Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

Network User Role

Tagged: , ,

  • Participant
    Level: Enlightened
    Posts: 78
    Jay Anderson on September 13, 2015 at 3:24 am #488

    Multisite
    Buddypress on the main site

    I am looking for a way to allow certain user to have some of the Super Admin capabilities but not have access to everything.

    I’m running a school site where each student gets his/her own blog. I have the network secure and only teachers and students can have access.

    I have the WPMU plugin Multisite Privacy. I have the default is set to password protect or to Only allow a registered user to see a site for which they are registered to.

    This works great, except the teachers don’t have access to the blogs unless they register or get the password. The sites also don’t show on the BP profile. I need the teachers to be able to see the students blog from the BP profile and then have access to that blog.

    Is there a way to give them some Super Admin capabilities to the teachers? For example, just the ability to access the students blogs without the registering or getting the password?

    I don’t want them to access the plugins, themes, etc.

    Any suggestions would be greatly appreciated.

    Thanks,

    Jay

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on September 14, 2015 at 2:24 pm #491

    Hi Jay,
    Thank you for asking. Sorry, I could not reply on the weekend.

    On a multisite, if a user is part of one site, they don’t get any role on other sites. So, The strategy we need to put is something that can check for user types on al sites.

    Two possible options:-

    1. Paid solution:- Check if multisite privacy supports capability/roles, if yes, Hopefully Andrea’s Network roles plugin
    http://wpebooks.com/network-roles/ can be used to assign teacher a role and allow this roile access to all blogs without new registration.

    2. If the Multisite privacy plugin provides a filter/action we can simply hook to that. The strategy should be in the User Edit page add an extra meta field that identifies the user as teacher. Since this meta is globally available, use it to check for the user and granting access to student blog.

    If you can check the multisite privacy code and Let me know, I can provide code for the 2nd option.

    Hoe that helps.

    Brajesh

  • Participant
    Level: Enlightened
    Posts: 78
    Jay Anderson on September 14, 2015 at 5:29 pm #494

    Hi Brajesh,

    I just want to say thank you for all the help. I really appreciate it.

    I downloaded the Network Roles plugin and it works great. I don’t think I will need to change the editor role to teacher because I will be changing that role and the teachers won’t be seeing that.

    There is one more thing that I hope you can help me with. When I go to the members profile on the buddypress main site and look at their sites I still can’t see the students blog site. (The sites that are password protected) Do you know of a way to allow them to be visible? I need the teachers to be able to find the students blogs without having to manually type in the blog url.

    I hope that make sense.

    Thanks again,

    Jay

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on September 14, 2015 at 7:37 pm #496

    Hi Jay,
    You are most welcome.

    Since Password protected blogs are not part of WordPress, I believe The Multisite Privacy is protecting it. can you tell me if that plugin says it is BuddyPress compatible? Also, are you comfortable with phpmyadmin? If yes, check for wp_bp_user_blogs and see if there are entries resent there?

  • Participant
    Level: Enlightened
    Posts: 78
    Jay Anderson on September 14, 2015 at 9:43 pm #498

    Hey Brajesh,

    yes the plugin in compatible with buddypress. I have found the same question on the wpmu forum but didn’t really get an answer other than this.

    “As Patrick pointed above, our plugin is adding some settings and hooking into some views, but this particular behavior is beyond our control.

    This is the default behavior for buudypress. The Sites list query is defined into the static method BP_Blogs_Blog::get().

    If you take a quick look you will find the following condition:
    if ( !is_user_logged_in() || ( !bp_current_user_can( ‘bp_moderate’ ) && ( $user_id != bp_loggedin_user_id() ) ) )
    $hidden_sql = “AND wb.public = 1″;
    else
    $hidden_sql = ”;

    Which basically means to exclude the non indexable sites, except for the superadmin or the blog owner if the scope of the query is personal (‘My Sites’ tab).

    If you need to show a list of all your sites no matter if they are public or not, then you would need to create a custom query. You can simply take the BuddyPress query and modify it according to your needs.”

    I’m not to sure exactly how to modify the custom query.

    Thanks again for the help,

    Jay

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on September 15, 2015 at 7:26 am #503

    Hi Jay,
    Thank you for the details.

    To be honest, They are correct. Their plugin is marking the blog non public and BuddyPress hides any non public blog.

    I looked into the sql, the problem is there is no early hook to handle it. The only hooks available are
    ‘bp_blogs_get_blogs’ and ‘bp_hs_blogs’ and if we hook to any of these two, It will be like effectively repeating the whole thing.

    How large is your network?

  • Participant
    Level: Enlightened
    Posts: 78
    Jay Anderson on September 15, 2015 at 4:11 pm #508

    Hi Brajesh,

    as of right now the largest network I have is 800 sites. I will have more signing up with the new school year happening.

    Jay

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on September 15, 2015 at 4:20 pm #509

    Hi Jay,
    I can provide you a solution based on the above two hooks but that won’t be efficient enough.

    Also, Can you please tell me how the network identifies a teacher( role or capability ) and I will post the code.

  • Participant
    Level: Enlightened
    Posts: 78
    Jay Anderson on September 15, 2015 at 4:39 pm #510

    Hi Brajesh,

    I used the Andrea’s Network roles plugin http://wpebooks.com/network-roles/ and your BP Xprofile Member Type Field & BP Member Type Generator.

    When a new user signs up they are required to say if they are a student, teacher or staff. I will verify each teacher and then use the Network plugin to change their role to editor. They teacher will be granted editor role to all of the blogs.

    I might make it a requirement that the student inputs their blog url in the profile field.

    Thanks for all the help.

    jay

You must be logged in to reply to this topic.

This topic is: not resolved