Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

Replies

  • Participant
    Level: Enlightened
    Posts: 25
    hangojango on April 13, 2020 at 3:08 pm #28831
    This reply has been marked as private.
  • Participant
    Level: Enlightened
    Posts: 25
    hangojango on April 12, 2020 at 10:36 pm #28816
    This reply has been marked as private.
  • Participant
    Level: Enlightened
    Posts: 25
    hangojango on April 11, 2020 at 4:12 am #28765

    PS, in case that wasn’t clear, I will keep the code as it is, including redirection.

  • Participant
    Level: Enlightened
    Posts: 25
    hangojango on April 11, 2020 at 4:11 am #28764

    Hi Brajesh,

    It sounds like keeping the re-direction is essential, otherwise activity posts could be shared across sites.

    I will instead just put a note on the no-login page to advise them to clear browser cache if they wish to try logging in again after contacting subsite Admin for membership.

    Thanks for your help.

    Let me know steps forward to reimburse you as discussed.

    Cheers.

  • Participant
    Level: Enlightened
    Posts: 25
    hangojango on April 10, 2020 at 3:06 am #28713

    Oh, actually there is a problem with the redirection…. Once I have been redirected, I cannot go back to the subsite login page. I am assuming this is due to a cookie. As a result, I do think it would just be simpler to remove redirection all together. So long as the non-member cannot access the subsite, that’s all that matters.

  • Participant
    Level: Enlightened
    Posts: 25
    hangojango on April 10, 2020 at 2:34 am #28712

    PS: I may have other small tasks to tidy up if you are interested…. But I will use the contact form on the Troubleshooting page to raise them, since they would not be related to your BP Multi-network plugin.

  • Participant
    Level: Enlightened
    Posts: 25
    hangojango on April 10, 2020 at 2:30 am #28711

    Hi Brajesh,

    It all seems to be working great now.

    Yesterday (before we removed your code due to roll back), no visitors could even see the subsite’s login page because it immediately directed everybody to the no-login page.

    This time round, all visitors can see the login page, as expected. Members can log in but non-members (who are registered elsewhere on the network) are redirected to the no-login page. Great. Unregistered visitors (who don’t have a username or password but try anyway) just remain on the login page without passing through, as expected.

    So thanks again. I am now looking for a way to add the troubleshooting fee to a shopping cart so I can pay the USD$50 but I don’t see it – just a contact form on the troubleshooting page. Please advise.

    Also, in case I have to roll-back to previous version in future (if there are any future plugin conflicts), I don’t want to lose your code. Is it all in the bp-custom.php file? (If so, I will just copy this to local drive as back up.) Or was code added elsewhere as well?

    Cheers.

  • Participant
    Level: Enlightened
    Posts: 25
    hangojango on April 9, 2020 at 1:39 pm #28705

    Hi again,

    We have identified the conflict, which was a new caching and database-cleaning plugin called WP-Optimizer. It is now removed. The site has rolled back to a previous version. Your code to redirect visitors to primary site page is also removed and I actually prefer it that way. On the plus, it looks like the separate member tables is still in place. i.e. Members of the Hoodies subsite cannot see members from other sites on the multisite.

    So just to clarify, my request is to not allow non-members to log in to sites. Only members can log into sites. (I know random visitors can’t log in because they are not on the network at all and do not have a password etc. But at the moment, anyone who is already a user of any site on the multisite network can log into any other subsite on the network, even if they are not members of that subsite.) Does that make sense?

    Although you said the member tables are now separate between subsites, it seems that this hasn’t stopped members from being able to log into sites where they are not members, and this is a problem.

  • Participant
    Level: Enlightened
    Posts: 25
    hangojango on April 9, 2020 at 5:30 am #28678

    Hi Brajesh,

    I appreciate you’ve probably logged off for a few hours but I wanted to let you know that there have been too many strange things going on with my multi-site today. The main issue is that some of the images aren’t coming back. We aren’t 100% sure it’s because of Elementor. It might also be a conflict with your new code, I don’t know. The only way to get the images back (aside from re-uploading and configuring them) is to roll to a back-up version. This will likely remove your code also, which I don’t mind because as noted above, it would be better if we did not put a redirection in place.

    I would still like to make sure that (a) only members of the subsite can be seen on the subsite, meaning that the tables are separate for all subsites, and (b) network members cannot log into subsites that they are not members of.

    Please let me know when you are back online. I will of course take a copy of the site before rolling back.

  • Participant
    Level: Enlightened
    Posts: 25
    hangojango on April 9, 2020 at 4:32 am #28677
    This reply has been marked as private.