Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

Secure media

  • Participant
    Level: Enlightened
    Posts: 78
    Jay Anderson on January 27, 2016 at 2:54 am #2434

    Chinook.school-core.com
    Multisite
    Buddypress installed on Main Site
    Wordpress Version 4.4.1
    Buddypress Version 2.4.3

    Hello,

    I’m running a Multisite Network with Buddypress installed on the main site. The network is for a high school and we need to have it secure. You have given me great advice in the past with securing everything and thank you for that.

    What I need to do now is to be able to secure the media on the students sites. As of right now the pages are all password protected but the media can still be accessed if the url is entered in.

    I’ve been looking at a couple of different options for securing the media library but none that work ideal.

    My question is
    1. Would MediaPress be an option to install on each student site and then have the media secure?

    2. Does MediaPress allow PDF, Word docs, etc to be viewed? I’m currently using Google Doc Embed to view the students private PDF docs. (resume, cover letter, etc.)

    We don’t want this information being accessed unless the student gives the password to a potential employer, teacher, parent, etc.

    Any suggestions would be appreciated. My goal is to secure the Network as much as possible.

    Regards,

    Jay

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on January 27, 2016 at 8:48 am #2435

    Hi Jay,
    Thank you for asking.

    1. It’s is very resource intensive to block media completely by media file url. Even Facebook does not do that. If you have direct url to the image(image file), You can access it even on facebook. What facebook does is creates obfuscated file names to avoid simple recognition. It is still doable per media file, but I do not recommend that as it will exhaust the servers.

    If we instead obfuscate the file name and use media page url instead of media file url(the file url is not visible, but someone can right click and say open image url ), It is easy to restrict users out of the box.

    Yes, MediaPress is capable of blocking completely, but I do not recommend that method as it will a lot more exhustive for resources( example, filer are not directly accessible and are read via php, will consume memory and cpu).

    2. MediaPress comes with doc files support. It also includes google doc viewer for doc files by default. So, all you need to do is configure the extensions on MediaPresssettings page. If you want to use a different viewer, It is possible to write that and plugin instead of google doc viewer.

    So, easy solution will be marking a Media as friend only(or private) and only friends will be able to see that.

    It is even possible to share a Media with an individual person(we have flexible API inbuilt, but that will need some custom coding to provide an interface).

    Please let me know which way you want to go.

    Thank you
    Brajesh

  • Participant
    Level: Enlightened
    Posts: 78
    Jay Anderson on January 28, 2016 at 9:43 am #2440

    Hello Brajesh,

    Thanks for the reply. I’m not too concerned about the media on the main site that has buddypress. What I was hoping for was on the students individual sites in the the Multisite.

    I currently give each student his/her own website in the multisite when they register. This site is their private online portfolio where they upload resumes, cover letters, etc. that has personal information that we do not want public. The only way a person other than the student can view the site is by getting the password from that student.

    Do you think there is a way to secure the media library on each site? Maybe the easiest way would to create a template for the resume that the student fills out?

    Thanks for the help and any ideas are greatly appreciated.

    Jay

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on January 29, 2016 at 1:01 am #2443

    Hi Jay,
    Thank you for clarifying.

    There are a few solutions for this available.

    You may want to look at these and see if it solves the issue

    1. https://wordpress.org/plugins/media-vault/
    2. https://wordpress.org/plugins/delightful-downloads/

    I will prefer the first one as that does not have any extra UI requirement and uses WordPress uploader.

    Please give it a try and let me know how it goes.

    Thank you
    Brajesh

  • Participant
    Level: Initiated
    Posts: 1
    Lluís Forns on January 29, 2016 at 11:03 am #2445

    How do I “block completely” access to unauthorized content? my site has low traffic but privacy is a must.

    Thanks

  • Participant
    Level: Enlightened
    Posts: 78
    Jay Anderson on February 2, 2016 at 9:00 am #2479

    Hi Brajesh,

    I can’t seem to get the Media Vault Plugin to work with the New version of WordPress. The Plugin hasn’t been updated in over 2 years.

    Since I am running a multisite it asks for an extra step by adding some code into the .htaccess file. This doesn’t seem to work.

    If you have any other ideas I would appreciate it.

    Thanks

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on February 3, 2016 at 5:17 am #2484

    Hi Jay,
    I am looking at the Media Vault and will have some solution by the day end.


    @enboig
    I have replied to your ticket on MediaPress gihub repo, we may not add that type of privacy in core.

You must be logged in to reply to this topic.

This topic is: not resolved