Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

Replies

  • Participant
    Level: Enlightened
    Posts: 47
    Alex on September 25, 2024 at 10:13 pm in reply to: [Resolved] PHP warning when activating plugin BuddyPress Profile Data Control #53199

    By the way I was using BP nouveau template pack. Because you were asking.

    • This reply was modified 2 months, 3 weeks ago by Alex.
  • Participant
    Level: Enlightened
    Posts: 47
    Alex on September 25, 2024 at 9:57 pm in reply to: [Resolved] PHP warning when activating plugin BuddyPress Profile Data Control #53198

    Hello Brajesh,

    I made another test to reproduce the error. On localhost I didn’t have this error yet.

    Its the same procedure what I wrote above.
    Plugins activated: Your data control plugin (current version), bp classic and buddypress (both current version).
    Themes tested with: Astra and twenty twenty four.

    The name field is the only field on xfields section which you cannot delete. Make the changes at your plugin which I made the screenshot from (switch “who can edit” from Adminstrator to Subscriber).
    Then you get the warning. This time with debug on I got a more detailled warning. I also attach these image here. Hope this helps.

    This is all what I can do to help to fix that issue.

    Meanwhile I programmed my own plugin for my needs with the advantage that I know whats going on.

    So I don’t need this plugin anymore. If you want you can mark this thread as solved.

    https://postimg.cc/xXfFtdB5

    Error message
    https://postimg.cc/JDVF3Q8D

  • Participant
    Level: Enlightened
    Posts: 47
    Alex on September 25, 2024 at 10:00 am in reply to: [Resolved] PHP warning when activating plugin BuddyPress Profile Data Control #53195

    Hello Brajesh,
    could you give a short report that you are able to reproduce the warning and are working on a fix?
    Otherwise I need to look after other solutions like this one f.e.
    https://buddypress.org/support/topic/dont-allow-users-to-change-some-fields-after-sign-up-hide-those-fields/
    because I dont want, that subscripers can edit their username after registration.

    Thanks for giving a short update on this!

  • Participant
    Level: Enlightened
    Posts: 47
    Alex on September 25, 2024 at 1:11 am in reply to: [Resolved] PHP warning when activating plugin BuddyPress Profile Data Control #53191

    This is what I found out.
    The warning did not occur on my staging site. So I switched on/off different parameters.

    Then when I changed the username xfield in the backend at “who can edit” from all members to administrator the warning occurs on my staging site as well.
    The worst is, that making this change undo didn’t solve the problem. Nor a reinstall of the plugin or cache delete.
    The only way at the moment to prevent this error message from occuring is to leave the plugin deactivated. So this setting must have saved values which are not beeing cleaned after plugin deletion.

    Strange behaviour also, when using query monitor to see more details of the problem the warning message doesn’t appear.

    • This reply was modified 2 months, 3 weeks ago by Alex.
  • Participant
    Level: Enlightened
    Posts: 47
    Alex on September 24, 2024 at 9:06 pm in reply to: [Resolved] PHP warning when activating plugin BuddyPress Profile Data Control #53190

    Hello Brajesh,
    ok, I switched off everything except this plugin adn buddypress 14.1.0 and bp classic. I also switched theme from Astra to twenty twenty four.

    As an admin no errors. But again, logged in as a subscriper I have the issue.
    So as you said, I suppose it has to do with the settings.

    I will make further checks and come back to you afterwards.

  • Participant
    Level: Enlightened
    Posts: 47
    Alex on September 24, 2024 at 7:20 pm in reply to: [Resolved] PHP warning when activating plugin BuddyPress Profile Data Control #53187

    1. Plugin is deactivated.
    2. login as User/subscriber
    3. Go to profile / settings / user data and change some of this users data like gender, age or whatever
    4. Click save
    Succesfully saved

    5. Now activate the plugin and do the same.
    When clicking save data, white screen with the warnings appear doesn’t matter which xprofile field you have changed.

    • This reply was modified 2 months, 3 weeks ago by Alex.
  • Participant
    Level: Enlightened
    Posts: 47
    Alex on September 9, 2024 at 5:46 pm in reply to: Change background color of members loop label #53132

    Thanks again for your answer.

    You solution changes the background color of the selected filter. I don’t see any advantage in just adding css and overwrite the grey with a prefered color.

    In my case I wanted the grey label green when active filter ist selected, red when newest member and blue when random. But as I worried this is not possible adding code to the members loop directly to id the label.

    To do this is probably to much effort, isn’t it?

  • Participant
    Level: Enlightened
    Posts: 47
    Alex on September 8, 2024 at 5:44 pm in reply to: Change background color of members loop label #53127

    Hello Ravi,
    thanks for your answer. Unfortunately I cant provide you with these credentials because the site is not public yet and protected.

    The tag where I want to change the background color has no different id’s or classes for active, random or newest member seach. So I wonder how you want to assign different colors just using CSS?

    SourceCode:
    <li id=”members-all” class=”selected” data-bp-scope=”all” data-bp-object=”members”>
    Active Members <span class=”count”>4</span>

    I can use li a { background-color: blue; } but again, then ALL labels are in blue.

    Regards

  • Participant
    Level: Enlightened
    Posts: 47
    Alex on August 7, 2024 at 8:53 am in reply to: conditional-profile-fields-for-buddypress plugin error #52957

    Hello Brajesh,
    works! Thanks for quick fix!

    Regards

  • Participant
    Level: Enlightened
    Posts: 47
    Alex on July 31, 2024 at 8:53 am in reply to: [Resolved] How to display bullet lists on the user profile? #52904

    I know, I know. But after weeks of testing, googling, asking developers and so on, this was the easiest way to make it work. Finally. In my opinion buddypress dev team should remove old tinymce 4.9. Or, at least letting admins use other rich text editors easily. As I wrote this is not only my wish.

    Ups, I put the code into functions.php.

    But isn’t your approach a security issue? It switch off kses for all fields, right? So isn’t modifying this core file the better choice in this case?