Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

Replies

  • Participant
    Level: Master
    Posts: 279
    NikB on April 10, 2023 at 5:51 pm in reply to: [Resolved] BuddyBlog Pro/Groups – Rejections #49182

    Thank you Brajesh and that makes sense.

    Obviously (at least as far as I am aware) there is currently no option to approve/reject members’ posts from the front end so these do need to be handled in the backend and therefore care does need to be taken by admins/editors NOT to publish the post when rejecting it, but as you say… admins/editors have super powers… and with super powers, comes super responsibility 😉

    I will let them know accordingly and please feel free to mark this post as resolved.

    Regards
    Nik

  • Participant
    Level: Master
    Posts: 279
    NikB on April 10, 2023 at 2:24 pm in reply to: BuddyBlog Pro – override Submit Post for Review #49177

    PS. The above is all starting to look very complicated but all(?) I really want to do is to prevent any notification emails getting sent out when bblpro_get_default_post_status_for_user = “publish”.

    The code suggested above by Ravi works well for members posts, but does not stop notifications relating to group posts being sent out.

    With many thanks again and will look forward to hearing from you.
    Nik

  • Participant
    Level: Master
    Posts: 279
    NikB on April 7, 2023 at 7:00 am in reply to: BuddyBlog Pro – override Submit Post for Review #49164

    Hi Brajesh/Ravi

    I’m not sure how to upload screenshots here but hopefully the following will help –

    Group Posts Form workflow –

    On submission: Submit post for review
    Admin notification: Yes
    Group Admin notification: Yes
    Post author notification: Yes
    On approval – post author notification: Yes

    Groups settings (set in WP/site admin dashboard) –
    Posts tab: Availability – All groups/Visibility – Everyone
    Sub posts tab: Availability – All groups/Visibility – Everyone
    Create posts tab: Availability – All groups/Visibility – Group members
    Pending & edit tabs: Availbility – All groups/Visbility – Group moderators

    No overrides are allowed by group admins ie. all posts in all groups throughout the site are to be handled in the same way (so there is no group posts settings page on the group manage page).

    As you would expect (and as the plugin is designed), the above works perfectly for regular group members (ie. those with the role of subscriber) ie. user submits a post for approval and emails are sent to the user, admin and group admin notifying them accordingly. When admin or group admin approves the post, email is sent to the user notifying them accordingly.

    However… group admins also want to add their OWN posts and in this case it makes no sense that those posts should require approval (since they themselves are the ones that are responsible for approving them).

    With your kind assistance (here – https://buddydev.com/support/forums/topic/buddyblog-pro-override-submit-post-for-review/page/3/#post-48737), I have used the bblpro_default_post_status_for_user filter to allow posts made by group admins to be published immediately ie. status is automatically set to “published” not “pending”. This also works perfectly however…

    The one outstanding issue is that despite the fact that posts by group admins are published immediately, they (and site admin) are still receiving the (on submission) notification emails advising them that “a post has been received and needs approval”, and in the case of group admins, also the (on submission) post author notification email.

    In summary… if the bblpro_default_post_status_for_user is set to “published” (as it is for group admins) then I want to be able to stop all “on submission” emails/notifications from being sent out.

    Note: the code suggested by Ravi above (https://buddydev.com/support/forums/topic/buddyblog-pro-override-submit-post-for-review/page/4/#post-49101) works perfectly when handling a similar situation for profile posts (ie. if a post is made by a user with bblpro_default_post_status_for_user set to “published” no notifications are sent out) however… for some reason this has no effect on group post notifications.

    I really hope this helps but if you need any further clarification, please do let me know.
    With many thanks again
    Nik

  • Participant
    Level: Master
    Posts: 279
    NikB on April 6, 2023 at 12:36 pm in reply to: BuddyBlog Pro – override Submit Post for Review #49149

    Hi Ravi

    Thank you for getting back to me but I think there may be some confusion. It’s not the post approval email that is the problem…

    The problem is that when group admins or editors (whose default post status is set to “publish”) make a post, it gets published immediately and therefore they do not expect to receive the admin and author notification emails.

    The above code you suggested works well for editors when publishing personal posts, but does not stop emails getting sent out when editors or group admins make a group post (with BuddyBlog Groups Pro), which as far as I can tell, handles notifications slightly differently.

    Hopefully that clarifies things a bit?

    Regards
    Nik

  • Participant
    Level: Master
    Posts: 279
    NikB on April 6, 2023 at 11:53 am in reply to: BuddyBlog Pro – override Submit Post for Review #49147

    Hi Ravi

    Sorry to follow up on this so soon but just wondering if you’ve had a chance to look at the groups emails yet?

    I’ve had a look at the code and unfortunately there doesn’t seem to be a filter for the group notifications so not sure how best to handle?

    With many thanks in advance and will look forward to hearing from you.
    Nik

  • Participant
    Level: Master
    Posts: 279
    NikB on April 4, 2023 at 10:54 am in reply to: BuddyBlog Pro – override Submit Post for Review #49121

    Hi Ravi

    Thank you very much. The group admins are finding it quite confusing to receive emails telling them their own posts need approval (even though I’ve told them just to ignore ;-)).

    With many thanks in advance and I’ll look forward to hearing from you.
    Nik

  • Participant
    Level: Master
    Posts: 279
    NikB on April 4, 2023 at 10:52 am in reply to: [Resolved] Using BuddyBlog Pro with Events Manager #49120

    Hi Brajesh

    Thank you for getting back to me. I realise I’m actually not at all sure how/why an entry EVER gets created in the wp_em_events table when posting a BuddyBlog post anyway(!) but your suggestion of simply checking if an extra exists and creating it if it doesn’t, does sound like the safest option 😉

    Fingers crossed and many thanks again.
    Nik

  • Participant
    Level: Master
    Posts: 279
    NikB on April 3, 2023 at 8:26 am in reply to: BuddyBlog Pro – override Submit Post for Review #49102

    Hi Ravi

    Thank you so much.

    That seems to work well for personal posts, but it’s not catching group posts ie. emails are still getting sent out even for posts that are published immediately. I’m guessing that needs another filter but it’s not immediately obvious what it should be. Any suggestions?

    With many thanks again
    Nik

  • Participant
    Level: Master
    Posts: 279
    NikB on April 2, 2023 at 11:05 am in reply to: BuddyBlog Pro – override Submit Post for Review #49083

    Hi Brajesh

    Sorry to be a pain but just wondering if you’d had a chance to look at this.

    If all else fails, would it at least be possible to stop (any) emails being sent out if the post is being posted by admin, an editor or a group admin?

    With many thanks again
    Nik

  • Participant
    Level: Master
    Posts: 279
    NikB on March 27, 2023 at 4:36 pm in reply to: BuddyBlog Pro – override Submit Post for Review #48945

    Hi Brajesh

    You mentioned you would try and get back with regard to the emails that get sent out, but not having heard anything yet, I’m wondering if I may not have explaiend things very well so thought I would try and outline a bit more clearly…

    Since most posts will require approval, the emails sent out in response to a post are as follows –

    1) On submission (to user): We will get back to you once your post has been approved.
    2) On submission (to admin/group admin): Please check and approve this post.
    3) On approval (to user): Your post has been approved.

    This all works fine until it is someone (eg. in my case admins, group admins and editors) whose posts do not require approval and get published immediately. In that case, it makes no sense for them to be receiving 1) or 2) since a) their post is already approved and b) in many cases, it will be their own post they’re being asked to approve.

    Ideal scenario when posts are published immediately (ie. without requiring approval) would either be that email 3) above gets sent out immediately OR failing that, no emails get sent at all.

    As always, any thoughts would be much appreciated.
    Regards
    Nik