Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

Possible bug exposed via BP Member Types Pro & BP Registrations Options plugin

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on April 18, 2019 at 1:31 pm #22407

    Hi Sam,
    Thank you.

    The code proposed by George there will not work. It is for basic account fields (email,password, blog details) and not for xprofile fields. It seems George might be a bit mistaken there.

    There is a solution for xprofile fields. Please see my suggestion for removing required attribute on step 3 in this blog post.

    https://buddydev.com/buddypress-better-registration-part-1-remove-full-name-confirm-password-from-buddypress-registration/

    There is another way too using the filter ‘bp_get_the_profile_field_is_required’ which simplifies the task.

    For now, I am going to use ‘bp_get_the_profile_field_is_required’ and put a solution. That should solve our issues for now.

    Will be releasing an update in next 2-3 days(most probably early).

    Regards
    Brajesh

  • Participant
    Level: Enlightened
    Posts: 25
    Sam Morris on April 18, 2019 at 1:42 pm #22408

    Hi Brajesh – This is why I made the hint about you taking over that Approvals plugin (I didn’t mean forking it, btw, but just doing a better BuddyDev version of it)…because you’re always updating and adding features, where the other guy really has not (the wonders of capitalism!). Thank you very much for keeping up on this conditionally hidden xrofile fields issue. I’m really impressed. And I will take a stab at your solutions this afternoon when I get a chance, and look forward to your plugin’s permanent fix/update some time next week (if I’m understanding correctly).

    Thanks again,
    Sam

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on April 18, 2019 at 1:48 pm #22409

    Hi Sam,
    Thank you.

    I am sure I will be able to get it done this week itself(by Saturday).

    About the other plugin, I will need ideas for making it better. The value lies in ideas. If we can get some good ideas(I will be checking their forums), we can certainly have our own version 🙂

    Thank you
    Brajesh

  • Participant
    Level: Enlightened
    Posts: 25
    Sam Morris on April 18, 2019 at 1:51 pm #22411

    I will begin making some notes!

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on April 18, 2019 at 1:51 pm #22412

    Thank you. I am looking forward to them 🙂

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on April 22, 2019 at 5:38 pm #22511

    Hi Sam,
    Hope you are doing well.

    I have released BuddyPress Member Types Pro 1.3.3 now.
    It supports conditions on required field too. Please give it a shot.

    Regards
    Brajesh

  • Participant
    Level: Enlightened
    Posts: 25
    Sam Morris on April 22, 2019 at 8:34 pm #22519

    Hi Brajesh – I’ve updated to 1.3.3, and oddly (to me) now both your snippet (https://buddydev.com/support/forums/topic/possible-bug-exposed-via-bp-member-types-pro-bp-registrations-options-plugin/#post-22316) and the original BP Approvals plugin snippet doesn’t work. I’ve tried each separately, and his just isn’t doing anything, but yours is causing a Server 500 error. Would you mind offering me another look at your modified snippet?

    But for what it’s worth at this point, the submit button has not been an issue!

    Thank you!
    Sam

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on April 23, 2019 at 5:45 am #22520

    Hi Sam,
    My apologies for the inconvenience.

    Is the BuddyPress registration option plugin active?

    Regards
    Brajesh

  • Participant
    Level: Enlightened
    Posts: 25
    Sam Morris on April 24, 2019 at 1:59 am #22543

    Hi Brajesh – Yes, the BP Approvals plugin is active (as well as your plugin too, of course – even the conditionals one). The approvals is working, but it’s just that the snippet is supposed to “suppress” the approval process for one member type (“individual”, in my case, while passing all other member types through the approval process). However, the original snippet from the BP Approvals guy isn’t suppressing anything (all member types are going through the approval process), while your snippet is giving off a server 500 error (this didn’t happen before).

    Thanks,
    Sam

    P.S. And FYI, the Conditionals plugin isn’t working properly (in my observation) under a certain condition. I haven’t much played with it before, so perhaps this is the way it has always been. Don’t know. But for example, if a field X is to be shown only if selection Y is chosen, it’s being shown before selection Y is chosen, and subsequently hidden after selection Z is chosen instead (not Y). I have noticed that this conditional issue can be solved if I unselect all member type choices. However, then the field that’s now properly being shown conditionally is no longer appearing in the member’s BP profile and can’t therefore be edited (kinda defeating the purpose of having the field filled out in the first place). Hopefully you followed my logic!

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on April 24, 2019 at 5:02 am #22545

    Hi Sam,
    Thank you for sharing details.

    1. Please disable condition profile field plugin, The current member types pro conditions and conditional profile field don’t work well together. You can use only one of these 2 conditions for now. I am planning to re-add the support for conditional profile field plugin in future(It broke for registration when we added member type based registration conditions).

    2. I will be testing the “BuddyPress registration Options” plugin with the code snippet and will get back to you in couple of hours.

    Thank you
    Brajesh

You must be logged in to reply to this topic.

This topic is: not resolved