Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

BuddyPress Moderation Tools – Users are able to report their own Comments,

  • Participant
    Level: Enlightened
    Posts: 56
    John B on August 28, 2020 at 9:05 pm #32797

    I just noticed that users are able to report their own their Activity Posts and Activity Comments. Is there a way to prevent this? I can’t think of any reason why a user would need to report their own content.

    Thx, JC

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on August 29, 2020 at 7:35 am #32804

    Hi John,
    Are you using any custom code or hook to attach it.

    The Button is not shown for the user’s own content.

    Regards
    Brajesh

  • Participant
    Level: Enlightened
    Posts: 56
    John B on August 29, 2020 at 1:38 pm #32813

    Yes, I’m using the following code to display the Report button.

    <?php echo bpmts_get_report_button( array(
			    'item_id'     => bp_get_activity_id(),
				'item_type'   => 'bp_activity',
				'context'     => bp_get_activity_object_name(),
				'context_id'  => bp_get_activity_item_id(),
                'link_class'  => 'report-pop',) ); 
          ?>

    Thx, JC

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on August 29, 2020 at 4:23 pm #32821

    Hi John,
    Thank you for the details.
    Thais code seems to be the button.

    The button has no knowledge whether it should be visible or not.

    We put the button behind a gate like this

    
if ( is_user_logged_in() && bpmts_is_me( bp_get_activity_user_id() ) ) {
			return;
		}

		if ( bpmts_user_can_report() ) {
			bpmts_report_button( array(
				'item_id'     => bp_get_activity_id(),
				'item_type'   => 'bp_activity',
				'context'     => bp_get_activity_object_name(),
				'context_id'  => bp_get_activity_item_id(),
				'use_wrapper' => false,
				'link_class'  => 'button item-button bp-secondary-action bpmts-activity-report-button',
			) );
		}

    to make sure it is not visible to the unauthorized users(including self).

    Regards
    Brajesh

  • Participant
    Level: Enlightened
    Posts: 56
    John B on August 31, 2020 at 7:36 pm #32902

    Thanks for helping with this.

    I tried the code above as I know how. I’ve never seen 2 if statements before so that may be the issue. I’m pasting this code and adding <?php at the beginning and ?> at the end. I just cant get it to work properly. Here is what I’m using.

    <?php if ( is_user_logged_in() && bpmts_is_me( bp_get_activity_user_id() ) ) {
			return;
		}

		if ( bpmts_user_can_report() ) {
			bpmts_report_button( array(
				'item_id'     => bp_get_activity_id(),
				'item_type'   => 'bp_activity',
				'context'     => bp_get_activity_object_name(),
				'context_id'  => bp_get_activity_item_id(),
				'use_wrapper' => false,
				'link_class'  => 'button item-button bp-secondary-action bpmts-activity-report-button',
			) );
		} ?>

    Can you please tell me what I’m doing wrong here?

    Thanks again.

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on September 1, 2020 at 5:42 am #32911

    Hi John,
    No, That won’t work.

    The example was for the code inside a function and putting it in template file will have issues rendering template when the first condition matches.

    May I ask a question:- What are your goals with these buttons. What kind of customisation you need? If you can tell me, I can make it easier in the next update.

    Is it your goal to just change the placement? or do you want to modify the markup/css?

    Thank you
    Brajesh

  • Participant
    Level: Enlightened
    Posts: 56
    John B on September 1, 2020 at 9:54 pm #32919

    I’m just trying to move the Report button so that it doesn’t appear below the comment. I’d like for it to appear to the right of the comment as shown here.

    https://youtu.be/GVRRytZHK2Y

    Here is the complete code that I’m using on my entry.php page to display the hover-over menu that displays the Report and Delete button. The menu and code work as expected with just one issue. Users are able to report their own content.

    <div class="dropdown-menu">
                        
            <button class="dropbtn-menu-a"> 
                
                <svg version="1.1" id="iconmonstr" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
	 width="18px" height="24px" viewBox="0 0 18 24" enable-background="new 0 0 18 24" xml:space="preserve">
<path id="menu-11" display="none" fill="#E4E4E4" d="M9,18c1.656,0,3,1.344,3,3s-1.344,3-3,3c-1.657,0-3-1.344-3-3S7.343,18,9,18z
	 M9,9c1.656,0,3,1.343,3,3c0,1.656-1.344,3-3,3c-1.657,0-3-1.344-3-3C6,10.343,7.343,9,9,9z M9,0c1.656,0,3,1.343,3,3s-1.344,3-3,3
	C7.343,6,6,4.657,6,3S7.343,0,9,0z"/>
<rect x="6.575" fill="#E4E4E4" width="4.849" height="6"/>
<rect x="6.575" y="9" fill="#E4E4E4" width="4.849" height="6"/>
<rect x="6.575" y="18.018" fill="#E4E4E4" width="4.849" height="6"/>
</svg>         
            </button>
  
  <div class="dropdown-content-menu-r">
    
      <?php echo bpmts_get_report_button( array(
			    'item_id'     => bp_get_activity_id(),
				'item_type'   => 'bp_activity',
				'context'     => bp_get_activity_object_name(),
				'context_id'  => bp_get_activity_item_id(),
                'link_class'  => 'report-pop',) ); 
          ?> 
      <?php if ( bp_activity_user_can_delete() ) bp_activity_delete_link(); ?>
      
                  </div>
                 
              </div>

    Thx, JC

You must be logged in to reply to this topic.

This topic is: not resolved