Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

Understanding MediaPress Activity privacy

Tagged: , ,

  • Keymaster
    (BuddyDev Team)
    Posts: 24697
    Brajesh Singh on September 6, 2015 at 8:06 am #381

    Hi All,
    This is a reference topic if you want to understand MediaPress Activity privacy and how it works.

    BuddyPress has only 2 states for activity either public( visible to everyone ) or hidden( only visible to the user who posted it)

    There is no activity privacy for restricting updates to ‘loggedin’, ‘friends’, ‘groups’, ‘followers’, ‘following’ etc.

    In MediaPress, we call privacy ‘status'( just the terminology). A Media has a status or a gallery has a status that describes who can access that media or gallery.

    We have implemented the status well and it restricts the visibility of the gallery/media on profiles/directory/groups etc properly.

    The problem arises when a Media is published to activity or a comment is made on the Media. Logically, these new activity should have same visibility as the parent item or more restrictive visibility.

    In future, BuddyPress will certainly have more privacy states where we can map our own custom status to those privacy levels.

    For now, We have mapped our status to the privacy levels provided by BuddyPress Activity privacy

    https://wordpress.org/plugins/buddypress-activity-privacy/

    You don’t need this plugin if you just need the public/private status in the activity. If you need friendsonly, groups only or other available status, you will need this plugin to enforce the visibility in the activity stream.

    Please do note that BuddyPress Privacy plugin is not a requirement but an enhancement. If you add it, It will enhance the privacy experience.

    Hope this post clarifies.

    PS: Here is how we have implemented the mapping of status to activity privacy

    https://github.com/buddydev/mediapress/commit/9efbd8b17c4fce2ed5698c24dac03aee2b5e7ee8

    As you see, when registering a status, we provide an extra arguement ‘activity_privacy’ that maps our current status to the BuddyPress Activity Privacy levels provided by the plugin.

  • Participant
    Level: Initiated
    Posts: 3
    Georg.io on February 17, 2016 at 4:43 am #2665

    Hi Brajesh

    it’s not a good idea to map Mediapress privacy to BP Activity Privacy. This plugin is bad (conflicts with other plugins) and its developer rather unreliable. Privacy is a very important thing, you cannot trust someone who is not present at the WordPress support forum. I have a lot of questions about his plugin but he has disappeared. So I deactivated his plugin and that affects Mediapress.

    Greetings
    Georg.io

  • Keymaster
    (BuddyDev Team)
    Posts: 24697
    Brajesh Singh on February 17, 2016 at 10:48 am #2668

    Hi George,
    Thank you for posting.

    The BP Activity privacy plugin is not required just optional if you want to enforce the restricted activity visibility.

    Can you please let me know what type of issues you are facing at the moment?

    Thank you
    Brajesh

  • Participant
    Level: Initiated
    Posts: 3
    Georg.io on February 17, 2016 at 7:35 pm #2672

    Hi Brajesh,

    I wouldn’t call “just optional” a level as “friendsonly”. In my opinion it is the most important privacy level for a member. People become members of a network in order to find friends and share things with them. They don’t care about all the people (public level) and they will not keep their content just to see it only themselfs (private level). They want to share it with people they trust and protect it from haters.

    If you don’t install BP Activity Privacy, a member that choose the “friendsonly” level will see entries of its content in the activity stream. When clicking on the entries, they point to nothing, but that is half-privacy because the thumbnail of a photo, for example, is large enough. Same thing for “groupsonly”. Imagine if some members decide to create a group in order to discuss about professional projects. Members will feel betrayed by the site owner.

    But I don’t want to install BP Activity Privacy because of its developer. This man has not a professional attitude.

    Here is a screenshot: http://www.hostingpics.net/viewer.php?id=398536mediapressBPActivityPrivacy.png

    For me, the privacy of Mediapress should be total and independent and in my opinion that’s a priority.

    Greetings
    Georges

  • Keymaster
    (BuddyDev Team)
    Posts: 24697
    Brajesh Singh on February 17, 2016 at 7:48 pm #2676

    Hi Georges,
    Thank you. If this is the behavior then it is a deviation.
    In normal case only public media activity should be visible on activity, friendsonly and other levels should be hidden and only visible to the uploader user.

    To be honest, we are not implementing activity privacy as we believe it will come to BuddyPress sooner or later and the current schema of activity is not well designed to give fine grained control like facebook.

    What we are doing is piggybacking on the BuddyPress Activity Privacy plugin and falling back to BuddyPress behavior(like all or none).

    I am looking at it and I assure you that we will fix it soon to fallback to default BuddyPress behavior.

    Thank you
    Brajesh

You must be logged in to reply to this topic.

This topic is: not resolved