Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

Subscribers not affected to subsite they joined

Tagged: 

  • Participant
    Level: Initiated
    Posts: 4
    hakim.d on February 20, 2018 at 12:53 pm #13497

    Hello everybody,
    I’m having issue with wordpress 4.8.3 and buddypress 2.9.2.
    users subscribing in subsite ‘A’, after account validation and connection on subsite, aren’t affected to the subsite they joined (they have no subsite affected and are only visible by network super-admin).
    thanks for help.
    Hakim

  • Keymaster
    Level: Yogi
    (BuddyDev Team)
    Posts: 3115
    Ravi on February 20, 2018 at 5:41 pm #13501

    Hello Hakim,

    Thank you for posting. Please try the following code in your ‘bp-custom.php’ file. If do not how what is bp-custom.php. Please refer the following url
    https://buddydev.com/docs/guides/guides/buddypress-guides/what-is-bp-custom-php/

    
function buddydev_modify_permissions() {

	$bp = buddypress();

	if( ! empty( $bp->members->admin ) ) {
		$bp->members->admin->capability ='manage_options';
	}
}
add_action( 'bp_init', 'buddydev_modify_permissions', 11);

    and let me know if code works or not.

    Thank You
    Ravi

  • Participant
    Level: Initiated
    Posts: 4
    hakim.d on February 21, 2018 at 9:38 am #13508
    This reply has been marked as private.
  • Keymaster
    Level: Yogi
    (BuddyDev Team)
    Posts: 3115
    Ravi on February 21, 2018 at 10:24 am #13509
    This reply has been marked as private.
  • Participant
    Level: Initiated
    Posts: 4
    hakim.d on February 21, 2018 at 11:12 am #13510

    Thanks Ravi,
    ok for that.
    but once the user ‘tester1’ is activated by ‘usersubsite1’, he becomes hidden from subsite1 admin.
    the user ‘tester1’ has no site affected in his profile (connect as admin to see that).
    This is the problem : once activated, ‘tester1’ is no longer a member of subsite1.

    thank you

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on February 23, 2018 at 9:26 pm #13553

    Hi Hakim,
    At the moment, WordPress does not keep the blog where user registered. That’s why while activating, It is not known on which blog the user registered.

    The issues I see from the previous code:-

    1. Any blog admin can activate any user

    A solution will be to
    1. Either add user to the blog where their account is activated. It’s easy
    2. Or Write the codes to keep a tab of the blog where the user registered, filter the pending list by blog id and only allow admins to activate users on their on registered site

    We won’t be able to assist you with the second case as it needs a lot of time and we are unable to provide free support for such task.

    For the first case, if that can be helpful for your site, please let me know and I or @ravisharma, will post the code.

    Regards
    Brajesh

You must be logged in to reply to this topic.

This topic is: not resolved