Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

[Resolved] BuddyPress Profile Visibility Manager –

Tagged: ,

  • Participant
    Level: Enlightened
    Posts: 38
    Javier on July 5, 2016 at 12:30 pm #4566

    Hello,

    This is such a great plugin but I encountered what supposes an issue for my purposes:
    I created a custom WP role with almost the same privileges as a site admin, but with no access to wp-admin, can’t install/remove plugins and other administrative tasks. Also, I don’t want this user to manage privacy options so ‘Only site admin can update user settings?’ is enabled; but if I give this user ‘delete users’ capability (I need him to delete accounts, if necessary) then the profile admin tab ‘Profile Privacy’ appears so he can manage those options.
    Is it possible to give this user capability to delete accounts but not to manage privacy options?

    Thanks in advance,
    Javier

  • Participant
    Level: Enlightened
    Posts: 38
    Javier on July 5, 2016 at 6:00 pm #4570

    May not be the most elegant solution, but here’s what I came up with:

    
		
function my_remove_profile_tabs() {
	if ( current_user_can( 'activate_plugins' ) ) {
		return;
	}

	bp_core_remove_subnav_item( 'settings', 'account-admin-visibility-mode' );
}

add_action( 'bp_init', 'my_remove_profile_tabs' );

    Also, do you guys know how to remove items from account menu (top right dropdown)?
    I couldn’t find ‘bp_core_remove_nav_item/bp_core_remove_nav_item’ equivalent. I know CSS can always come to the rescue, but there must be something specific.

    Thanks,
    Javier

    • This reply was modified 8 years, 5 months ago by Javier.
  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on July 5, 2016 at 7:21 pm #4579

    Hi Javier,
    Thank you for posting.

    The problem is when you have enabled it for Admins only, the plugins checks using is_super_admin() function. Since you are on a non multisite WordPress, WordPress checks for ‘delete_users’ capability and if a user has this capability they are assumed super admin, this is why you are seeing it.

    To remove the adminbar menu, you can put the following in your above function

    

global $wp_admin_bar;
$wp_admin_bar->remove_node( 'my-account-profile-visibility' );

    Hope that helps.

  • Participant
    Level: Enlightened
    Posts: 38
    Javier on July 6, 2016 at 9:06 am #4592

    Thanks for the clarification, Brajesh.
    Since, in my case, only site admin can activate plugins, I created this reusable function in my BuddyPress hooks plugin:

    
function custom_is_my_site_admin(){
    current_user_can('activate_plugins');
}

    Seems to work… I couldn’t figure out a better way.

    • This reply was modified 8 years, 5 months ago by Javier.
  • Participant
    Level: Enlightened
    Posts: 38
    Javier on July 6, 2016 at 9:21 am #4594

    *I haven’t noticed my replies were private: feel free to make them public, in case they become handy for someone

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on July 6, 2016 at 6:37 pm #4603

    Thank you and glad it is working. I will have some better filter in future for the same. Have made replies public.

    Marking it as resolved.

    Thank you
    Brajesh

You must be logged in to reply to this topic.

This topic is: resolved