Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

Buddypress profile page give 404 error page when accessed by non-logged in user.

Tagged: 

  • Participant
    Level: Initiated
    Posts: 17
    Jigar Prajapati on June 26, 2017 at 6:49 am #9615

    Hello,

    We have very wired issue on one of our buddypress installation site where non-logged in user see the 404 page when access the profile page of other user. While logged in user can access the profile page of any user.

    We have a public page, where we are displaying the registered users listing. Anyone can click on it see the user profile.

    Can anyone have clue on this? Is there any permission issue causing this?

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on June 26, 2017 at 8:52 am #9616

    Hi Jigar,
    Welcome to BuddyDev.
    It is most probably an issue caused by a privacy plugin or some code. Check if you have any privacy plugin enabled.

  • Participant
    Level: Initiated
    Posts: 17
    Jigar Prajapati on June 26, 2017 at 9:25 am #9618

    Hi Brajesh,

    Thanks for the reply.

    Actually the problem starts with Buddypress AJAX registration form issue. We have added on conditional dropdown to the registration form. The site already had few old registrations done.

    When we try to visit the profile, we get the field js error as that old profile does not have the value of new field based which we have condition made to display other fields. The buddypress by default loads the fields only created when user is register so new fields are not loading on ajax registration popup form. We resolve it by putting the condition in bp_displayed_user_id() function to set $id = user id only if user is logged in. By this now the registration form is loading fine with all fields when we view the profile without logged in.

    But it creates the new issue as non-loggedin user will return 0 when we call bp_displayed_user_id() and redirects to 404.

    I have undo the code I have modified and now it is still giving the 404 page. To further invest, it get redirect to 404 from bp_core_catch_no_access() function bp-core-catchuri.php file.

    The condition that fails there is bp_is_blog_page() return false.

    Again, I have removed all modification I have done and found above condition with throw out to 404.

    Please help me to track this.

    Thanks

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on June 26, 2017 at 9:36 am #9619

    Hi Jigar,
    I am sorry but I won’t be able to assist much here.
    The problem is you have modified the core files and there are too many unknown variables here for me to assist you

    1. What is the ajax registration form? Is it some code you have written?
    2. Are you using any conditional field that is throwing js error? Is n’t it feasible for you to fix it?

    3. Never modify BuddyPress core, no one will be able to help as it makes the behaviour of our installation unpredictable for others.

    I will suggest starting with a fresh copy of BuddyPress and then moving one by one.

  • Participant
    Level: Initiated
    Posts: 17
    Jigar Prajapati on June 26, 2017 at 9:52 am #9620

    Hi Brajesh,

    Thanks.

    I have undo all the changes I have did. Infact I just placed only one condition in core file which I have removed and now there is no modification in core files.

    For ajax registration, I have used bp-ajax-registration plugin. Also, I have used conditional-profile-fields-for-buddypress plugin for conditional fields.

    So the error on registration popup when on profile page is due to plugin itself and not through any custom code.

  • Participant
    Level: Initiated
    Posts: 17
    Jigar Prajapati on June 26, 2017 at 9:55 am #9623

    the condition is placed on member type drop down created through these two plugins, bp-member-type-generator (Member type for Buddypress) and bp-xprofile-member-type-field (Create profile field based on member type created as dropdown)
    Hope this will help.

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on June 26, 2017 at 9:57 am #9624

    Hi Jigar,

    So the error on registration popup when on profile page is due to plugin itself and not through any custom code.

    Does disabling the ajax registration plugin fixes your 404 issue?

  • Participant
    Level: Initiated
    Posts: 17
    Jigar Prajapati on June 26, 2017 at 10:14 am #9626

    Hi Brajesh,

    Not by disabling, If I remove my custom code, it removes the 404 error. But it have the js error and ajax registration not working at all.

    So the problem is, if I resolve JS issue, it give 404 page and if remove that resolution, gives registration not working.

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on June 26, 2017 at 10:25 am #9627

    Please share your custom code.

  • Participant
    Level: Initiated
    Posts: 17
    Jigar Prajapati on June 26, 2017 at 10:27 am #9628

    Also, the second issue is it loads the profile values of user to which I am viewing the profile loads to the registration form fields as default value.

    So if I am visiting the profile of user ‘xyz’ with the full name give as ‘xyz abc’, the registration form have ‘xyz abc’ as default value of Full name field.

You must be logged in to reply to this topic.

This topic is: not resolved