Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

[Resolved] Cannot update cover image

  • Participant
    Level: Master
    Posts: 279
    NikB on February 14, 2018 at 4:57 pm #13398

    Wordpress Version 4.94
    BuddyPress Version 2.9.3
    Theme Twenty Seventeen
    No other plug-ins installed

    Message received when editing/updating cover image from profile – “There was a problem uploading the cover image.

    Image appears to be uploaded to the correct upload folder, but profile is not updated.

    Downgrading to BuddyPress Version 2.9.2 resolves the issue and everything works as expected.

    Given the above, it seems very likely this must be an issue with the latest version of Buddypress (not theme or plug-in related). Anyone else experiencing the same and/or any suggestions?

    With many thanks in advance.

  • Keymaster
    Level: Yogi
    (BuddyDev Team)
    Posts: 3115
    Ravi on February 14, 2018 at 7:19 pm #13402

    Hello NikB,

    Welcome to Buddydev. Please point me to your site with some demo account detail so that I can check

    Regards
    Ravi

  • Participant
    Level: Master
    Posts: 279
    NikB on February 14, 2018 at 7:28 pm #13403

    Hi Ravi

    Thank you for your reply. Unfortunately I don’t have a live site that I can give you access to right now… however… I’ve just tested on my semi-live dev server and it seems to be working OK, which seems to leave my localhost (xampp) as the culprit. Maybe a permissions setting on the database(?) – although everything else seems to work perfectly fine (even including updating the profile photo). Maybe some other xampp setting that conflicts with the latest version of Buddypress and the way it uploads/saves the cover image?

    Since it seems to work on the dev server, I’m going to cross my fingers that it will also work live, so it’s no longer a major issue… still curious though as would be good to have the localhost version working too.

    Any thoughts?

  • Keymaster
    Level: Yogi
    (BuddyDev Team)
    Posts: 3115
    Ravi on February 14, 2018 at 7:54 pm #13404

    Hi NikB,

    Thank you for the acknowledgement. Please clarify me one thing that is WordPress normal media uploading file is working fine or not on your localhost?

    Regards
    Ravi

  • Participant
    Level: Master
    Posts: 279
    NikB on February 14, 2018 at 8:10 pm #13405

    Hi Ravi

    Yes normal WordPress media uploads are working perfectly fine… indeed,as mentioned above, I can even upload a Buddypress profile photo with no problem. It’s just the cover photo that seems to be causing a problem.

    Regards
    Nik

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on February 14, 2018 at 9:07 pm #13408

    Hi Nick,
    Can you please check if you have wp-content/uploads/buddypress directory on your local setup.

    Also, if it is present, is there “members” directory inside it.

    If they are not present, create it.

    Please make sure the uploads/buddypress is writable by the webserver and try again.

    Let me know if you already have these and if you can see the uploaded cover image there?

    Also, if it does work, please do let me know if you are on windows/linux ?

    Thank you
    Brajesh

  • Participant
    Level: Master
    Posts: 279
    NikB on February 15, 2018 at 12:04 am #13416

    Hi Brajesh

    Yes the directory is created… the image is even uploaded to the correct directory eg. wp-content/uploads/buddypress/members/1/cover-image/correct.jpg. It just doesn’t appear on the page – possibly no record (or incorrect path) created in the database?

    Not sure off the top of my head where that info would be stored in the database but I’ll see if I can find it tomorrow…

    I’m using Windows 10.

    Warm regards
    Nik

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on February 15, 2018 at 11:39 am #13422

    Hi Nik,
    Thank you.

    From your reply, It seems to me, there is an issue with BuddyPress generating the cover image.

    BuddyPress does not store the cover image in database(as far as I remember).

    To troubleshoot, I will suggest looking at bp-core-attachments.php line 1133(in 2.9.3), the use of

    
bp_attachments_cover_image_generate_file

    and its implementation.

    In my guess, most probably the function is generating error.

    Please let me know what you find.

    Thank you
    Brajesh

  • Participant
    Level: Master
    Posts: 279
    NikB on February 15, 2018 at 1:33 pm #13433

    Ah thank you Brajesh… we’re definitely on the right tracks here.

    Comparing the previous and updated versions of that file, I see that line 1317 has been changed from –

    if ( ! is_dir( $cover_dir ) ) {

    to

    if ( 0 !== validate_file( $cover_dir ) || ! is_dir( $cover_dir ) ) {

    Not yet sure what that validate_file is checking but I assume it must be failing somehow…

    The only other significant difference in the two files is function bp_attachments_cover_image_ajax_delete() which may perhaps also have something to do with it I guess.

    With many thanks again for any thoughts.

    Warm regards
    Nik

  • Participant
    Level: Master
    Posts: 279
    NikB on February 15, 2018 at 3:33 pm #13435

    Just checked this theory by removing the validate_file clause (ie. efffectively changing line 1317 back to what it was previously) and everything else works fine so that’s obviously the culprit.

    Since the path obviously exists (or the image couldn’t be displayed), I’m not sure why the validation is failing but maybe something to do with the fact that the server is localhost?

You must be logged in to reply to this topic.

This topic is: resolved