Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

[Resolved] Profile Visibility Manager Hide Friends List does not cover friends widget

Tagged: 

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on May 27, 2016 at 10:01 pm #4013

    Hi Bjoern,
    I am sorry. I forgot to remove some debug. Pushing another update in a minute and then will post back.

    Thank you
    Brajesh

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on May 27, 2016 at 10:12 pm #4014

    Hi Bjoern,
    1. There is an update available now and It should be fixed

    2. About Hiding Button:- Only the Request membership button is hidden for private groups. If the group is public or the profile is public/logged in that button will not be hidden. It is more aligned with the way hidden groups are. In case of hidden groups, there is no join button. I have done the same for private groups for specific members with inaccessible profile.

    Another reason I did it was to avoid adding complexity to the query that hides the members from all member lists. You are right about visibility of the user but this plugin works for the members lists only.

  • Participant
    Level: Enlightened
    Posts: 26
    Bjoern on May 28, 2016 at 5:21 am #4016

    Hi Brajesh,

    Thanks for the update. Really like all your plugins. – Hiding the friends widget works now perfect when the user sets his friends list to private. No more issues there.

    The group requests/invitations on the other side is giving me a little bit of a headache. I still don’t think that hiding the request button is a good solution. I understand that this only works for private groups and profiles set to private. However this is a very common scenario for a lot of users. In this very common scenario the user is completely unable to join the group unless he changes the privacy. He can’t even private message the group admin because the group admin is also hidden in a private group so he doesn’t know who the admin is. The group admin on the other side can’t send an invitation to the user even if they befriend each other unless the user sets his privacy to show up in member search. All this needs way too much explanation. In addition my Boss theme does not completely hide the group requests after your update. Your update hides the main request button but not the request tab where users can add a message to the group admin. The main button just redirects to this tab. I was still able to send out a group join request from my hidden test user but the admin again got the notification but it’s not showing the actual request when you click on it. I really think it would be better to allow and show the requests to the group admin even if the user sacrifices a little of his privacy there. Then it’s his choice. Otherwise he doesn’t have a choice, he simply can’t join at all.

    Thanks,
    Bjoern

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on May 28, 2016 at 10:05 am #4018

    Hi Bjoern,
    Thank you for the details and explanation. I will be updating the plugin and adding some filter specific for your case but in general, I will keep it this way till 2.0 when we are replanning everything.

    I will post back after the update today.

    Thank you
    Brajesh

  • Participant
    Level: Enlightened
    Posts: 26
    Bjoern on May 30, 2016 at 2:02 am #4025

    ok sounds great…thank you

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on May 30, 2016 at 5:29 pm #4038

    Hi,
    Thank you for your patience. I finally realized that you were more right than me. It is how we deal with private group members list/friends list/friends request list.
    I went with your suggestion and now the request group membership button will be available as well s the user will be listed in the member request.

    Please upgrade to 1.3.6 and let me know if that works for you or not?

    Thank you
    Brajesh

  • Participant
    Level: Enlightened
    Posts: 26
    Bjoern on May 31, 2016 at 3:19 am #4044
    This reply has been marked as private.
  • Participant
    Level: Enlightened
    Posts: 26
    Bjoern on June 3, 2016 at 9:19 pm #4096

    Did you see my reply the other day? I just saw that it was accidentally marked as private:

    Thanks so much Brajesh.
    I just tested 1.3.6 but unfortunately the group requests still don’t appear under “requests” for the group admin. I use the Boss theme from Buddyboss which comes with Ajax live notifications. The group admin gets the notification and an email about the request but when he clicks on the notification it shows the empty requests tab of the group. He can not accept the request. I am not quite sure what the problem is. This occurs when the profile is set to “Friends only”.

    Another less important thing I noticed is that when the group admin instead sends a request to that person (works when search visibility is on) and the person joins the group the respective activity entry in the newsfeed shows the correct avatar of [private user’s name] joined group xyz but the avatar links to another user (apparently to the group admin instead) although there’s no need for that. I am not quite sure whether that’s your plugin or some Buddypress bug but this only occurs with “friends only” private profiles.
    Best, Bjorn

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on June 4, 2016 at 12:53 am #4104

    Hi Bjoern,
    I am sorry I missed the last reply.

    I am looking at the issue and will get back to you again today.

    Thank you
    Brajesh

  • Participant
    Level: Enlightened
    Posts: 26
    Bjoern on June 7, 2016 at 10:50 am #4133

    Brajesh, thanks for your reply. Were you able to figure out what the problem is?

You must be logged in to reply to this topic.

This topic is: resolved