Singh on January 26, 2018 at 2:45 pm #13170

    Hi David,
    I am sorry for the inconvenience.

    Is there anything specific about your installation. I tested on WordPress 4.9 and BuddyPress 2.9.2 again and it is working.

    1. Are you on multisite?
    2. Are you using any caching plugin?
    3. What happens when user deactivates account?

    Thank you
    Brajesh

  • Participant
    Level: Initiated
    Posts: 11
    David on January 28, 2018 at 11:55 pm #13201

    Hi Brajesh. Sorry for the late reply. To answer your questions, it is not a multisite, I do not have any caching plugin. The way I am using it is to suspend users, so I do not allow uses to deactivate their own account. However, what happens is the user gets suspended but they are still allowed to navigate buddypress with limited access. The issue seems to be with this line of code.

    
		$is_manager = bp_account_deactivator()->current_user_can_change_account_status();
		$logged_out = false;
		if ( ! $is_manager && $deactivator->get_option( 'logout-on-deactivation' ) ) {
			wp_logout();
			$logged_out = true;
		}

    I noticed that if I get rid of the conditional statement, and just allow wp_logout(), the user that gets logged out is the admin and not the blocked user.

  • Keymaster
    (BuddyDev Team)
    Posts: 24712
    Brajesh Singh on January 28, 2018 at 11:59 pm #13202

    Hi David,
    Thank you.

    That condition is to avoid logging out the user if the user is site admin(or if you are adding custom code to allow other users having the option to deactivate other user’s account).

    I hope that you were most probably logged in as admin while trying to deactivate account. is that correct?

    Regards
    Brajesh

  • Participant
    Level: Initiated
    Posts: 11
    David on January 29, 2018 at 12:38 am #13203

    I am logged in as admin and I am trying to deactivate a user who is logged into the site from a different IP. Still I cannot log that user out

  • Keymaster
    (BuddyDev Team)
    Posts: 24712
    Brajesh Singh on January 29, 2018 at 12:45 am #13204

    Hi David,
    I am sorry, I was not sure earlier.

    What you are trying is destroying all sessions of the user.

    For now, It is not available in Deactivate Account(I am adding it as it is a very good feature).

    You can still logout a user from everywhere by Visiting Dashboard->Users and clicking on Edit User, you will see a “logout from everywhere’ button there. The functionality is offered by WordPress core.

    Hope that helps.
    Brajesh

  • Participant
    Level: Initiated
    Posts: 11
    David on January 29, 2018 at 12:51 am #13205

    Ok, I assumed that was what was meant by “logout user on deactivation”. I did not know that the user him/herself would be the one to have to deactivate in order to logout. Can I expect this update to the plugin in the near future? I hate to have to edit the plugin but for now I will mess around with WP_Session_Tokens::get_instance($user_id) and destroy_all and see if I can fiddle something for myself

  • Participant
    Level: Initiated
    Posts: 11
    David on January 29, 2018 at 1:09 am #13206

    Its ok. I figured out some temporary code until you update. Thank you.

  • Keymaster
    (BuddyDev Team)
    Posts: 24712
    Brajesh Singh on January 29, 2018 at 1:14 am #13207

    Hi David,
    Thank you. We will have it in the next update(within this week). Currently the logout option only logs out from current session.

You must be logged in to reply to this topic.

This topic is: resolved