Unmoderated User posting and partial access

Viewing 15 replies - 1 through 15 (of 29 total)
1 2
  • Thread Starter majecdad

    (@majecdad)

    11 years, 3 months ago

    I would add some more results of testing, the New User – still unmoderated – DOES show up in the standard BP Members widget, shows up in the Member directory, and is calculated in the All Members qty.

    Plus he can comment on existing Updates from other users.

    Thanks for any insight you can give as to whether I might be looking at intended functionality totally wrong.

    Michael Beckwith

    (@tw2113)

    The BenchPresser

    11 years, 3 months ago

    Hi Mitch.

    “Venkman” from AppPresser, aka Michael from WebDevStudios 😉

    Overall, until approved, they should be regularly redirected back to their own profile within BuddyPress, and only able to set up their own profile. No interaction of any kind outside of that.

    If you have 3rd party extensions providing the BP functionality outside of BuddyPress’ components, then that’s not something I would have been able to predict or know about.

    Friend requests should be blocked, but I have to wonder if they are still getting provided the ability to search and add buttons, for which this would be a bug.

    Added a public message where? If you can provide an example, that’d be awesome.

    Private messages should be more hardened in one of the last releases and the tab hidden. Not sure about the 404 at the moment.

    Shouldn’t be able to be posting items or even seeing activity to favorite.

    The member lists should be hidden, I know I have code involved to remove them until they’re marked as approved.

    Could you check the user meta for this user, via the database, and see if they have this user meta key and what it’s set to?

    _bprwg_is_moderated

    I moved to using user_meta to indicate current status with the 4.2.0 release.

    Regardless, they’re somehow getting way too much access and I’m not sure why quite yet.

    Are you willing to let me in to see this in action? It may be easier for me to debug what’s going on that way, in the long run.

    Thread Starter majecdad

    (@majecdad)

    11 years, 3 months ago

    Hey Michael,

    I thought I recognized you from somewhere – didn’t make the AppPresser connection. Great product, loads of potential, wish I could have gained better traction with it. I think I got stuck on PhoneGap. I need to look again before all my licenses expire. 🙂

    WRT this matter: First _bprwg_is_moderated is set as true

    Secondly, you may have a point with other plugin functionality. I have about a dozen BP plugins in place (plus way too many others). I know I deactivated some in testing, I’ll continue to look at that. (edit: have deactivated all BP plugins excl: BP and BPRO, issue remains).

    Re: ‘adding public message where’ – If the New User goes to /members/existingmember/ the New User can see the existing user profile and the buttons that say ‘public message’ and ‘private message’ (as well as the aforementioned add friend) as referenced, the Public message button was visible by the NewUser in the existing user profile, but clicking on it gave the White Screen of Death. (‘oh by the way’ update: after deactivated all the other BP plugins, NewUser is now ABLE to post a public message update to an existing user profile page – ooops – go figure).

    Here are the BP plugins I had active, but a conflict here doesn’t seem to be the issue.

    BP Group Hierarchy Propagate by Christian Wach version 0.3.2,
    BP Group Hierarchy by David Dean version 1.4.3,
    BP Group Organizer by David Dean version 1.0.8,
    BP Profile Search by Andrea Tarantini version 4.0.3,
    BP Registration Options by Brian Messenlehner and Michael Beckwith of WebDevStudios, Jibbius version 4.2.4,
    BuddyPress Activity Privacy by Meg@Info version 1.3.3,
    BuddyPress Group Email Subscription by Deryk Wenaus, boonebgorges, r-a-y version 3.5,
    BuddyPress Like by Darren Meehan version 0.2.0,
    Buddypress Xprofile Custom Fields Type by donmik version 2.1.5,
    BuddyPress by The BuddyPress Community version 2.2.0,

    Lastly, happy to provide you access. Just know it is a total – I mean really – sandbox site… so no laughing at it. 🙂

    LMK where you want credentials sent.

    Thanks for your efforts here.

    Michael Beckwith

    (@tw2113)

    The BenchPresser

    11 years, 3 months ago

    michael @ webdevstudios.com would be best place to send them. Please provide a link to this thread just so I can keep track of things, email wise.

    No laughing involved, I have “50” sandbox sites locally for various things. I know things are in development.

    tiagoschenkel

    (@tiagoschenkel)

    11 years, 3 months ago

    Hi!

    I had the same problem and I just created a test environment, fresh installation of WordPress, then I enabled BuddyPress and then only the plugin “BP Registration Options”.

    I created a test user and activated the account. Then I logged in on the site, without “Approve” the user, and I was able to post a activity on the “What’s new, [user_name]?” field.

    The user should not be able to interact before his approval, so this looks like more a bug in the plugin, unfortunately…

    Thread Starter majecdad

    (@majecdad)

    11 years, 2 months ago

    Hey Michael,

    So it’s been a bit since the initial report, I was wondering if you were able to replicate the issue? Or if you had hit the site with the login info I submitted?

    I also reverted to BP 2.1.1 on another test site I have – I figured it might be a 2.2 issue – but the problem was there too.

    Please let me know if I can do anything else to help.

    Thanks.

    Michael Beckwith

    (@tw2113)

    The BenchPresser

    11 years, 2 months ago

    Mitch, hadn’t quite gotten around to much yet due to other things taking priority, but I assure you I haven’t forgotten. I’m planning to look into it a lot closer today or tomorrow, preferably today.

    Michael Beckwith

    (@tw2113)

    The BenchPresser

    11 years, 2 months ago

    Mitch, is there any way to get my own test account at a user level? I keep going to http://domain.com/wp-login.php?action=register and it keeps redirecting me to a login page, which isn’t what I need, since I don’t have the test account yet.

    Alternative: can I hijack any of the pending users and change their password so that I could log in as that user and see what’s going on?

    Thread Starter majecdad

    (@majecdad)

    11 years, 2 months ago

    I made a change to how you can access (removed Login plugin). You can try again, and I will send you a quick email.

    A/O, also, yes, feel free to hijack users.

    Michael Beckwith

    (@tw2113)

    The BenchPresser

    11 years, 2 months ago

    I haven’t dug too far in, but I think I have a good sudden idea of exactly what needs to be done. The biggest thing I noticed is that you don’t have “Private network” checked, which is the biggest indicator that the user needs to be redirected to their profile. However, it appears that there is still too much “leaking” through for those who are intended to be able to SEE goings on, but not able to actually interact, which would be the minimal purpose of the moderation settings.

    So, work to do, and hopefully soon.

    Thread Starter majecdad

    (@majecdad)

    11 years, 2 months ago

    ​Right, my (maybe incorrect?) understanding was that having just ‘Moderate’ precluded ​the new user from interacting with the platform components (except their own profile), where ‘Private Network’ hid everything.

    I don’t have a problem enabling the more restrictive of the two, it was just ‘Moderate’ (as I understood it) was the perfect fit for not-too-much/not-too-little.

    Regardless, let me know what you recommend, I’m flexible.

    More importantly, thanks for diving in to resolve!

    Michael Beckwith

    (@tw2113)

    The BenchPresser

    11 years, 2 months ago

    Basically moderate, from my understanding (I haven’t been a part of this plugin the whole time) is meant to prevent any interaction, PMing, friending, commenting on activity, etc, but the content could still be viewed.

    Private network, on the otherhand, removes viewing completely. User is restricted to their own profile, in terms of BuddyPress/bbPress areas, the whole time until approved.

    Half of the first one is not working as intended, which is what I need to work on soon. Private network, as far as I’ve seen with your site, is working.

    Thread Starter majecdad

    (@majecdad)

    11 years, 2 months ago

    I just modified the site to test in the ‘Private Network’ mode. That could be doable. I like the way it shows all the profile page icons, but they are not functional.

    I also think the reg process and messaging is very well done.

    One issue there though. In my testing, the new user (not approved), while restricted from seeing any of the information from/of others (good), is still ABLE to post in the stream and have it seen by everyone else (notsogood). That, of course, is potentially really spammy.

    The (unapproved) new user is also added to the users list. It seems it would be better to keep them in the BPRO approval queue instead.

    Lastly, I am going to test with a potentially conflicting privacy plugin deactivated, and will followup.

    Thanks.

    Thread Starter majecdad

    (@majecdad)

    11 years, 2 months ago

    I thought the ability to post to everyone prior to approval might have been related to having the buddypress activity privacy/ plugin active – which allows multiple privacy choices (including ‘Anyone’) for post visibility.

    But after deactivating it, the above issues remain.

    I just wanted to update you as I tested from this end.

    Thanks.

    Michael Beckwith

    (@tw2113)

    The BenchPresser

    11 years, 2 months ago

    I spent a few hours on this tonight and I’m hoping I have more holes covered soon. Aiming for a 4.2.5 release next week if I can get some bugs finalized.

    Is the stream posting from a “What’s new” form? I know I took care of at least one, but I think all of them will be affected.

    Users should be getting hidden from frontend lists, unless I missed a spot which is wholly possible.

Viewing 15 replies - 1 through 15 (of 29 total)
1 2

The topic ‘Unmoderated User posting and partial access’ is closed to new replies.

Tags