Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

Replies

  • Participant
    Level: Initiated
    Posts: 19
    Brett on May 17, 2017 at 2:22 am #9169

    Brajesh,

    Whilst I no longer need this (I used jquery to make my fields required, so that it does the validation before the form is submitted) I still think this is a bug.

  • Participant
    Level: Initiated
    Posts: 19
    Brett on May 11, 2017 at 11:59 pm #9094

    I hope so!
    The issue only rears it’s head when there is an error with required fields, and when BuddyPress reloads the form with the submitted values that existed before the error, your plugin doesn’t appear to be triggered to show the conditional fields.

    I don’t think I need assistance with the validation, as I have javascript that deals with that, unless my two lots of javascript that deal with 1 – hiding field 56 if field 6 is set to a certain value (using the change event) and 2 – Hiding field 56 on page load if it is set to that same vaue

    If needed, I can provide those.

    All the fields are dependent on that value displayed in field 6. It appears to be that since the page is reloading with a value that is not yet saved in the xprofile field, that it does not treat it properly.

  • Participant
    Level: Initiated
    Posts: 19
    Brett on May 9, 2017 at 11:21 pm #9057

    Brajesh,

    Is there a way to fire off the trigger that shows the fields, when the profile form is reloaded after an error, and loads the values that were entered before the error?

    This is what is not doing on a page reload when a required profile field has an error.

    • This reply was modified 7 years, 7 months ago by Brett. Reason: Incorrectly marked as resolved and provided incorrect information
  • Participant
    Level: Initiated
    Posts: 19
    Brett on May 9, 2017 at 11:18 pm #9056

    I have found javascript to work around this, and it is now working as expected.

  • Participant
    Level: Initiated
    Posts: 19
    Brett on May 1, 2017 at 2:27 am #8917

    Thanks for the example, I understand the code, but this is once the account is already created. They are editing their profile, rather than signing up, so the sign up validation hook isn’t going to work.

    The field in question that gets hidden depending on the value is 56, and the field that it depends on for this is 6.

  • Participant
    Level: Initiated
    Posts: 19
    Brett on March 28, 2017 at 10:25 pm #8306

    Brajesh, got to the bottom of this, had issues with code that was leaving it in a position to not write cookies. I have cleaned these issues up and it now works as expected on activation.

    I had another plugin that had similar issues trying to deal with creating a cookie as well.

    Thanks for your assistance.

  • Participant
    Level: Initiated
    Posts: 19
    Brett on March 6, 2017 at 10:13 pm #7632

    Right now there is, W3TC is active.

  • Participant
    Level: Initiated
    Posts: 19
    Brett on March 5, 2017 at 10:48 pm #7616

    The following ones that might affect registration are:
    Allow multiple accounts (so I could get someone to help me test)- has been deactivated.
    Social Login (allows users to sign up/login with social media accounts)

    What I have noticed is that if I don’t try to redirect, it appears to be logged in. My Sign Up and Login disappear on my menu and get replaced with a logout. Once I go to another page, it then shows as logged out again.

    Nothing else I can think of that should affect the registration.

    If you need me to list anything, let me know.

  • Participant
    Level: Initiated
    Posts: 19
    Brett on November 29, 2016 at 10:36 pm #6552

    That has made no difference, user is still not logged in when they activate.
    BTW, it is not sending an email when the account is activated either, in case this makes any difference to what might be occuring.

    For now I will disable the plugin due to release pressures, but I would like it to work like this to allow users an easier activation and profile filling process

    • This reply was modified 8 years ago by Brett.
  • Participant
    Level: Initiated
    Posts: 19
    Brett on November 29, 2016 at 12:52 am #6536

    I have quite a few plugins that appear to work on that hook. Here is my list
    public_html/wp-content/plugins/bp-xprofile-location/inc/pp-field-type-location.php: add_action( ‘bp_core_activated_user’, array($this, ‘pp_loc_activated_user’), 15, 3 );
    public_html/wp-content/plugins/conditional-profile-fields-for-buddypress/bp-conditional-profile-fields.php: add_action( ‘bp_core_activated_user’, array( $this, ‘update_saved_fields’ ) );
    public_html/wp-content/plugins/buddypress/bp-xprofile/bp-xprofile-functions.php:
    add_action( ‘bp_core_activated_user’, ‘xprofile_sync_wp_profile’ );
    public_html/wp-content/plugins/buddypress/bp-members/bp-members-functions.php: do_action( ‘bp_core_activated_user’, $user_id, $key, $user );
    public_html/wp-content/plugins/buddypress/bp-members/bp-members-functions.php: do_action( ‘bp_core_activated_user’, $user_id, $key, $user );
    public_html/wp-content/plugins/buddypress/bp-members/bp-members-activity.php: *@param array $user Array of userdata passed to bp_core_activated_user hook.
    public_html/wp-content/plugins/buddypress/bp-members/bp-members-activity.php:
    add_action( ‘bp_core_activated_user’, ‘bp_core_new_user_activity’ );
    public_html/wp-content/plugins/buddypress/bp-core/bp-core-cache.php:add_action( ‘bp_core_activated_user’, ‘bp_core_clear_member_count_caches’ );
    public_html/wp-content/plugins/bp-member-type-manager/includes/bp-member-type-manager-actions.php:add_action(‘bp_core_activated_user’,’bmtm_assign_role_on_registration_activation’, 10, 3);
    public_html/wp-content/plugins/bp-auto-login-on-activation/bp-autologin-on-activ ation.php:add_action( ‘bp_core_activated_user’, ‘bp_autologin_on_activation’, 40, 3 );

    I have removed the BP Member Type Manager, as I no longer need it, but your Autologin on activation is one of them, and the other two – BP xProfile Location and Conditional Profile Fields for BuddyPress were both disabled.
    The rest look to be core files of BuddyPress