[@hnla Participant 16 years, 5 months ago]

http://etivite.com/groups/buddypress/forum/topic/quick-tip-display-the-groups-forum-link-on-the-group-directory-groups-loop-php/

[@hnla Participant 16 years, 5 months ago]

Generally it would be placed in a functions.php file that lives in a child theme – are you running a child theme? if not I suppose it can be run in bp-custom.php file that lives in the plugin folder but haven’t tested whether that does work. You can place it in the default themes functions.php file but the problem there is that when you upgrade BP you will lose any mods made to this file and any others in the default theme which is why it’s best to run a child theme if planning on making a few mods.

[@hnla Participant 16 years, 5 months ago]

Did you pick up on the fact that this new page opening function was only to relate to pages being opened from an RSS feed?
Absolutely! Note the reference to the li.feed above. The RSS item that I looked at was set with this token what the script does is look for all instances of this element with a class of ‘feed’ and adds a new ‘target’ attribute to the anchor. As I said though this is good to go where that condition holds true, if elsewhere there are feed links that decide to change that parent li token to ‘rss’ or not place the link in a list construct, but things can be amended. The core of the script is something I use all the time when I would rather ensure that the main page is not navigated away from.

Opening new windows is generally considered to be something that should be done sparingly and only with good reason while understanding the implications thereof. It must be remembered that the general user is simply extremely unfamiliar with how something like a browser works, yes I trap new windows to tabs but if a inexperienced user is allowing new windows to open then what can happen is the classic confusion often referred to as ‘breaking the back button’ A new window opens as an overlay on top of and masking the original and this happens at lightning speed that many miss the event; this new window has no ‘history’ thus the back button has no function and that can massively confuse inexperienced users who can’t work out why it has ‘stopped’ working.

It’s not a case that one can’t do this but that we need to be aware of how we are now interacting with what is regarded as user choice and that user choice is not something that authors are meant to try and control in any significant way.

N.B I have adjusted the script posted to change the rel=”ext” to rel=”feed” as this is a more appropriate value in this instance.

[@hnla Participant 16 years, 5 months ago]

tbh it’s considered a bad thing for developers to do, the opening of new windows is a browser issue and as such it’s considered impolite to force your wishes on the end user. It is my decision as to how I deal with links not yours, if you try and disrupt my browsing habits I’m annoyed; regardless I override anything you might try and do so it’s largely wasted effort your new window becomes a new tab for me.

This action is also a behaviour and as such the use of attributes is rightly deprecated, but they can be added via scripting. You could give the following code a try it would need to be added to a functions.php file in a child theme.


function rss_new_win() {
echo <<<SCRIPT

<!--
function bindNewWin() {
jQuery("li.feed > a").attr({target:"_blank", rel:"ext"});
return false;
}
jQuery(document).ready(function(){
bindNewWin();
});
//-->

SCRIPT;
}
add_action('wp_head', 'rss_new_win');


I can’t vouch for how well this works, it’s tested and works ok but whether it breaks any WP/BP script inclusion rules I’m not familiar with i couldn’t say so it should be used cautiously ; also take note that it adds an attribute to all anchors that have a li parent of class ‘feed’ if that condition is not true then it would fail (the main feed on the activity steam is marked up in this fashion if others exist that are contary then they would need to be added in some manner to this code.

IGNORE THE CODE POSTED HERE IT DOESN’T DISPLAY CORRECTLY grab from this pastebin link if you want to give it a go:
http://pastebin.com/keBUmVxX

[@hnla Participant 16 years, 5 months ago]

So far the only method I have found to control activity stream entries is to work of bp_get_activity_type() having found the activity type – in this instance it’s joined_group you can simply wrap the loop that’s in /activity/entry.php with something like:

if ( 'joined_group' !== bp_get_activity_type()) :

this now means that the activity loop will only output an entry as long as it’s not of type joined_group.

It’s a bit of a crude approach and others may have a better solution.

[@hnla Participant 16 years, 5 months ago]

Difficult to help further than saying validate your layout, it’s very badly mal formed. CSS is parsed and applied to the DOM if the DOM is broken then CSS can not be applied correctly or struggles to know where elements start and end. Lots of things can stall the correct construction of a complete page, and this will be different from browser to browser.

You must work through the code identifying where things have broken and correcting them, only then can you be sure that you have a level playing field and that any remaining issues are not simply related to broken markup.

Fyi a good place to start would be the fact that half the necessary head elements are halfway down the page inside the body element of the document, frankly it’s one of those times I would rather HTML had a stricter parsing engine rather than the abomination referred to as the Tag Soup Parser.

[@hnla Participant 16 years, 6 months ago]

@mikepratt that’s a really nice design and layout, especially like the /why/ page.

[@hnla Participant 16 years, 6 months ago]

Filezilla is pretty good ftp programme, the client can run sftp, the server can not. I use FileZilla as my client, always have.

Pure-ftp seems to be installed on many boxes of the semi configured variety, it is claimed to be a secure FTP server I haven’t used it so can’t comment but others around such as Pro-ftp are known to have holes.

VSFTPD on the other hand is touted as the most secure and endorsed by some very big players such as Redhat, Openbsd, IBM, SANS.

Configured as sftp along with chrooted directories should give a fairly secure environment.

I would still view things pretty cautiously as you haven’t really established the method of exploit and definitely change your ftp access to a sftp one to close that possible avenue of attack down.

[@hnla Participant 16 years, 6 months ago]

That’s the rub it’s why it’s so important to identify how it’s happened, good that you have a dedicated server though as that means you can harden security once things have been cleared up, I like vsftpd as a ftp program considered to be amongst the most secure and set up with virtual users jailed to directories and sftp. Good luck identifying it, keep the thread updated.

[@hnla Participant 16 years, 6 months ago]

@gregfielding you have my sympathy for the task ahead it’s a major PITA. Interested in whether you have identified the manner through which you were hacked though, was it indeed via ftp or some other similar unauthorised access of your server?

[@hnla Participant 16 years, 6 months ago]

Ah hadn’t considered load times as Boone points out, although I don’t really see that there would be a huge issue there and there are many more things going on that do cause page content rendering issues. When I see document elements flowed in this way and visually re-ordered it tends to be from a somewhat misguided belief that it benefits anything even though the supposed benefits have never been proved in any testing and somewhat disproved from an accessibility point of view. In light of this elements purpose I would actually tend to think it’s best placed as it is, if I were designing a theme from scratch I would probably go along with it’s positioning in the footer area, but… one does need to consider text rendering and assistive devices if this element and it’s links are important then where do they fall in the document flow when the page is read by screen readers or rendered sans styles plain text, these are considerations all too often overlooked.

One thing to consider though is how IE6 handles things or not as the case may be, position :fixed is not understood by IE6 look at the default theme in that browser!

If staying with position:fixed then do add rules for IE6 overridding fixed with absolute using Conditional Comment stylesheets targeted for IE6 or lte IE 7 and use star selector filters for any IE6 specific rules. IE6 sadly is not quite as dead as many would love to believe and many companies and organizations are still using it and not able or willing to upgrade.

[@hnla Participant 16 years, 6 months ago]

Iframes are the devils work, and deprecated and definitely not part of a strict DTD not that anyone cares, if they have to be used then as r-a-y says the scripted approaches are best not that they are that elegant but jQuery thickbox is still a script I personally use when required.

[@hnla Participant 16 years, 6 months ago]

it’s simply added to the footer area for what I would guess are perceived as seo concerns keeping it towards the end of the document and using poss abs to visually render it at top of page. There is nothing stopping you changing the add_action(‘wp_footer’, ‘bp_core_admin’) but I think that you need to do this in a functions file in a child theme if using one, you will need to remove the default action then ad a new one, that way your changes will be preserved. I would have thought you could add it to the do_action(‘bp_header’) hook that sits at the end of the div#header.

[@hnla Participant 16 years, 6 months ago]

:puzzled: that SC looks as though you are missing CSS styles altogether, what do other browsers look like?

Diagnosing problems from screen captures isn’t really possible, it’s all about the code! Your best bet is to post a link to your site, if it’s live.

[@hnla Participant 16 years, 6 months ago]

@andrea_r Ok then that’s not so funny, although reading a few of those posts in the link you provided do seem to suggest that the hacks were in a uploaded free theme.

If it’s a ftp compromise it’s really about time ftp was simply forbidden or retired , such an insecure means of accessing a server especially when there are many far more secure protocols around such as sftp

[@hnla Participant 16 years, 6 months ago]

Wont help and might be obvious but the absolutely vital and most urgent issue to tackle when a server is compromised is that you MUST identify the means of exploit, work out just how this has happened and close that vulnerability – start trawling through your log files for starters. To be able to inject code directly to a functions.php file is more than a little worrying. If there is a exploit out there it needs to be identified and reported to the core dev team to investigate and patch.

Edit/ ok so it appears less an exploit than simply malicious code in a particular theme, for which there is little protection against really as in reality you have uploaded bad code on to your server yourself rather than the bad code needing to find a means of gaining access to the server.

You are going to have to identify what theme is the culprit which given you have so many is going to be painful but it’s likely going to be one of the last that you uploaded, also you can probably discount any themes that are well known and reputable i.e are rated and listed on WP.

P.S I would remove the patebin code fairly soon after perhaps one or two more experienced BP/WP hands have had a peep, one doesn’t want to make public malicious code?

[@hnla Participant 16 years, 6 months ago]

My great worry these days is that the dev community is being compelled to fix problems with usability of core BP, as much or more so than extending what’s there.)

And which is one of my concerns too, and is evident in many posts on this site with developers rushing out fixes to usernames for example as is perceived as being a problem highlighted by one person.

What worries me is that moving forward in this manner is not necessarily the best approach to developing a rock solid core app as you have perceived issues being dealt with in a slightly haphazard manner and the setting up or configuring of BP dependent on finding many and various disparate third party snippets of code.

I’m sure Andy&co are focused too an extent on fixing problems but also it may well be a case that ‘Problems’ are not necessarily perceived as problems- part of the reason I thought that this thread was a necessity; to try and flesh out what were considered existing UI/design flaws and provide that as good solid feedback to work from. I note that in the ‘roadmap’ it states that there are periods of consultation? to garner feedback for version features, I would like to see that process in action and to see developers helping guide these future releases; as I agree that it’s now not simply about adding ‘Features’ but far more importantly on providing a core that works and that developers may extend upon.

It feels as though BP is reaching a momentous milestone or crux point in it’s development, and that perhaps the core dev team ought to take a breather, take time out and review what is right and what is wrong and that needs addressing. Foxly made the point well in his ‘ spammers are coming'(sic) thread discussing his suggested approach to tackling the spam issues surrounding BP where he asserts that BP is reaching this crux point where if it wants to grow from simply a “Science project for hobbyist sites” to a fully mature app that can serve business / enterprise it has to tackle certain issues and is why he considers taking some time to tackle this issue he sees with spam is of paramount importance. I would not disagree with Foxly for one moment and what he has reported on thus far on the issue is commendable but I do not think a developer should be tackling this, taking time out from working on hugely useful ‘Feature’ plugins to work on something that – if is agreed to be an issue that must be dealt with – is essentially a core development issue and really ought to be handled by the core development team not by a third party developer (Obviously this is not to say it won’t be as things are in early stages and speculative at this point)

So, yes extending must slow down for a while and issues of a UI / design nature must be thrust to the fore and I would hope there is a means of collating some of the very apposite and useful comments and suggestions that have appeared so far in this thread.

[@hnla Participant 16 years, 6 months ago]

https://buddypress.org/community/groups/how-to-and-troubleshooting/forum/topic/members-only-2/

Skip over the comment that mentions s2member and look for r-a-y’s comment about register-member 2 and further down I show some basic mods to that single page plugin that allows you to select pages that will redirect or not.

[@hnla Participant 16 years, 6 months ago]

Just like I showed, and added exactly for the reason that you asked! Ho Hum . next time I’ll simply ask a question

[@hnla Participant 16 years, 6 months ago]

And how are you creating that page? I gave a clue to how to add a WP Page to the ‘allowed to be viewed’ pages

[@hnla Participant 16 years, 6 months ago]

Yes on a separate line. take care though and be prepared to backtrack to a good version of the file.

[@hnla Participant 16 years, 6 months ago]

php.ini is a global conf file for php. If you are running your own server you need to locate the file and open in a text editor and find the right line and adjust from 32 to 64. If you are on a shared host then you might get away with adding a line to the .htaccess file – that should be in your root directory – like thus:
php_value memory_limit 64M

This though will only work if a shared host has allowed this particular directive to be set, and I would have thought they wouldn’t but it’s worth a shot!

[@hnla Participant 16 years, 6 months ago]

An earlier thread might work for you. Always run a quick search

https://buddypress.org/community/groups/how-to-and-troubleshooting/forum/topic/members-only-2/

[@hnla Participant 16 years, 6 months ago]

Sounds as though your PHP script memory limit is too low iirc 16mb is default, 32mb the value I always change it to and the guys here tend to recommend setting it to 64mb. This is changed in php.ini if you have no access to the global settings for PHP on the server then you can set it via htaccess or failing both of these approaches contact your server hosts and put the problem to them and see if they can resolve for you.

[@hnla Participant 16 years, 6 months ago]

Markup validation or malformed markup does not really correlate to lack of security.

Whereas WP strove to produce valid markup that would pass validation against DTD schemas there was always a fundamental flaw to maintaining that valid code which is third party coding i.e plugins, sadly when you allow third parties to introduce code/markup to the application you lose control over this aspect as plugin authors will have varying degrees of proficiency where frontend coding is concerned.

BP by and large – like WP – produces valid acceptable markup (we’ll overlook empty clearing divs ) however as one starts to add the vital and necessary plugins into the mix this valid code very rapidly falls apart. You can spend a lot of time if you so choose correcting these plugins, chasing down a heap of markup errors, but it will be a somewhat never ending task and not really that productive a use of someones time. Currently looking at our index page shows me 33 errors mainly produced by a video sidebar widget, most of these errors could be corrected, doing so in this instance largely a waste of time.

Interestingly /activity/ directory produces a fully compliant page, what page are you seeing your error on?