Title: Security issue Last modified: April 9, 2018 --- # Security issue * Resolved [José Miguel](https://wordpress.org/support/users/jomisica/) * (@jomisica) * [8 years, 5 months ago](https://wordpress.org/support/topic/security-issue-87/) * This plugin is not secure because it allows any visitor to the site to modify any user’s options! * All you have to do is build a URL like this: [https://www.example.com/members/the-member-that-will-be-affected/settings/privacy-settings/](https://www.example.com/members/the-member-that-will-be-affected/settings/privacy-settings/) * I’m already using the bp_is_my_profile () function to protect my users. While this serious problem is not solved, in my view. * The idea of the plugin is very good, however it needs some work! - This topic was modified 8 years, 5 months ago by [José Miguel](https://wordpress.org/support/users/jomisica/). - This topic was modified 8 years, 5 months ago by [José Miguel](https://wordpress.org/support/users/jomisica/). - This topic was modified 8 years, 5 months ago by [José Miguel](https://wordpress.org/support/users/jomisica/). - This topic was modified 8 years, 5 months ago by [José Miguel](https://wordpress.org/support/users/jomisica/). * The page I need help with: _[[log in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Fsecurity-issue-87%2F%3Foutput_format%3Dmd&locale=en_US) to see the link]_ Viewing 15 replies - 1 through 15 (of 15 total) * Thread Starter [José Miguel](https://wordpress.org/support/users/jomisica/) * (@jomisica) * [8 years, 5 months ago](https://wordpress.org/support/topic/security-issue-87/#post-10162294) * Using this patch resolves: * — includes/buddypress-profile-privacy.php 2018-04-09 18:20:20.000000000 +0100 +++ includes/buddypress-profile-privacy.php 2018-04-09 18:20:26.000000000 +0100@@- 92,6 +92,7 @@ ‘show_for_displayed_user’ => true, ‘parent_url’ => trailingslashit( $bp->loggedin_user->domain . $bp->slug . “settings” ), ‘parent_slug’ => ‘settings’, + ‘user_has_access’ => bp_core_can_edit_settings() ) ); * } * [harry74](https://wordpress.org/support/users/harry74/) * (@harry74) * [8 years, 3 months ago](https://wordpress.org/support/topic/security-issue-87/#post-10364134) * Well spotted Jose! Could you please tell me where I should paste your patch? I know almost nothing about coding, so I tried it in the bp-custom.php file but obviously that was a mistake because it gave errors. * PS. I don’t want to sound mean, I do appreciate everyone’s effort in providing free plugins, but don’t you think that 3 stars is way too generous and gives the wrong picture? This is a huge security issue for a social network and basically makes the plugin useless until it is fixed. * Thanks * Thread Starter [José Miguel](https://wordpress.org/support/users/jomisica/) * (@jomisica) * [8 years, 3 months ago](https://wordpress.org/support/topic/security-issue-87/#post-10364764) * 1. You have to edit the file: /wp-content/plugins/simple-buddypress-profile-privacy/ includes/buddypress-profile-privacy.php * 2. Find the function sbpp04_profile_settings_nav * 3. And change for this: function sbpp04_profile_settings_nav() { global $bp; * bp_core_new_subnav_item(array( ‘name’ => __(‘Privacy Settings’, ‘simple-buddypress- profile-privacy’), ‘slug’ => ‘privacy-settings’, ‘position’ => 30, ‘screen_function’ => ‘sbpp04_privacy_screen’, ‘show_for_displayed_user’ => true, ‘parent_url’ = > trailingslashit(bp_core_get_user_domain(bp_displayed_user_id()) . “settings”),‘ parent_slug’ => ‘settings’, ‘user_has_access’ => bp_core_can_edit_settings() * )); } * The important part is: ‘user_has_access’ => bp_core_can_edit_settings () * Do not forget the comma before! * If I can help with anything else, just say so! * Thread Starter [José Miguel](https://wordpress.org/support/users/jomisica/) * (@jomisica) * [8 years, 3 months ago](https://wordpress.org/support/topic/security-issue-87/#post-10364834) * As for the three stars, I believe they have been fair at a certain time. Errors even happen in software such as the Linux Kernel. This is due to the software being in constant development. However I think it is lack of responsibility not to correct a mistake having knowledge of it. Also I think we should all rate the plugins we use, this way that develops has some feedback. Keeping software always up to date requires time that is sometimes not even recognized. * Thread Starter [José Miguel](https://wordpress.org/support/users/jomisica/) * (@jomisica) * [8 years, 3 months ago](https://wordpress.org/support/topic/security-issue-87/#post-10366329) * Actually I can not modify the settings at the moment. It must have been due to another plugin or else I tested badly. However, it is still bad to get into the profile of others without permission. * Plugin Author [Fencer04](https://wordpress.org/support/users/fencer04/) * (@fencer04) * [8 years, 3 months ago](https://wordpress.org/support/topic/security-issue-87/#post-10366359) * Yes, I agree. I did respond to this thread with that information when you first made the post. I have no idea why it didn’t show up. I’m hoping that [@harry74](https://wordpress.org/support/users/harry74/) decides to update his review since a lot of hard work went into this (and still is). * I’ll be posting an incremental update to the plugin with your fix later today. I was trying to push out the larger update I have been working on but updates to BuddyPress got in the way. I’ll post here after I make the update. * Thread Starter [José Miguel](https://wordpress.org/support/users/jomisica/) * (@jomisica) * [8 years, 3 months ago](https://wordpress.org/support/topic/security-issue-87/#post-10366369) * OK thank you! * [harry74](https://wordpress.org/support/users/harry74/) * (@harry74) * [8 years, 3 months ago](https://wordpress.org/support/topic/security-issue-87/#post-10366477) * Already updated it. I just wish WP would fix this bug, where in the main plugin screen it still shows the old rating after having updated it. * José I don’t think it’s another plugin, since I tested both times with the same ones activated. BTW, thanks a bunch for explaining how to implement your patch, worked like a charm. * Apart from that, I’m trying to find a way to disable the “Post in” dropdown menu when a user posts something on the activity stream. I find it confusing and I’d like the post to go by default wherever the user is. If he’s in his profile, post to his profile; if he is in a group page, post to the group’s page etc. I’m pretty sure there’s no plugin that does that, I’ve searched for hours. Could you tell me if this is something that could be done fairly easily by a coder or if it requires a lot of work? * Thanks in advance! * Plugin Author [Fencer04](https://wordpress.org/support/users/fencer04/) * (@fencer04) * [8 years, 3 months ago](https://wordpress.org/support/topic/security-issue-87/#post-10366520) * [@harry74](https://wordpress.org/support/users/harry74/) I appreciate it. I do see the new rating now. I think there is just a delay. * Thread Starter [José Miguel](https://wordpress.org/support/users/jomisica/) * (@jomisica) * [8 years, 3 months ago](https://wordpress.org/support/topic/security-issue-87/#post-10366977) * [@harry74](https://wordpress.org/support/users/harry74/) I can help about “Post in”, but by email, because it is out of context. My email is [miguel@ncdc.pt](https://wordpress.org/support/topic/security-issue-87/miguel@ncdc.pt?output_format=md) * Plugin Author [Fencer04](https://wordpress.org/support/users/fencer04/) * (@fencer04) * [8 years, 3 months ago](https://wordpress.org/support/topic/security-issue-87/#post-10367205) * The new update is live. If you guys could test it and confirm it’s working for you I’d appreciate it. * Thread Starter [José Miguel](https://wordpress.org/support/users/jomisica/) * (@jomisica) * [8 years, 3 months ago](https://wordpress.org/support/topic/security-issue-87/#post-10367305) * The problem with showing the profile has been resolved. * Thank you! * If the translation into Portuguese is important I can help. * Thread Starter [José Miguel](https://wordpress.org/support/users/jomisica/) * (@jomisica) * [8 years, 3 months ago](https://wordpress.org/support/topic/security-issue-87/#post-10367312) * The problem is solved. * Plugin Author [Fencer04](https://wordpress.org/support/users/fencer04/) * (@fencer04) * [8 years, 3 months ago](https://wordpress.org/support/topic/security-issue-87/#post-10367314) * Excellent. Thank you for the assist. You both get props in the dev notes for the plugin. * [harry74](https://wordpress.org/support/users/harry74/) * (@harry74) * [8 years, 3 months ago](https://wordpress.org/support/topic/security-issue-87/#post-10367557) * [@fencer04](https://wordpress.org/support/users/fencer04/) Just tested it myself, with the new BP update 3.1.0 too. Problem solved. Good job. Thanks! * [@jomisica](https://wordpress.org/support/users/jomisica/) I’ll email you asap( hganns1974@gmail.com). Thank you for offering to help! - This reply was modified 8 years, 3 months ago by [harry74](https://wordpress.org/support/users/harry74/). Viewing 15 replies - 1 through 15 (of 15 total) The topic ‘Security issue’ is closed to new replies. * ![](https://ps.w.org/simple-buddypress-profile-privacy/assets/icon-256x256.jpg? rev=1517564) * [Simple BuddyPress Profile Privacy](https://wordpress.org/plugins/simple-buddypress-profile-privacy/) * [Frequently Asked Questions](https://wordpress.org/plugins/simple-buddypress-profile-privacy/#faq) * [Support Threads](https://wordpress.org/support/plugin/simple-buddypress-profile-privacy/) * [Active Topics](https://wordpress.org/support/plugin/simple-buddypress-profile-privacy/active/) * [Unresolved Topics](https://wordpress.org/support/plugin/simple-buddypress-profile-privacy/unresolved/) * [Reviews](https://wordpress.org/support/plugin/simple-buddypress-profile-privacy/reviews/) * 15 replies * 3 participants * Last reply from: [harry74](https://wordpress.org/support/users/harry74/) * Last activity: [8 years, 3 months ago](https://wordpress.org/support/topic/security-issue-87/#post-10367557) * Status: resolved