Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

BuddyPress Message Privacy help

  • Participant
    Level: Initiated
    Posts: 14
    D W on July 12, 2017 at 9:31 pm #9876

    Hello, i am having an issue with the message privacy plugin, When a user registers for a BP profile they put there username under both Account Details and Profile details (WP & BP) but the message privacy app only looks at the ACCOUNT details Username not the Profile Details username. Users can only see each others Profile username not the account username so if a spam user has different account and profile usernames there is no way for a legitimate user to know the correct username to block.

    – I am using extend profiles buddy press option

    Example Spam user has name A for account and name B for profile. legit user lists name B in ban list and the spam user is not blocked in any way. legit user cant see account username so to Legit user it just seems like a broken ban list or something.

    I Researched merging/syncing the 2 usernames but couldn’t find a way to to that.

    Is there a way to allow switching/combining the usernames(account and profile) the plugin targets? (ban/white lists)

    Thanks for you help, I look forward to hearing from you guys.

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on July 12, 2017 at 10:03 pm #9877

    Hi DW,
    I am sorry but I am a little bit confused here.
    In the plugin we are using user login as the identifier.

    Can you please tell me what are two types of username? Are you referring to the full name field? Or am I missing something here?

    If possible, Please link me a to a screenshot.

    Thank you
    Brajesh

  • Participant
    Level: Initiated
    Posts: 14
    D W on July 13, 2017 at 12:19 am #9891

    On the registration page for my buddypress site I have one column that says Account details on the left and one column that says Profile details on the right. the Account details has Username, e-mail and password boxes. The Profile details has Username, Email, Fullname and the rest of my buddy press extended profiles fields. Extended profile fields has a username box that i cant remove. when you look at a users profile you only see the second username not the account username. Its my impression that one is for BP profile and one is for WP account. I believe its the Extended Profile fields module of buddypress that is causing this but it is an important part of how my users will interact so i cant turn it off.

    because Extended profiles is showing its username as the display name for users profiles there is no way for users to see each others account names and therefor no way for them to list each other in the ban lists if the 2 usernames(1 user) are different.

    It feels like buddypress shouldn’t do that but it does.

    My registration page is nothing special. its actually blank with buddy press register page option pointed at it.

    Thanks for you help i hope i made more sense this time.

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on July 13, 2017 at 12:26 am #9892

    Hi Dw,
    Thank you for taking time to explain. I sincerely appreciate it.

    It still seems strange to me that you have two usernames. Please take a look at this image and the fields marked with red are the only fields required by BuddyPress

    http://i.imgur.com/bVTU1gm.png

    Is it different on your site?

    Thank you
    Brajesh

  • Participant
    Level: Initiated
    Posts: 14
    D W on July 13, 2017 at 1:29 am #9893

    mine looks similar but it also has a username box above the name box. In WordPress admin under users->profile fields i have a list of the fields (not the WP fields just the BP ones) and i can delete or change whatever i like EXCEPT the username. the username field is labeled “Username(Primary)(required)” ,also in my field group name at the top it says “Profile Information (Primary)”

    Thank you for the help! I really appreciate it.

  • Participant
    Level: Enlightened
    Posts: 64
    Graham on July 13, 2017 at 10:47 am #9895

    I am looking at buying the “BuddyPress Message Privacy” plugin and saw this thread first.

    There are 3 user names used in WP (and therefore BP):

    1. user_login: Not visible to other users

    2. user_nicename: Visible to users, but can be changed with a plugin or manually in phpmyadmin

    3. display_name: What the user sets as the name to be shown to other users.

    The user_login name is never displayed to other users, as that would be a security issue.

    Are you saying your plugin ONLY uses the user_login name? If so, then can it be configured to use user_nicename instead?

    If not, then the plugin would not be suitable for me.

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on July 13, 2017 at 1:59 pm #9897

    Hi DW, Graham,
    Thank you.

    We are not using the user_login to do anything special, It simply matches the list of names enterd by the user.

    To be honest, we are using bp_core_get_username() for the logged in user to see if the sender is in the block list.

    The problem is inconsistency. BuddyPress will either use user_nicename or user_login depending whether the compatibility mode is on.

    Will it be fine if I put a option for the site admin to choose to use the nicename or the login name?

    Thank you
    Brajesh

  • Participant
    Level: Enlightened
    Posts: 64
    Graham on July 13, 2017 at 2:26 pm #9898

    Didn’t know there was a compatibility mode!

    I don’t profess to know much about how things actually work at the grass root level. Having the option to choose nicename or login sounds like a great idea to me.

    I assume either would pick up whether a user is blocked?

    Please keep me informed, because the ability to block someone from messaging them is something I really need for my site.

  • Participant
    Level: Initiated
    Posts: 14
    D W on July 13, 2017 at 4:22 pm #9900

    Hey Brajesh, thank for your help on this.

    Having an admin option to choose which username the plugin looks at sounds like a great idea! i look forward to trying it out when its ready.

    Im not sure if the profile is showing the user_nicename or the display name. my guess is it is showing display name but i dont know for sure.
    Also is it really called nicename? or is it nickname?

    thanks again!

    Graham,
    thank you for the info on all those usernames! just to let you know when i tested the plugin using the login names the banlist and friends only settings worked great. the one issue i found i told these guys about on this forum and they immediately updated the whole plugin to fix it and the issue was totally fixed. Its only after more extensive testing i found this issue but i am confident they will get it fixed in no time.

  • Participant
    Level: Enlightened
    Posts: 64
    Graham on July 13, 2017 at 4:29 pm #9901

    Hi D W,

    It’s called nicename in the database itself, but I think some programs may call it nickname to make it more understandable to users.

You must be logged in to reply to this topic.

This topic is: not resolved