Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

Error 404 for non logged in users

Tagged: ,

  • Keymaster
    Level: Yogi
    (BuddyDev Team)
    Posts: 3115
    Ravi on September 6, 2016 at 6:52 pm #5421

    Hi Tiziano,

    Thank you for posting. Is this issue coming from BuddyPress profile visibility plugin?.

    Thank You
    Ravi

  • Participant
    Level: Enlightened
    Posts: 39
    Tiziano on September 6, 2016 at 7:27 pm #5423

    Hello Ravi,

    actually I don’t use the BuddyPress profile visibility plugin so the issue is coming from somewhere else. I also made a test with my private area in buddydev.com, following this link: https://buddydev.com/members/tizianopitisci/messages/

    If I’m logged in I can access to my private messages. If I’m logged-out the system asks me to login.

    Unfortunally with my website this system doesn’t work properly, and It’s not a matter of theme as well, as I made a test for this too.

    Thank you for your help!

    Tiziano

  • Participant
    Level: Enlightened
    Posts: 39
    Tiziano on September 14, 2016 at 7:24 am #5568

    Any other idea? I think we shoul find the code in which buddypress check the visibility of the content. If the content is a private content, buddypress send the user to 404 error page. We just need to find that line and switch 404 page with wp-login.php page.

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on September 14, 2016 at 11:05 am #5571

    Hi Tiziano,
    Is there any content restriction plugin/code active on your site?

  • Participant
    Level: Enlightened
    Posts: 39
    Tiziano on September 14, 2016 at 12:23 pm #5585

    Hello Brajesh,

    actually, there is no content restriction plugin/code active on my website. I also made a test with another website, with zero plugin installed (exept buddypress, of course) and It gives to me the same issue. I have the last buddypress version and It’s an italian located website (I wonder if is a permalink matter due to the tranlation..)

    Thanks for your help!

  • Participant
    Level: Enlightened
    Posts: 39
    Tiziano on September 15, 2016 at 10:44 am #5610

    I also used the defauolt wordpress theme “twenty fifteen” with zero plugin activated (exept buddy press) but nothing has changed…

    This issue is really important because when a user recives an email with a link to the website and this link sends to an error page (instead a login page) the users will feel that on the website there is something wrong and will leave the website.

  • Participant
    Level: Enlightened
    Posts: 39
    Tiziano on September 15, 2016 at 4:18 pm #5629

    Dear Brajesh, maybe I can explain better myself with this follow examples (please, logout from Buddypress and Buddydev and follow the links):

    BUDDYPRESS: https://buddypress.org/members/tizianopitisci/notifications/

    BUDDYDEV: https://buddydev.com/members/tizianopitisci/notifications/

    As you can see, even BuddyPress returns an Error 404 page, but not Buddydev.

    Buddydev is the solution I was looking for because asks users to login.

    Thanks a lot for your help

    Tiziano

    • This reply was modified 8 years, 3 months ago by Tiziano.
  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on September 15, 2016 at 4:22 pm #5631

    Hi Tiziano,
    Thank you.
    That makes sense now.

    I am looking into it. seems like a recent change in BuddyPress is responsible for this behavior.

    Regards
    Brajesh

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on September 19, 2016 at 9:42 pm #5717

    Hi,
    I looked at it again and It is a BuddyPress bug introduced in 2.6 I believe. Please report it to BuddyPress trac.

You must be logged in to reply to this topic.

This topic is: not resolved