Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

Replies

  • Participant
    Level: Enlightened
    Posts: 34
    Milan Latinovic on February 8, 2021 at 7:36 pm #36126

    Hi Ravi,

    Thanks for looking into this.
    We were keeping “Enable Galleries for Groups” correctly checked, but the issue was still there. So, this was not the cause of the issue.

    In any case, for this project, we decide not to use MediaPress anymore. We will continue using other interesting plugins from BuddyDev but we removed MediaPress from our project.

    Therefore, I will mark this issue as resolved.

    Kind regards,
    Milan

  • Participant
    Level: Enlightened
    Posts: 34
    Milan Latinovic on February 1, 2021 at 6:52 am #35975
    This reply has been marked as private.
  • Participant
    Level: Enlightened
    Posts: 34
    Milan Latinovic on January 31, 2021 at 6:20 pm #35946

    Quick update.

    After disabling all plugins and leaving only bare-WordPress + BuddyPress + MediaPress issue is still there. This information might be helpful. So, it is not cross-plugin incompatibility.

  • Participant
    Level: Enlightened
    Posts: 34
    Milan Latinovic on May 5, 2020 at 7:06 pm #29537

    Hi Brajesh,

    Sadly, DK PDF plugin is no longer supported, so there is nobody I could communicate with.

    However, I did my own research and found a working solution.
    I will share it here, maybe somebody will find it useful.

    function modify_excerpt_embed( $output ) {
	if(is_plugin_active("dk-pdf/dk-pdf.php")) {
		// Here you can write any modifications to embed excerpt that you want to
	}
	return $output;
}

    So, I am using WordPress hook “modify_exceprt_embed” to modify excerpt, but I am only doing this if DK PDF plugin is active. This way, when we remove this plugin my filter will no longer be active.

    This is what I wanted to do in the beginning, find some filter that is good for changing embed output.

    Thanks for providing me with additional information.
    It was pleasure as always. 🙂

    All best,
    Milan

  • Participant
    Level: Enlightened
    Posts: 34
    Milan Latinovic on May 4, 2020 at 4:48 pm #29498

    Hi Brajesh,

    Yes, we are using plugin that is generating text “Download this post in the PDF format” at the top of our posts. This is what we want and this text makes sense in posts.
    However, we don’t want it in a BuddyPress preview, when we share link.

    I will report this to the plugin creators as you suggested.

    However is there some mechanism to “filter out” this text?
    For example, if we can make some rule to tell WordPress remove “Download this post in the PDF format” text from the beginning of the attachment if available?

    When we report this to plugin creators it will take some time before they implement it for sure. That is why I am exploring possibility to fix this at the level of our site, with filters or other hooks.

    Kind regards,
    Milan

  • Participant
    Level: Enlightened
    Posts: 34
    Milan Latinovic on May 4, 2020 at 4:35 pm #29497

    Hi Brajesh,

    Thanks for the quick response.

    Yup, I am aware of old version of “BuddyPress Force Profile Photo” and BuddyPress Profile Completion now.
    You are right, this is good approach to solve this issue.

    I will use it out of the box, thanks!

    Kind regards,
    Milan

  • Participant
    Level: Enlightened
    Posts: 34
    Milan Latinovic on February 9, 2020 at 8:38 am #27642

    Hi Brajesh,

    Agree, it is most likely false positive.
    We used Detectify for the security scan, I have sent them a question about could this be a false positive and if not what is the actual threat.

    I will mark this ticket as resolved (since no action is required from our side).
    If I get any meaningful response from Detectify I will update this post.

    Kind regards,
    Milan

  • Participant
    Level: Enlightened
    Posts: 34
    Milan Latinovic on September 28, 2019 at 5:41 pm #25544

    Hi Brajesh,

    Not a problem at all, let me know when you have some idea on how to solve it.
    Also, if I can do or test anything from my side to help, will gladly do it.

    Kind regards,
    Milan

  • Participant
    Level: Enlightened
    Posts: 34
    Milan Latinovic on September 21, 2019 at 10:50 am #25403

    Hi Brajesh,

    Yes, this makes sense, thanks.
    I will close this ticket now and if I notice possible issues with links from oembed providers I would report them in separated ticket.

    Thanks!
    All best,
    Milan

  • Participant
    Level: Enlightened
    Posts: 34
    Milan Latinovic on September 19, 2019 at 6:45 am #25368

    Hi Brajesh,

    I have a quick followup question.

    Seems like that we are getting previews only for links which are from our own web site (our domain). If I try to make a preview for any other external link it is not working. Is there some kind of settings needed to preview external links or how can we make this functionality work?

    Kind regards,
    Milan