Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

Replies

  • Participant
    Level: Initiated
    Posts: 12
    CDS on October 26, 2018 at 3:15 pm #18291

    I simply open php file and search with the search tool.

    In Themes > kleo > buddypress > members > members-loop.php I think to have found the code displaying the list of members in a group because it’s the same in the Inspector
    :
    ‘ <li class=”kleo-masonry-item”>
    <div class=”member-inner-list animated animate-when-almost-visible bottom-to-top”>
    <div class=”item-avatar rounded”>
    “><?php bp_member_avatar(); ?>
    <?php do_action(‘bp_member_online_status’, bp_get_member_user_id()); ?>
    </div>’

    This is the link to pastebin https://pastebin.com/DhUzb5bd

    I continue to search in other files in kleo

  • Participant
    Level: Initiated
    Posts: 12
    CDS on October 26, 2018 at 2:11 pm #18278

    Thanks for your reply !
    I’ll look for that but where ?

    In waiting, I deleted the elsif about the mystery man in bp-core-avatars.php.
    Now it’s the default avatar from http://www.gravatar.com displayed.

    I tried to get your code in bp-custom.php and this file in the plugins root but I have a blank page if I add ‘<?php’ at the start. Or the code is displayed without ‘<?php’

    In Kleo directory, there is a buddypress repertory wich contents a buddypress-functions.php where I found
    ‘// Template Output.
    add_filter( ‘bp_get_activity_action_pre_meta’, array( $this, ‘secondary_avatars’ ), 10, 2 );’

    In functions.php there isn’t no add_filter attached to some avatar hook, just this one for your code.
    And of course there are a few add_filter in bp-core-avatars.php

    Perhaps it’s not suffisant to put your code in functions.php ? But how can I do a bp-custom.php without blank page ?

    A very big thank you !

  • Participant
    Level: Initiated
    Posts: 12
    CDS on October 26, 2018 at 10:28 am #18264

    Hi Brajesh,
    Unfortunatly I connot contact the Kleo team because I don’t have the purchase code to do that (the theme was bought by the customer and I cannot join him actually)
    So I looked into all php file and Found in WP>plugins>buddypress>bp-core the bp-core-avatars.php where the mystery man is managed.
    The code is :
    ‘/**
    * Filters whether or not to skip Gravatar check.
    *
    * @since 1.5.0
    *
    * @param bool $value Whether or not to skip Gravatar.
    * @param array $params Array of parameters for the avatar request.
    */
    if ( ! apply_filters( ‘bp_core_fetch_avatar_no_grav’, $params[‘no_grav’], $params ) ) {

    // Set gravatar type.
    if ( empty( $bp->grav_default->{$params[‘object’]} ) ) {
    $default_grav = ‘wavatar’;
    } elseif ( ‘mystery’ == $bp->grav_default->{$params[‘object’]} ) {

    /**
    * Filters the Mystery person avatar src value.
    *
    * @since 1.2.0
    *
    * @param string $value Avatar value.
    * @param string $value Width to display avatar at.
    */
    $default_grav = apply_filters( ‘bp_core_mysteryman_src’, ‘mm’, $params[‘width’] );
    } else {
    $default_grav = $bp->grav_default->{$params[‘object’]};
    }

    // Set gravatar object.
    if ( empty( $params[’email’] ) ) {
    if ( ‘user’ == $params[‘object’] ) {
    $params[’email’] = bp_core_get_user_email( $params[‘item_id’] );
    } elseif ( ‘group’ == $params[‘object’] || ‘blog’ == $params[‘object’] ) {
    $params[’email’] = $params[‘item_id’] . ‘-‘ . $params[‘object’] . ‘@’ . bp_get_root_domain();
    }
    }’

    What do you think about ? Is it possible to delete that and add your code at the place ?

    Thanks for your help … and your patience !

  • Participant
    Level: Initiated
    Posts: 12
    CDS on October 17, 2018 at 7:35 am #18123

    Hi Brajesh, you’re very kind ! You gave me a way to search !
    The theme is Kleo wich has settings for Buddypress but nothing about avatar, only about the ‘Profile & Group Icons style’.
    There is a buddypress directory in the plugins repertory. But there is also an buddypress directory in themes > Kleo. So I looked into members.php in this directory. The code seems to be similar that I can see with the Insepctor :
    ‘ <li class=”kleo-masonry-item”>
    <div class=”member-inner-list animated animate-when-almost-visible bottom-to-top”>
    <div class=”item-avatar rounded”>
    “>
    <?php bp_group_member_avatar_thumb(); ?>

    <?php do_action(‘bp_member_online_status’, bp_get_member_user_id()); ?>
    </div>’

    I tried to put the bp-custom.php in the kleio directory but nothing change.

    What do you think about that ? I suppose that the bp_group_member_avatar_thumb is defined in functions.php ?
    I’ll look at this but if you have an idea …
    I think the goal is not more so fare 😉 (sorry, I’m french I don’t know if it’s correct !)

    Best regards !

  • Participant
    Level: Initiated
    Posts: 12
    CDS on October 16, 2018 at 11:23 am #18113

    Hello Brajesh, I’m sorry I come again with my problem 🙁 I get the really path to the image, I use correctly the name of the member type as on your screen, but it’s always the path to the buddypress default image. I created the member types with the free version of BuddyPress Member Types Generator. I tried to get the code in bp-custom.php but a blank page happened. I’m not sure I did that correctly. Is it necessary to put this file directly in the plugin directory or in the buddypress directory ?
    Is it neccessary to add anything before the code ?
    Please, what can I try ?

    Thanks a lot for your patience

    Best regards

  • Participant
    Level: Initiated
    Posts: 12
    CDS on October 15, 2018 at 1:55 pm #18078

    Hi Brajesh, thanks for your reply. I created member types with the plugin BP Member types. Is it correct ?
    I created 3 types : classique, jeune-pro and premium.
    I’m a little lost. I don’t understand why it doesn’t work.

  • Participant
    Level: Initiated
    Posts: 12
    CDS on October 8, 2018 at 1:10 pm #17979

    Hello Brajesh,
    Did you have time to try the code ? Thanks !

  • Participant
    Level: Initiated
    Posts: 12
    CDS on October 4, 2018 at 11:55 am #17810

    Hi Brajesh,
    Thanks for your reply !
    Thus the add_filter is at the good place in the code ?
    Yes, I replaced the url.
    The exact code I added in functions.php is :

    ‘// Desactiver avatar buddy
    add_filter( ‘bp_core_fetch_avatar_no_grav’, ‘__return_true’ );
    //Customiser avatars buddypress

    function buddydev_set_default_use_avatar_based_on_member_type( $avatar, $params) {
    $user_id = $params[‘item_id’];

    $type = bp_get_member_type( $user_id );

    if ( $type == ‘premium’ ) {
    $avatar = get_template_directory_uri() . ‘/assets/images/avatar-premium.png’;
    } elseif( $type ==’classique’ ) {
    $avatar = get_template_directory_uri() . ‘/assets/images/avatar-classique.png’;
    } elseif( $type ==’jeune-pro’ ) {
    $avatar = get_template_directory_uri() . ‘/assets/images/avatar-jeunepro.png’;
    } else {
    $avatar = ‘http://example.com/unknown.png&#8217;;//get_template_directory_uri() . ‘/assets/images/unknown.png’;;
    }

    return $avatar;
    }
    add_filter( ‘bp_core_default_avatar_user’, ‘buddydev_set_default_use_avatar_based_on_member_type’, 10, 2 );’

    But the default avatar isn’t desactivated 🙁 it’s always the stupid myster man 🙂

    What is it missing ? Perhaps an endif ? I don’t know, I’m not a very good php dev 🙂
    I tried also by changing the default avatar in Settings -> Discussion.
    I tried by changing a member of type.
    No change …

    If you have an idea …

    thanks a lot !!!

  • Participant
    Level: Initiated
    Posts: 12
    CDS on October 3, 2018 at 7:51 am #17786

    Hi Brajesh,
    Thanks for your reply. Finally I found how to do with an other plugin.

    Bestregards

  • Participant
    Level: Initiated
    Posts: 12
    CDS on October 2, 2018 at 1:12 pm #17763

    Please. I bought WP4BP Woocommerce integration wishing to associate customers to buddypress groups following the product bought before the buddypress install. Is it possible ?
    thanks a lot !