Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

[Resolved] Make BuddyPress Profile Visibility Manager work with BuddyBoss’ Private Website

  • Participant
    Level: Initiated
    Posts: 7
    Thomas Kamplain on March 15, 2021 at 12:25 pm #36831

    Hello!

    I am using your plugin BuddyPress Profile Visibility Manager with BuddyBoss. In BuddyBoss, there is a feature called “Private Website” that restricts access to the website to only logged-in members. Before we installed the plugin, whenever someone responds to a post on the News Feed, an email notification will be sent out where you can click a link to reply to the comment. That link looks something like this: https://example.com/news-feed/p/1254/. If you click that link on a browser where you are currently logged-in, it will direct you to the post itself. If you open the link on a browser where you are NOT logged-in, you will be redirected to BuddyBoss’ login page. After logging-in, it will then redirect you to the post.

    However, after installing the plugin, this redirection after login feature no longer works. After logging-in, I am now getting redirected to a URL like this one: https://example.com/members/john/visibility-protected/. The page will be showing a 404 error and does not redirect me correctly to the post.

    Can you look into this? What we would want to happen is for the login redirect feature to still work even when we have enabled the profile visibility features of the plugin, for example, setting the profile to friends-only.

    I can provide more details and a video recording if needed, just let me know.

    Thank you!

  • Keymaster
    (BuddyDev Team)
    Posts: 24697
    Brajesh Singh on March 15, 2021 at 8:15 pm #36862

    Hi Thomas,
    Thank you for using the plugin.

    Form the above link, It seems to me that the activity belongs to a user who has marked their profile private(or restricted to their friends etc).

    If you can, Please switch as “John” and check their Privacy settings. This is an expected behaviour for private/restricted profile.

    Please do let me know if that is not the case.

    Regards
    Brajesh

  • Participant
    Level: Initiated
    Posts: 7
    Thomas Kamplain on March 16, 2021 at 1:57 am #36877

    Hi Brajesh!

    Thanks for your reply! Yes, the activity belongs to a user who has marked their profile private. However, that user is me so I was expecting that I can still see my own post after I log in.

    Below are the steps to replicate the problem. I will also share a video recording of our site in a separate private reply to give you a better picture of the problem.

    1. Enable the “Private Website” setting of BuddyBoss
    2. Set the profile visibility of the user who will be making the post to “Only Me (private)”
    3. Post a new update on the news feed (activity feed)
    4. Using a separate account, write a reply to the post
    5. An email notification will be sent to the user notifying him that there was a reply to his own post
    6. Open the link on a browser session where no one is logged-in (incognito browser)
    7. A 404 error appears as I try to view the reply to my own post

    Is there a solution for this, so that I can still be directed to my own post after I login successfully?

  • Participant
    Level: Initiated
    Posts: 7
    Thomas Kamplain on March 16, 2021 at 1:59 am #36878
    This reply has been marked as private.
  • Keymaster
    (BuddyDev Team)
    Posts: 24697
    Brajesh Singh on March 17, 2021 at 12:19 am #36909

    Hi Thomas,
    Thank you so much for the video. I can see the issue. I believe I can lower the priority of our protection handling code to fix this issue. That will only fix if the site access is restricted(as in your case).

    Please allow me upto 48 hours to push a release.

    Regards
    Brajesh

  • Participant
    Level: Initiated
    Posts: 7
    Thomas Kamplain on March 17, 2021 at 1:54 am #36911

    That’s great, Brajesh! Thank you!

    On our main site, we are using Paid Memberships Pro and a custom code to handle the login redirect feature. We used to utilize the “Private Website” feature of BuddyBoss before and we also used that on our staging site to easier troubleshoot this problem with the Profile Visibility Manager. They follow the same approach though, they will append a “redirect_to” attribute to the login URL so that the user can get redirected to the referrer page after they have logged in. Can the fix/new release cover this as well? Or maybe, should I just adjust the priority of our custom code?

    I’ll share another video from our main site on a separate private reply.

  • Participant
    Level: Initiated
    Posts: 7
    Thomas Kamplain on March 17, 2021 at 1:54 am #36912
    This reply has been marked as private.
  • Keymaster
    (BuddyDev Team)
    Posts: 24697
    Brajesh Singh on March 17, 2021 at 2:36 pm #36919

    Hi Thomas,
    Thank you.

    Can you please share the custom code? I need to see on what action the protection kicks in from the BuddyBoss/PmPro and change our priority to something lower.

    Regards
    Brajesh

  • Keymaster
    (BuddyDev Team)
    Posts: 24697
    Brajesh Singh on March 17, 2021 at 2:39 pm #36920

    Sorry, I had not gone through the video. I can see the code/action now.

    Will be pushing an update today.

    Regards
    Brajesh

  • Keymaster
    (BuddyDev Team)
    Posts: 24697
    Brajesh Singh on March 17, 2021 at 7:47 pm #36926

    Hi Thomas,
    Please upgrade to 1.8.7. It fixes the compatibility issue.

    Regards
    Brajesh

The topic ‘ [Resolved] Make BuddyPress Profile Visibility Manager work with BuddyBoss’ Private Website’ is closed to new replies.

This topic is: resolved