Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

[Resolved] Bug in BuddyDev Username Availability Checker 1.1.1

  • Participant
    Level: Enlightened
    Posts: 134
    HansRuedi Keller on September 5, 2016 at 8:51 am #5396

    Hi Brajesh,
    I got a few registrations with spaces in username and found that all these users have a PC with Windows and IE. Do you have an idea why for these configs Availability Checker 1.1.1 isn’t working (does not warn in frontend that a space isn’t allowed in username)?

    Thanks,
    Hans

  • Keymaster
    (BuddyDev Team)
    Posts: 24697
    Brajesh Singh on September 7, 2016 at 5:30 am #5437

    Hi Hans,

    The problem is spaces are allowed in username in Standard WordPress. They are no allowed on multisite. so, most probably you are using this plugin on non Multisite and since the username is valid, It does not warn them.

    PS: If the username was invalid, There whould have been no registration.

    Can you please check again.

    Thank you
    Brajesh

  • Participant
    Level: Enlightened
    Posts: 134
    HansRuedi Keller on September 7, 2016 at 9:43 am #5450

    Hi Brajesh,

    Yes, it’s a single wp instance. And I’m using your plugin in combination with wp-members by Chad Butler. One day you provided the code needed to make the combination working in the frontend…


    add_filter( 'buddydev_username_availability_checker_load_assets', 'bpdev_enable_username_availability_asset_loading' );

    function bpdev_enable_username_availability_asset_loading( $allow = null ) {

    if( ! is_user_logged_in() && is_page('register') )
    return true;

    return $allow;
    }

    add_filter( 'buddydev_uachecker_selectors', 'buddydev_uachecker_add_extra_selectors' );

    function buddydev_uachecker_add_extra_selectors( $selectors ) {

    return $selectors .',#wpmem_reg input#user_login';

    }

    With spaces in usernames there is a problem while mentioning a user (@username) in BP.

    The username check is working for me with any browser on my Mac – other words, if I try to register a username with a space in it, I get the error message. Only on a PC with IE there is no error showing up…

  • Participant
    Level: Enlightened
    Posts: 134
    HansRuedi Keller on September 8, 2016 at 8:08 pm #5484

    …and yes, sometimes it’s a good idea to sleep another night. That way I remembered a few lines of code from Chad Butler in my functions.php to prevent registrations with a space in username. That code was no longer working because of a change in wp-members code (the username field in the registration form changed from “log” to “user_login”).

  • Keymaster
    (BuddyDev Team)
    Posts: 24697
    Brajesh Singh on September 9, 2016 at 10:26 am #5490

    Hi Hans,
    Thank you for updating. I was wondering what is going on since the above code does not deal with validation.

    I am glad you found the sleep and the solution 🙂

You must be logged in to reply to this topic.

This topic is: resolved