Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

restrict upload types buddypress

  • Participant
    Level: Enlightened
    Posts: 66
    phil may on November 24, 2018 at 6:16 am #18969

    This isnt related to one of your plugins but I cant find any info regarding this anywhere

    On a test account I was function testing my default role for new buddypress members and when I changed my profile picture I was able to upload a zip file in the media uploader. How do i restrict a role to only be able to upload photos/videos?

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on November 24, 2018 at 6:19 am #18970

    Hi Phil,
    It is not related to BuddyPress.

    BuddyPress does not uses the media uploaded(modal box). It is the theme that uses it.

    Also, BuddyBlog too filters on the upload to allow users upload. So, if you are using BuddyBlog, try disabling and trying again.

    If it is still allowing, It is the Arcane theme as they have implemented profile photo update via media uploader.

    Regards
    Brajesh

  • Participant
    Level: Enlightened
    Posts: 66
    phil may on November 24, 2018 at 7:27 am #18973

    maybe i can just block filetypes in uploads with htaccess rules

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on November 24, 2018 at 7:48 am #18976

    Hi Phil,
    I am not sure of that is the right thing to do.

    My approach will be to find the issue and get it fixed in the respective component. I know from your previous reply that the theme support is a bit slow but it is their implementation and you should ask them to fix it.

    Even if they take a week or 2 it is always better than patching the issues which should not have been the issue in the first place.

    Regards
    Brajesh

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on November 24, 2018 at 7:55 am #18977

    Hi Phil,
    I am not sure of that is the right thing to do.

    My approach will be to find the issue and get it fixed in the respective component. I know from your previous reply that the theme support is a bit slow but it is their implementation and you should ask them to fix it.

    Even if they take a week or 2 it is always better than patching the issues which should not have been the issue in the first place.

    Regards
    Brajesh

  • Participant
    Level: Enlightened
    Posts: 66
    phil may on November 24, 2018 at 8:21 am #18980

    I agree with you 100%, but whenever i mention to them a buddypress compatibility issue they act insulted as if I am talking bad about the work they’ve done, but in reality all I’m doing is trying to improve usability for everyone including myself. I feel like they dont actually know how to fix it and the only way I will get them to implement any improved code is if i give it to them. I might be good at finding bugs and issues but I sure cant write php!

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on November 24, 2018 at 4:49 pm #18985

    Hi Phil,
    That’s sad to hear.

    I believe they should own the responsibility for their mistakes and fix it. There is no shame in it.

    Let me write it in public, the Arcane theme is a mess. For BuddyPress Part, They don’t know what they have done and it is a huge problem for site maintainers.

    As far as we are considered, we are going to put it in the black list (In non supported items from us unless they improve it).

    Regards
    Brajesh

You must be logged in to reply to this topic.

This topic is: not resolved