Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

[Resolved] Media link or post_name not found unexpectedly displays another image instead

Tagged: , , , ,

  • Participant
    Level: Master
    Posts: 279
    Richard Foley on January 14, 2018 at 10:29 am #12865

    When a media is not found via it’s post_name directly, another image is displayed, which has a *similar* post_name. At first sight this might seem helpful, however it can be very disconcerting for a user to click one image and to get one from another user instead.

    MariaDB [mynaktiv]> select id, post_author, post_name from wp_posts where post_type = 'attachment' and post_name like 'december_17__2016%'; 
+--------+-------------+---------------------+
| id     | post_author | post_name           |
+--------+-------------+---------------------+
|  92150 |       12246 | december_17__2016   |
|  94454 |       12247 | december_17__2016   |
|  94452 |        9991 | december_17__2016-2 |
| 100555 |        9991 | december_17__2016-3 |
| 100556 |        9991 | december_17__2016-4 |
+--------+-------------+---------------------+

    In this case, if user 9991 clicks a link to /members/profile-9991/mp/wall-9991/december_17__2016/, what is actually loaded is the image for user 12246, so: /members/profile-12246/mp/wall-12246/december_17__2016/

    Helpful, but not really helpful 🙂

    R.

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on January 14, 2018 at 12:18 pm #12866

    Hi Richard,
    I am sorry for the inconvenience.

    This is strange and should never happen.

    Here is the check we are using

    
$post = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM {$wpdb->posts} WHERE post_name = %s and post_type = %s ", $slug, mpp_get_media_post_type() ) );

    We are not using like, in the above test so I am not sure how this happened for you.

    Can you please point me to the code(It might be related to something else).

    Regards
    Brajesh

  • Participant
    Level: Master
    Posts: 279
    Richard Foley on January 14, 2018 at 6:20 pm #12878

    It’s not clear to me exactly how it’s happening, all I know at this stage is that this is the result of that URL call. One thing I notice though. The post_name is clearly not unique, and I seem to recall you saying this was required at some point…?

    R.

    • This reply was modified 6 years, 11 months ago by Richard Foley.
  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on January 14, 2018 at 6:22 pm #12879

    Hi Richard,
    May I know how the two attachment post_name are same? Should not they be unique?

  • Participant
    Level: Master
    Posts: 279
    Richard Foley on January 14, 2018 at 6:29 pm #12882

    ha ha, we both reached the same conclusion at (almost) the same time 🙂 Ok, I’ll fix my data, and close the ticket.

    Thanks Brajesh, sorry for the bother.

    • This reply was modified 6 years, 11 months ago by Richard Foley.
    • This reply was modified 6 years, 11 months ago by Richard Foley.
  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on January 15, 2018 at 7:44 pm #12901

    No problem 🙂

The topic ‘ [Resolved] Media link or post_name not found unexpectedly displays another image instead’ is closed to new replies.

This topic is: resolved