Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

Replies

  • Participant
    Level: Initiated
    Posts: 6
    Kevin on December 20, 2024 at 12:02 am #53974

    I dont know what you talking about. I reported a bug, no more, no less. Runing bp Version 14.3.3.
    I know that this is a warning and if you dont have php reporting on you wont see it. Nevertheless its an issue.
    I also checked buddpress and its on file 14.0.php on line 44.

    Your accusation of piracy is quite harsh. But you can be rest assured, I will delete my account here right now.

    And in future I will think twice buying plugins from you.

  • Participant
    Level: Initiated
    Posts: 6
    Kevin on December 19, 2024 at 10:18 pm #53970

    Wow 2!
    The plugin which I tested was bought but not from you. If you dont want this you have to to target your anger to those sellers.

    But I understand if you wanna give support only to your own buyers. Nevertheless I reported a bug which has nothing to do who has bought which plugin from someone. I did not asked you for private development or anything like that.

    Why don’t you offer a money back guarantee for your plugins here? Than people who buy plugins from you directly which are not running well can remove it without losing a fortune. This would be fair in my opinion.

  • Participant
    Level: Initiated
    Posts: 6
    Kevin on December 18, 2024 at 9:08 pm #53935

    I dont buy buggy plugins. Whenever I did it jangles my nerves.

    I just wanna be kind and report the issue. Its on you what you do with it.

  • Participant
    Level: Initiated
    Posts: 6
    Kevin on December 15, 2024 at 12:08 pm #53810

    I did a little code research on this and found out that bp using the wp_lostpassword_url() function to set the url.

    I tried this code in functions.php to change the URL but this does not work:

    
function passurl_wpse_208054($lostpassword_url, $redirect ) {
	return 'http://path/to/login/url';
  }
  add_filter('lostpassword_url', 'passurl_wpse_208054', 10, 2);
  • Participant
    Level: Initiated
    Posts: 6
    Kevin on October 29, 2024 at 6:21 pm #53428

    I changed the code but get an php error when calling the page afterwards:

    Fatal error: Uncaught TypeError: date(): Argument #2 ($timestamp) must be of type ?int, string given in \wp-content\plugins\buddypress\bp-core\bp-core-functions.php:1775 Stack trace: #0 \wp-content\plugins\buddypress\bp-core\bp-core-functions.php(1775): date(‘Y-m-d H:i:s’, ‘2024-10-29 19:1…’) #1 \wp-includes\class-wp-hook.php(324):
    …

  • Participant
    Level: Initiated
    Posts: 6
    Kevin on October 20, 2024 at 9:41 pm #53350

    When I hardcode it like this (just change gmt to false it works) so hopefully you are able to correct my filter:

    
function bp_core_current_time( $gmt = false, $type = 'mysql' ) {

	/**
	 * Filters the current GMT time to save into the DB.
	 *
	 * @since 1.2.6
	 *
	 * @param string $value Current GMT time.
	 */
	return apply_filters( 'bp_core_current_time', current_time( $type, $gmt ) );
}

    Might this be a bp bug because my wp timezone was set to my local timezone – same for UTC plus offset – and I found other non resolved ancient posts on this?
    https://buddypress.org/support/topic/activity-wall-time-setting/
    https://buddypress.org/support/topic/possible-solution-found-every-single-time-stamp-on-my-site-is-off-by-7-hours/page/3/