Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

Multiline texfield has no limitation for characters

  • Participant
    Level: Enlightened
    Posts: 47
    Alex on June 29, 2024 at 8:05 pm #52782

    I need to prevent users from crashing my site when typing thousands of words on a multiline textfield (user profile at the frontend).
    There have been several questions about this on the buddypress forum with no solution.

    For the tinymce editor which is been used at this field there is a doc but I cant it make work with the buddypress implementation.
    https://www.tiny.cloud/blog/set-character-count-limit/

    Do I have to remove the rich text editor? Help appreciated!

  • Keymaster
    Level: Yogi
    (BuddyDev Team)
    Posts: 3115
    Ravi on July 1, 2024 at 3:00 am #52795

    Hello Alex,

    Thank you for posting. By default, BuddyPress does not provide any multiline text field with the TinyMCE editor. It seems you are using a third-party solution for having such kind of field. In my opinion, it will be beneficial for you to reach out to the author for this issue.

    Regards
    Ravi

  • Participant
    Level: Enlightened
    Posts: 47
    Alex on July 1, 2024 at 10:59 pm #52815

    Maybe we have a misunderstanding.
    Have a look at this:
    https://ibb.co/SrCSz5k

    In the buddypress core there are code to put out a shorter version of tinymce with less items at the toolbar.
    Check class-bp-xprofile-field-type-textarea.php
    Anyway, I could also use the wordpress bio field which is a multiline textfield only without the editor.

    Meanwhile I found a solution for the tinymce editor which is javascript driven unfortunately. This means a user can switch it off, then has the normal textfield back and can write thousands of words and crash the layout.

    So let me ask again, is there any PHP solution for this texfield (multi-line text box or bio textfield) to limit the characters which beeing saved?

    Regards Alex

  • Participant
    Level: Enlightened
    Posts: 47
    Alex on July 2, 2024 at 10:19 am #52816

    I switched the value field from longtext to varchar at the xprofile data field in MySQL. Then it cuts off everything which is longer than the given limit no matter JS is switched on or not.

    Is this the way to go? I mean you are more into buddypress than me. If this change leads to other problems than plz tell me.

  • Keymaster
    (BuddyDev Team)
    Posts: 24697
    Brajesh Singh on July 2, 2024 at 1:06 pm #52817

    Hi Alex,
    Thank you for the replies.

    Ravi is not available right now, so I will assist.

    1. He was mistaken. BudddyPress does use tinymce for multiline text field by default. This can be disabled using a filter but that won’t stop users from adding long text.

    2. Switching the field to ‘text’ does not have much effec other than changing the UI in front end and some filters. It is still not restricting users(no validation for length) but the browser UI limits what user can enter.

    There is no proper solution as BuddyPress does not have a validation inside the xprofile_set_field_data that guarantees availability of field id.

    It is possible to use the filter bp_xprofile_field_type_is_valid for validating field data fro outside. This filter lacks direct access to field id for which data is being saved. There is an direct way to access field id some of the type(using field_obj reference when available). The problem is it may work in some context and may not work in others.

    If you know the field ids, I can put a few lines of code for validation. It should work in most of the context but will not guarantee blanket solution.

    Also, I forgot to mention, the problem with using above filter is it lacks the ability to show the proper error message.

    Regards
    Brajesh

You must be logged in to reply to this topic.

This topic is: not resolved