Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

Replies

  • Keymaster
    (BuddyDev Team)
    Posts: 24766
    Brajesh Singh on January 9, 2025 at 8:03 pm in reply to: Anonymous plugin – Activity as friend #54539

    Hi Katrine,
    Hope you are doing well.

    I am sorry for the delayed reply, we have been away form BuddyDev for a bit.
    I will be releasing an update within next 48 hours with a fix for the anonymous activity.

    I am sorry, I won’t be able to offer any assistance with custom privacy as I am deeply invested in a whole alternative solution.

    Regards
    Brajesh

  • Keymaster
    (BuddyDev Team)
    Posts: 24766
    Brajesh Singh on January 9, 2025 at 8:01 pm in reply to: BP Deactivate Account – Bugs #54538

    Hi Katrine,
    Thank you for the reply and understanding.

    Hope you are doing well. That’s the limiting we have to face as 3rd party plugin developers when the base platform does not offer/limit flexibility. I am sorry that we could not help much with it and I am hoping that we will do something about these for sure in future.

    Regards
    Brajesh

  • Keymaster
    (BuddyDev Team)
    Posts: 24766
    Brajesh Singh on January 9, 2025 at 7:55 pm in reply to: MediaPress – Translation #54537

    Hi Katrine,
    Thank you.

    I am sorry for the delayed reply as we have been away form BuddyDev for few days.

    Thank you for pointing that out. It is related to automatic gallery creation for the wall gallery.
    In your localization plugin, please search for 'Wall %s Gallery' and change it to 'Wall Gallery'

    That will solve it for any new wall gallery created in future. For the current ones, you will need to edit their name.

    Regards
    Brajesh

  • Keymaster
    (BuddyDev Team)
    Posts: 24766
    Brajesh Singh on January 9, 2025 at 7:49 pm in reply to: BuddyBoss Documents page PDF preview not working #54536

    As suggested above, Please contact BuddyBoss for support.

  • Keymaster
    (BuddyDev Team)
    Posts: 24766
    Brajesh Singh on January 9, 2025 at 7:49 pm in reply to: Where to change the buttons at the profile header? #54535

    Hi Josh,
    Thank you for the reply.
    There are solutions like unhooking the button and hooking your own custom one. The problem is BuddyPress/BuddyBoss has a convoluted implementation for these basic things. The time invested in fixing/changing feel so much unrewarding.

    If it is highly necessary, I will suggest you look into how these buttons are generated and hooked into the header.

    Regards
    Brajesh

  • Keymaster
    (BuddyDev Team)
    Posts: 24766
    Brajesh Singh on January 9, 2025 at 7:45 pm in reply to: Security Alert: BuddyDev account access disabled for some of the users #54534

    Hi Ben,
    Happy New Year!
    Hope you are doing well.
    I am doing great and have some amazing news coming at the end of this month 🙂

    It was a brute force dictionary attack with username/text password. Except the email address, username, displayname on BuddyDev, there was nothing else compromised for these accounts. Activating a basic firewalll has stopped and there has been no new issue in last 3 weeks now.

    Regards
    Brajesh

  • Keymaster
    (BuddyDev Team)
    Posts: 24766
    Brajesh Singh on January 9, 2025 at 7:41 pm in reply to: bug BuddyPress Profile Data Moderator #54533
    This reply has been marked as private.
  • Keymaster
    (BuddyDev Team)
    Posts: 24766
    Brajesh Singh on January 1, 2025 at 2:45 am in reply to: BP Deactivate Account – Bugs #54443

    Hi Katrine,
    Thank you for your patience.

    I have tried it. I am sorry but I don’t see a solution in sight.

    Here is what I did:-
    – Only way to truly prevent it would be to check on activity form submission, if anonymous is ‘on’ and has attached media files, we stop the posting and notify the user.

    The problem is, I tried using ajaxSend, ajaxPrefilter as well as submit() on form to abort the request. I am able to show the notice but the post still gets published.

    BuddyPress does not provide an entry point to stop the request client side and that is preventing me from getting it to work.

    Regards
    Brajesh

  • Keymaster
    (BuddyDev Team)
    Posts: 24766
    Brajesh Singh on January 1, 2025 at 1:22 am in reply to: [Resolved] Exclude from sitewude activity stream per user id #54442

    Hi Michael,
    Thank you for your post.

    Your approach in https://buddydev.com/support/forums/topic/exclude-from-sitewude-activity-stream-per-user-id/#post-54246 is correct one.

    There is a problem with your second approach in https://buddydev.com/support/forums/topic/exclude-from-sitewude-activity-stream-per-user-id/#post-54349

    1. The first approach always hides activity (marks as private) irrespective of what activity type it is.
    2. secondary_item_id could be a lot of things depending on context. It could be a user id or another object id and I will advise checking against it unless you check the $activity->type to ensure secondary_item_id will be user id.

    Regards
    Brajesh

  • Keymaster
    (BuddyDev Team)
    Posts: 24766
    Brajesh Singh on January 1, 2025 at 1:12 am in reply to: The image by link is not loaded on php 8.3 #54441

    Hi Arisu,
    Hope you are doing well.
    I am sorry for the delayed response. I tested the plugin with PHPCompat tool for 8.3 and I am not seeing any issue that can throw notices.

    Can you please tell me the steps to reproduce it?

    Thank you
    Brajesh