Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

[Resolved] Remove “Delete private message” Function

Tagged: 

  • Participant
    Level: Initiated
    Posts: 1
    Scappe on October 23, 2023 at 5:36 pm #50782

    I am trying to remove the possibility to delete private messages (display: none; is not enough, I want to remove it anywhere on the client side), to be clear I am talking about this link “https://mydomain.com/members/userName/messages/sentbox/delete/4/?_wpnonce=f08b25f7c8” or in alternative let normal users delete messages but let admin see every message ever sent (also deleted ones)

    Could anyone help me?

  • Participant
    Level: Initiated
    Posts: 1
    Scappe on October 24, 2023 at 8:07 am #50783

    Yo this is a message to the me of yesterday and to anybody else who is looking for a way to disable the delete message function; add this stuff into your functions.php:

    function prevent_bp_message_deletion( $wp ) {
    if ( isset( $_GET[‘_wpnonce’] ) && strpos( $_SERVER[‘REQUEST_URI’], ‘/messages/sentbox/delete/’ ) !== false ) {
    wp_redirect( bp_loggedin_user_domain() . ‘messages/sentbox/’ );
    exit;
    }
    }
    add_action( ‘wp’, ‘prevent_bp_message_deletion’, 1 );

  • Keymaster
    (BuddyDev Team)
    Posts: 24712
    Brajesh Singh on October 24, 2023 at 9:25 am #50786

    Hi,
    Thank you for the question and the solution.
    Here is another way to achieve the same.

    

/**
 * Disables message thread deletion.
 */
add_action(
	'bp_actions',
	function () {
		if ( ! bp_is_messages_component() || bp_is_current_action( 'notices' ) || ! bp_is_action_variable( 'delete', 0 ) ) {
			return false;
		}
		bp_core_add_message( 'Invalid action!', 'error' );
		bp_core_redirect( bp_loggedin_user_domain() . bp_get_messages_slug() );
	},
	5
);

    Please do note that if a theme deletes message via ajax, this code won’t apply in that case.

    Regards
    Brajesh

You must be logged in to reply to this topic.

This topic is: resolved