BuddyPress.org

When I click on your link, I get redirected to your home page. Then, on the home page if I try using the search, I get a list of search results as you’d expect.

background-color: #333;

You should use Chrome or FireFox dev tools to find the selector you need if @danbp‘s selector didn’t work for you.

i edited the source code my self and added <form action=”#” which should sort the problem but by doing that everytime there is an update i will need to redo it myself

Yeah, that’s not recommended because, as you say, you will need to redo after each BuddyPress update.

The W3C validator is saying you can’t have an empty form action attribute. So instead of:

<form action=""

you will need to provide a value like this:

<form action="some-script.php"

You could open a ticket on Trac or alternatively you could solve the problem by providing a value yourself. Check out the BuddyPress Template Hierarchy article for…[Read more]

Yes. You can use bp_parse_args() for that. See the Using bp_parse_args() to filter BuddyPress template loops article for more info.

I can view anyones messages when logged out.

And you’re definitely talking about what BuddyPress refers to as private messages?

Can you try again after disabling all plugins, reverting to TwentyFifteen and removing all custom code? If you still get to see private messages when logged out then that shouldn’t be happening.

I can view anyones messages when logged out.

And you’re definitely talking about what BuddyPress refers to as private messages?

Can you try again after disabling all plugins, reverting to TwentyFifteen and removing all custom code? If you still get to see private messages when logged out then feel free to open a bug ticket on Trac. That…[Read more]

I can view anyones messages when logged out.

And you’re definitely talking about what BuddyPress refers to as private messages? That is definitely not right.

Can you try again after disabling all plugins, reverting to TwentyFifteen and removing all custom code? If you still get to see private messages when logged out then feel free to open a…[Read more]

With standard buddypress (no modifications) you can freely view anyone’s messages without even logging in

That shouldn’t be the case for all users. Only users with admin capabilities should be able to do that. Are you able to see people’s private messages when logged in as a subscriber? If so, that’s a bug

Also, to answer your question:

How would you do the security check?

These must be done server side. You’re right to think that anything done via the client can be tainted (manipulated by an end user).

The general process is:

Make an AJAX call passing any client-side data to the server
Process the data (secure it and perform necessary privacy…[Read more]

Also, to answer your question:

How would you do the security check?

These must be done server side. You’re right to think that anything done via the client can be tainted (manipulated by an end user). The general process is:

Make an AJAX call passing any client-side data to the server
Process the data (secure it and perform necessary privacy…[Read more]

You could see hidden data that user did not want displayed.

That’s why I said privacy checks should be carried out separately.

As an aside, security and privacy are both very different things. Securing data means making sure it is safe where as privacy refers to the visibility of the data. Both these things should be addressed in your…[Read more]

You could see hidden data that user did not want displayed.

That’s why I said privacy checks should be carried out separately.

As an aside, security and privacy are both very different things. Securing data means making sure it is safe where as privacy refers to the visibility of the data. Both these things should be addressed in your…[Read more]

what harm could come from a visit to a simple profile tab?

You could see hidden data that user did not want displayed.

That’s why I said privacy checks should be carried out separately.

As an aside, security and privacy are both very different things. Securing data means making sure it is safe where as privacy refers to the visibility of the…[Read more]

Just to be clear, security and privacy checks should be carried out separately to WP nonce implementation

@codemonkeybanana this is just my own personal opinion but implementing WP nonces when loading tabs isn’t hugely necessary. WP nonces verify user intent, and even if intent cannot be verified, what harm could come from a visit to a simple profile tab?

What are you using for your default landing tab?

As an example, let’s say you’re using activity (which is the default tab anyway) so no need to do the following:

define( 'BP_DEFAULT_COMPONENT', 'activity' );

Now, your example.com/members/username screen can be targeted like this:

if ( bp_is_user_activity() ) {
// Do something.
}

Note: bp_…[Read more]

Instead of groups_accept_invite(), try using groups_join_group().

So in your code above, you’d use: groups_join_group( $group_id, $bp_user_id )

Rendez Vous is the closest thing I know of. Feel free to search the Plugin Directory to see if anything else is available.

Rendez Vous is the closest thing I know of. Feel free to try searching the Plugin Directory to see if anything else is available.