Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

Replies

  • Participant
    Level: Enlightened
    Posts: 30
    Michael on December 18, 2024 at 10:46 pm #53938

    Works great, thankyou!

    The Lost Password form however still displays (initially) the prompt “Please enter your username or email address” and above the input text field it says “Username or Email Address” … any way those can also be modified to indicate it accepts email address only? Just for tidiness sake.

    If not, thankyou anyway, the functionality is great.

  • Participant
    Level: Enlightened
    Posts: 30
    Michael on December 14, 2024 at 1:30 am #53722

    Hi Brajesh
    Thankyou, unfortunately my knowledge of SQL queries is too limited to modify your plugin code safely.

    I tried to write a function to do the deletions by looping through the user IDs. Is this a reasonable way to approach it? It works on my test site but please could you review the code to confirm it’s safe to use.

    Code loops through user IDs, checks if user exists, checks the last_activity and if older than 365 days ago then the account gets deleted.

    
function delete_abandoned() {
	
	require_once( ABSPATH.'wp-admin/includes/user.php' );
	$nowTime = time();

	for ( $x = 1; $x <= 1000; $x++ ) {
		
		$user = get_user_by( 'ID', $x );
		
		if ( $user ) {
			$lastTime = strtotime( bp_get_user_last_activity($x) );
			$daysAgo = intval( ($nowTime - $lastTime) / (3600*24) );
			
			if ( $daysAgo > 365 ) {
				wp_delete_user($x);
			}
		}
	}
}
  • Participant
    Level: Enlightened
    Posts: 30
    Michael on July 8, 2024 at 9:54 am #52828

    Thanks Ravi, appreciated.

  • Participant
    Level: Enlightened
    Posts: 30
    Michael on June 27, 2024 at 11:00 am #52774

    Thanks Ravi!

  • Participant
    Level: Enlightened
    Posts: 30
    Michael on June 26, 2024 at 9:19 am #52769

    Hi Ravi,

    Hope you can kindly answer my last question and then this can be noted as “resolved”.

    Thanks!

  • Participant
    Level: Enlightened
    Posts: 30
    Michael on June 21, 2024 at 4:26 pm #52749

    Thankyou so much Ravi, that works great on my test environment. Deletes the comments and correctly updates the total comments count per post too. Perfect.

    Re. possible performance issues for large numbers of comments.

    – the particular user has approx. 2000 comments spread over 4 years.
    – would it be safe to do them all at once?
    – or maybe using ‘date_query’ with the get_comments() function, I could delete them in smaller batches.

    What would you recommend?

    Thanks!

  • Participant
    Level: Enlightened
    Posts: 30
    Michael on June 18, 2024 at 10:02 pm #52737

    Sorry! Sorry! Sorry!

    The code snippet above was pasted wrong, here’s the correct version:

    
$entries = $wpdb->get_results("SELECT * FROM wp_posts WHERE post_type IN ('post', 'page')");

foreach($entries as $entry)
{
    $post_id = $entry->ID;
    $comment_count = $wpdb->get_var("SELECT COUNT(*) AS comment_cnt FROM wp_comments WHERE comment_post_ID = '$post_id' AND comment_approved = '1'");
    $wpdb->query("UPDATE wp_posts SET comment_count = '$comment_count' WHERE ID = '$post_id'");
}
  • Participant
    Level: Enlightened
    Posts: 30
    Michael on June 18, 2024 at 3:09 pm #52736

    Thanks Brajesh,

    – I looked at the Bulk Delete plugin but the functionality to delete comments per specific user id is only available in the premium version, and I will probably only use it only once.

    – re. Recounting all the post comments, I’m unable to write the correct code myself, but I found the following on Stack overflow :

    
$entries = $wpdb->get_results("SELECT * FROM wp_posts WHERE post_type IN ('post', 'page')");

foreach($entries as $entry)
{
    $post_id = $entry->ID;
    $comment_count = $entries = $wpdb->get_results("SELECT * FROM wp_posts WHERE post_type IN ('post', 'page')");
    $wpdb->query("UPDATE wp_posts SET comment_count = '$comment_count' WHERE ID = '$post_id'");
}

    – I tested in test environment, seems to work fine (albeit with a small number of posts)

    Question – my live site has over 1000 posts, would the code be safe to use?

    Thanks!

  • Participant
    Level: Enlightened
    Posts: 30
    Michael on November 10, 2023 at 5:48 pm #50851

    Hi Mark
    This might possibly be of assistance?
    Will remove the editor toolbar stuff.
    Simply replace 9999 with your field id.

    
function antipole_remove_rich_text( $field_id = null ) {
    if ( ! $field_id ) {
        $field_id = bp_get_the_profile_field_id( '9999' ); // replace 9999 with your field id
    }
 
    $field = xprofile_get_field( $field_id );
  
    if ( $field ) {
        $enabled = false;
    }
}
add_filter( 'bp_xprofile_is_richtext_enabled_for_field', 'antipole_remove_rich_text' );
  • Participant
    Level: Enlightened
    Posts: 30
    Michael on November 3, 2023 at 2:18 pm #50822

    That works perfectly, thankyou very much Ravi for your assistance.