Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

Replies

  • Participant
    Level: Master
    Posts: 280
    NikB on April 10, 2023 at 6:09 pm in reply to: BuddyBlog Pro – override Submit Post for Review #49184

    Hi Brajesh

    I can understand that to offer options to allow/disallow notifications dependent on user permissions, especially depending on whether or not group admins are allowed to change the various options could get very complicated!

    Fortunately in my case at least, group admins are not allowed to change any of the settings ie. ALL posts require their approval (except for their own) and notifications should always be sent UNLESS it’s a post by the group admin themselves.

    The fact that the code provided by Ravi doesn’t prevent the latter from happening for group posts is causing us major problems, since group admins can’t understand why they receive not even just one, but TWO emails (one as group admin, one as the author) for a post they’ve made themselves and is already published.

    Unfortunately, the site is about to go live this week so if there isn’t any way of overriding this feature, the only other option I can think of is to edit the source code somehow myself, which is obviously not ideal but I don’t see any other alternative at this stage… and will definitely be keeping an eye out for any further updates as/when you have them available.

    Regards
    Nik

  • Participant
    Level: Master
    Posts: 280
    NikB on April 10, 2023 at 5:51 pm in reply to: [Resolved] BuddyBlog Pro/Groups – Rejections #49182

    Thank you Brajesh and that makes sense.

    Obviously (at least as far as I am aware) there is currently no option to approve/reject members’ posts from the front end so these do need to be handled in the backend and therefore care does need to be taken by admins/editors NOT to publish the post when rejecting it, but as you say… admins/editors have super powers… and with super powers, comes super responsibility 😉

    I will let them know accordingly and please feel free to mark this post as resolved.

    Regards
    Nik

  • Participant
    Level: Master
    Posts: 280
    NikB on April 10, 2023 at 2:24 pm in reply to: BuddyBlog Pro – override Submit Post for Review #49177

    PS. The above is all starting to look very complicated but all(?) I really want to do is to prevent any notification emails getting sent out when bblpro_get_default_post_status_for_user = “publish”.

    The code suggested above by Ravi works well for members posts, but does not stop notifications relating to group posts being sent out.

    With many thanks again and will look forward to hearing from you.
    Nik

  • Participant
    Level: Master
    Posts: 280
    NikB on April 7, 2023 at 7:00 am in reply to: BuddyBlog Pro – override Submit Post for Review #49164

    Hi Brajesh/Ravi

    I’m not sure how to upload screenshots here but hopefully the following will help –

    Group Posts Form workflow –

    On submission: Submit post for review
    Admin notification: Yes
    Group Admin notification: Yes
    Post author notification: Yes
    On approval – post author notification: Yes

    Groups settings (set in WP/site admin dashboard) –
    Posts tab: Availability – All groups/Visibility – Everyone
    Sub posts tab: Availability – All groups/Visibility – Everyone
    Create posts tab: Availability – All groups/Visibility – Group members
    Pending & edit tabs: Availbility – All groups/Visbility – Group moderators

    No overrides are allowed by group admins ie. all posts in all groups throughout the site are to be handled in the same way (so there is no group posts settings page on the group manage page).

    As you would expect (and as the plugin is designed), the above works perfectly for regular group members (ie. those with the role of subscriber) ie. user submits a post for approval and emails are sent to the user, admin and group admin notifying them accordingly. When admin or group admin approves the post, email is sent to the user notifying them accordingly.

    However… group admins also want to add their OWN posts and in this case it makes no sense that those posts should require approval (since they themselves are the ones that are responsible for approving them).

    With your kind assistance (here – https://buddydev.com/support/forums/topic/buddyblog-pro-override-submit-post-for-review/page/3/#post-48737), I have used the bblpro_default_post_status_for_user filter to allow posts made by group admins to be published immediately ie. status is automatically set to “published” not “pending”. This also works perfectly however…

    The one outstanding issue is that despite the fact that posts by group admins are published immediately, they (and site admin) are still receiving the (on submission) notification emails advising them that “a post has been received and needs approval”, and in the case of group admins, also the (on submission) post author notification email.

    In summary… if the bblpro_default_post_status_for_user is set to “published” (as it is for group admins) then I want to be able to stop all “on submission” emails/notifications from being sent out.

    Note: the code suggested by Ravi above (https://buddydev.com/support/forums/topic/buddyblog-pro-override-submit-post-for-review/page/4/#post-49101) works perfectly when handling a similar situation for profile posts (ie. if a post is made by a user with bblpro_default_post_status_for_user set to “published” no notifications are sent out) however… for some reason this has no effect on group post notifications.

    I really hope this helps but if you need any further clarification, please do let me know.
    With many thanks again
    Nik

  • Participant
    Level: Master
    Posts: 280
    NikB on April 6, 2023 at 12:36 pm in reply to: BuddyBlog Pro – override Submit Post for Review #49149

    Hi Ravi

    Thank you for getting back to me but I think there may be some confusion. It’s not the post approval email that is the problem…

    The problem is that when group admins or editors (whose default post status is set to “publish”) make a post, it gets published immediately and therefore they do not expect to receive the admin and author notification emails.

    The above code you suggested works well for editors when publishing personal posts, but does not stop emails getting sent out when editors or group admins make a group post (with BuddyBlog Groups Pro), which as far as I can tell, handles notifications slightly differently.

    Hopefully that clarifies things a bit?

    Regards
    Nik

  • Participant
    Level: Master
    Posts: 280
    NikB on April 6, 2023 at 11:53 am in reply to: BuddyBlog Pro – override Submit Post for Review #49147

    Hi Ravi

    Sorry to follow up on this so soon but just wondering if you’ve had a chance to look at the groups emails yet?

    I’ve had a look at the code and unfortunately there doesn’t seem to be a filter for the group notifications so not sure how best to handle?

    With many thanks in advance and will look forward to hearing from you.
    Nik

  • Participant
    Level: Master
    Posts: 280
    NikB on April 4, 2023 at 10:54 am in reply to: BuddyBlog Pro – override Submit Post for Review #49121

    Hi Ravi

    Thank you very much. The group admins are finding it quite confusing to receive emails telling them their own posts need approval (even though I’ve told them just to ignore ;-)).

    With many thanks in advance and I’ll look forward to hearing from you.
    Nik

  • Participant
    Level: Master
    Posts: 280
    NikB on April 4, 2023 at 10:52 am in reply to: [Resolved] Using BuddyBlog Pro with Events Manager #49120

    Hi Brajesh

    Thank you for getting back to me. I realise I’m actually not at all sure how/why an entry EVER gets created in the wp_em_events table when posting a BuddyBlog post anyway(!) but your suggestion of simply checking if an extra exists and creating it if it doesn’t, does sound like the safest option 😉

    Fingers crossed and many thanks again.
    Nik

  • Participant
    Level: Master
    Posts: 280
    NikB on April 3, 2023 at 8:26 am in reply to: BuddyBlog Pro – override Submit Post for Review #49102

    Hi Ravi

    Thank you so much.

    That seems to work well for personal posts, but it’s not catching group posts ie. emails are still getting sent out even for posts that are published immediately. I’m guessing that needs another filter but it’s not immediately obvious what it should be. Any suggestions?

    With many thanks again
    Nik

  • Participant
    Level: Master
    Posts: 280
    NikB on April 2, 2023 at 11:05 am in reply to: BuddyBlog Pro – override Submit Post for Review #49083

    Hi Brajesh

    Sorry to be a pain but just wondering if you’d had a chance to look at this.

    If all else fails, would it at least be possible to stop (any) emails being sent out if the post is being posted by admin, an editor or a group admin?

    With many thanks again
    Nik