Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

Replies

  • Keymaster
    (BuddyDev Team)
    Posts: 24774
    Brajesh Singh on July 31, 2024 at 5:03 am in reply to: BuddyPress Xprofile Custom Field Types – Images upload – Registration page #52896

    Hi Newton,
    Welcome to BuddyDev support forums.

    Thank you for reporting the issue.

    We handle file upload on ‘xprofile_data_before_save` (when a profile field data is saved to the database).

    In BuddyPress 14.0, The registration does not store any data in xprofile table unless the user account is activated(Internally account is created after activation now).

    That is causing the issue. There may be a solution by forcing creation of account.

    Please put this in your bp-custom.pjp

    

add_filter( 'bp_signups_create_user', '__return_true' );

    Let me know if that works or not?

    Regards
    Brajesh

  • Keymaster
    (BuddyDev Team)
    Posts: 24774
    Brajesh Singh on July 29, 2024 at 4:12 pm in reply to: [Resolved] BuddyPress Auto Activate Auto Login issues #52886

    Hi Naomi,
    Thank you for using the plugin.

    Can you please confirm that you have enabled the auto activation settings? Also, which version of BuddyBoss are you using?

    Please share the details and we will assist.

    Thank you
    Brajesh

  • Keymaster
    (BuddyDev Team)
    Posts: 24774
    Brajesh Singh on July 29, 2024 at 4:11 pm in reply to: [Resolved] How to display bullet lists on the user profile? #52885

    Hi Alex,
    I am sorry, I lack the time to invest into getting tiny 7 work with WordPress.

    I would suggest opting for one of the solutions from above for now.

    Regards
    Brajesh

  • Keymaster
    (BuddyDev Team)
    Posts: 24774
    Brajesh Singh on July 29, 2024 at 3:55 pm in reply to: BuddyBlog Group Type Commenting #52884

    Hi Aaron,
    Thank you for the patience.
    I have investigated it and I am seeing the reason.

    The problem is BuddyBoss’s bp_disable_blogforum_comments() method works incorrectly if the activity component is not set to ‘blogs’. It does not check if the commenting is actually disabled for the post type unless the component is set to blogs. In our case, the component is set to ‘groups’ and that’s why.

    We can filter on bp_activity_can_comment to provide a fix as I don’t have much hope from their support.

    Please allow me couple more days to put an update without having any side effect.

    Thank you
    Brajesh

  • Keymaster
    (BuddyDev Team)
    Posts: 24774
    Brajesh Singh on July 29, 2024 at 9:45 am in reply to: [Resolved] BuddyPress Xprofile Custom Field Types Buddyboss #52880

    Hi,
    Welcome to BuddyDev.

    I just tested it and It is working.

    Can you please confirm you are translating the string %s years. This is used to display the age.

    Regards
    Brajesh

  • Keymaster
    (BuddyDev Team)
    Posts: 24774
    Brajesh Singh on July 29, 2024 at 9:37 am in reply to: [Resolved] How to display bullet lists on the user profile? #52879

    Hi Alex,
    Thank you for the replies.

    I went through the entire thread about the security issues. It is not going to affect when you use it with WordPress.
    All the content gets sanitized with kses and only allowed tags get pass, so the issue does not have impact on WordPress.

    Still, here is a way to disable the kses stripping your tag(It is even more insecure to do it).

    
add_action( 'bp_init', function () {
	remove_filter( 'bp_get_the_profile_field_value', 'bp_xprofile_escape_field_data', 8 );
} );

    Regards
    Brajesh

  • Keymaster
    (BuddyDev Team)
    Posts: 24774
    Brajesh Singh on July 27, 2024 at 5:22 am in reply to: xprofile taxonomy with wpml #52872

    Hi Eric,
    Thank you for reporting the issue.

    In our plugin, we use

    
	$terms = get_terms( $taxonomy_selected, array( 'hide_empty' => false ) );

    and then loop through the terms to show $term->name as option label. I am not sure who WPML works with it. If the update the name, It should work.

    Otherwise, Please ask them if they recommend using another method to make it wpml compatible and I will update.

    Regards
    Brajesh

  • Keymaster
    (BuddyDev Team)
    Posts: 24774
    Brajesh Singh on July 27, 2024 at 5:19 am in reply to: [Resolved] BP XProfile Custom Field – Dynamically-created multiselect values won’t save #52871

    Hi Evan,
    I am sorry, I am not sure of the issue.

    The plugin expects you to send the terms(text string) as array.
    We filter on bp_xprofile_set_field_data_pre_validate to test for the field type and if the field type is tag, we create terms for any of the non existing term.

    Please take a look at the submitted form and see if the value is sent as array.

    Regards
    Brajesh

  • Keymaster
    (BuddyDev Team)
    Posts: 24774
    Brajesh Singh on July 27, 2024 at 5:10 am in reply to: How to change Profile Visibility tab in setting to Profile Privacy #52870

    Hi Laz,
    Welcome to Buddydev support forums.

    I am sorry for the delayed reply.

    Are you using any localization plugin? If yes, you can localize The profile visibility manager.

    If not, Please let us know what you need it and we will generate the localized file and share with you.

    Regards
    Brajesh

  • Keymaster
    (BuddyDev Team)
    Posts: 24774
    Brajesh Singh on July 27, 2024 at 4:58 am in reply to: BuddyBlog Group Type Commenting #52869

    Hi Aaron,
    Please allow me to look into it and get back to you by Monday.

    Regards
    Brajesh