[@stripedsquirrel Participant 16 years, 4 months ago]

>(oo bad construct there – computers aren’t people. yet.)

Hmm, careful or you will hurt Lenny’s feelings. (No, Andrea was joking, Lenny, really!).

ehmm, anyway, thanks for the tip about the hosts file; it seems useful for testing. But how would the wildcards and internal references to the site url (if any?) work? Could I set up any blogs?

Cheers, Harry

[@stripedsquirrel Participant 16 years, 4 months ago]

hmmm, just tried to visit the factastic page (I had tried it over a year ago but did not like it much then), but Avast Av won’t let me, as the website serves Trojans and quite agressively at that (6 attempts from some Java trojan!). Not Good.

The other plugin mentioned (which I also had tried), is not existing anymore (site gives a 500 error).

That’s why I wa sthinking that a dedicated subblog my do the trick just as fine, just need a nice workable layout

[@stripedsquirrel Participant 16 years, 4 months ago]

Thanks for the quick reply Andy. Sorry, forgot to mention, that yes, I will be offering user blogs (the ‘network’ setting on new WP?).

What would you recommend in ths case, for a cleanest possible install with less chance of failure when upgrading to WP3.0 when released?

Thanks, Harry

[@stripedsquirrel Participant 16 years, 4 months ago]

Not sure what happened, could be a server problem as the 2 files do not show as expected, but maybe you uploaded the files to your site root (which is invisible through the browser) and not too the /public-html or /www folder (where your visible files live)?

[@stripedsquirrel Participant 16 years, 5 months ago]

Currently the BP upgrade instructions mention this as step 3:

“Upgrading with the Plugin Updater

1. BACK UP your existing install including the database.

2. It’s very important to first de-activate any plugins that require BuddyPress to run before updating BuddyPress.

3. De-activate the BuddyPress plugin.”

https://codex.buddypress.org/getting-started/upgrading-from-10x/

This might need to be changed then? I actually would not know to what as I never managed to have a straight update without white-screens and other problems as described above, but maybe that was because of following the instructions?

[@stripedsquirrel Participant 16 years, 6 months ago]

@DJ PAul & Jeff.

DJ Paul: Agree that a user should be able to choose whether he wants PM from strangers or only from friends.

Jeff, not sure if this is what you mean, but does the Privacy Component allow you to define this setting as just described? Do you have any update about whether your work might be added to core or if it is considered a plugin?

[@stripedsquirrel Participant 16 years, 6 months ago]

Hi DJ Paul.

as far as I can see, nobody is complaining that the sky is falling, that would be a quite silly thing to do. Well I guess technically it is, but at least the earth is stopping it from doing so

Just pointing out an inaccuracy in thinking, I am sure that this is allowed without immediately posting PHP to fix it?

Back on topic; the question should also be: how could this spammer get access to all the usernames automatically? Of course everybody is listed, but somehow the were harvested and added to the pm list.

– Anyway, I think a very good start is that you can only message your friends. Thought that this would be already ths case, that is why I wondered how we could get spammed?

– Additionally: a maximum of PM’s per user per x amount of time (seems that 1/minute should be enough, + 50 per day. of course this should be optional and configurable with error notification (site options or plugin?)

– Maybe a maximum mailbox size, which included sent messages. So that at least spammers have to clean out their sent box before being able to send new messages.

– Also a maximum of adressees per PM, else the other 2 are useless

– maybe a minimum age of user (meaning time since registration), before he can send out PM at all?

Of course, any of these can be worked around, but at least it might slow spam down, at least from strangers..

Cheers, Harry

[@stripedsquirrel Participant 16 years, 6 months ago]

Hi Andy, I think you are incorrect there. Spammers like to send spam. I am sure you get some in your email?

What is easier to get into a nice big community (without having to create a blog) and easily (?) send spam PM to all members of the community? You don’t even have to infect computers, as you can use the internal messaging system and you know most users will get the message as an email as well.

Hey, it saves them from email harvesting or buying ‘5 billion email addreses’ dbases as the community has already done this.

So, no, apparently (and this example that started this topic has proven this), it is possible on BuddyPress and it serves the spammers purpose, so disabling blog registration will not stop this. You can disable blog and user registration, but it might be hard to start a community that way..

Cheers, Harry

[@stripedsquirrel Participant 16 years, 6 months ago]

I don’t think it’s spam as she clearly picked only the handsome guys.

Still waiting for her picture though…

[@stripedsquirrel Participant 16 years, 6 months ago]

Thanks Andrea. Sorry I have ‘inspired’ you do make a blogpost, but yes, it has become inevitable now

I agree with the notice, better to let people know. I thought about the index.html as well, but that would still make people loose their posts they are editing when upgrade is taken place (or is failing), wouldn’t it? have you ever tried the automated upgrade?

>Some of us with large sites do not deactivate all plugins and then reactivate later. With hundreds or thousands of blogs, it’d be a nightmare.

So you also do not (even) deactivate the BP-plugins?

>The moving of the theme only occurred during BP 1.1. Shouldn’t have to do it next time.

It is still in the upgrade instructions though and I assume that if there are theme changes this might make sense or not? I do hope somebody cleverer than me could make this process automated as well.

By the way, myself and some others had a white screen of death last upgrade. Not just just main blog, but all blogs, the moment I clicked the de-activate BuddyPress button. Apparently this could have been prevented by switching theme first. At that time I was not using a cloned child theme (now I am), so maybe that caused it.

Just shooting some ideas for your upcoming post

Cheers, Harry

[@stripedsquirrel Participant 16 years, 6 months ago]

@mark, thanks for the reply.

How do you use Maintenance mode: activate sitewide, or only on main blog? I tried a similar plugin (wartungsmodus), but that (a) did only seem to work on main blog and (b) would give users access to the plugin (and set the site on maintenance?)?

[@stripedsquirrel Participant 16 years, 6 months ago]

So far no luck with all of the above.

Just noticed that when changing register slug as mentioned that the link on the login page (for example after logging out: http://biketravellers.com/wp-login.php?loggedout=true) does not change, it links to http://biketravellers.com/wp-login.php?action=register which gives a 404.

(as it links to /register)

Any idea why the new slug does not work (it works on the homepage, and I also added a function to the functions page).

How to change that link on wp-login.php without hardcoding and losing it after every upgrade?

Cheers, Harry

[@stripedsquirrel Participant 16 years, 6 months ago]

I just tried that as I am out of alternatives…

Just noticed when testing the new signup slug that the user gets an email with the following text:

“You can log in to the administrator account with the following information:

Username: test

Password: bd36dc14

Login Here: http://test.biketravellers.com/wp-login.php”

? : Why does the user get a random password sent as he alreaady chose a non-random one? This random one does not work by the way.

Is this a result of the spam procedures or a regular bug?

Cheers, Bike

[@stripedsquirrel Participant 16 years, 6 months ago]

Hi Jeff,

thanks for getting back on that part of the question. I actually do not know where I got if from, I guess from the WPMU forums, but Google does not seem to know it anymore.

I have never had any premium subscription, so unless they offered it for free temporarily, it must have een from the public part of the wpmudev.org.

This is the info from the plugin file, which does not give much info:

/*

Plugin Name: Signup Question

Plugin URI:

Description:

Author: Andrew Billits / James Farmer

Version: 1.0.1

Author URI:

*/

Basically it let you define a basic question in the backend (I think the standard question was ‘is fire hot or cold’), which would be easier to solve than most captcha’s and was needed to sign up.

Edit: I found it: http://wpmudev.org/project/Signup-Security-Question

Though not a premium plugin, it is not GPL either… /Edit

I am not sure if this part made any difference in stopping splogs though: seeing the thousands of hits on my -renamed therefore non-existent- wp-signup.php it seems that renaming the sign-up file would make more difference.

That is also why I doubt if renaming teh slug will help as the underlying fle can still be reached?

Welcome your input on both aspects, thanks!

[@stripedsquirrel Participant 16 years, 7 months ago]

Thanks arezki, but my last 15 splogs all had different IP’s and email domains, so I am not sure if this will help anything/

I also have nothing of the original message in the footer, but they keep on coming.

I notice that (with the welcome pack installed/enabled), that I receive friendship requests from, well, myslef whenever a splog signs up. I am not sure if this means that the email to the sploguser has bounced or so?

Seems that the banned email domains list in WPMU Admin options is not being used/checked as well, I just had a sign up from @live.cn, while I have *.cn on my blocklist…

I sent a message to Andy yesterday, as this problem is too big to ignore, see testbp.org.

[@stripedsquirrel Participant 16 years, 7 months ago]

They keep on coming. Thsi should really get some attention from Andy & JJJ. Just check out the http://testbp.org website. The entire homepage is 9and has been for at least several days) filled with spam (from sidewide activity), so they apparently cannot stop it either.

It is not a good sign to have the public testsite full of splogs and spams methinks, but at least it is truthful as it shows what it is like: BP & MU attract spammers who cannot be stopped easily…

[@stripedsquirrel Participant 16 years, 7 months ago]

Thanks r-a-y. Not sure how the splogginmg works, but would changing th sslug really make a difference if the underlying register page is still the same?

I mean under MU renaming wp-login.php (and the internal references) worked, but at least that was the active .php file itself. Not sure if the slug can be bypassed my calling the (register.php?) page directly?

Cheers, Harry

[@stripedsquirrel Participant 16 years, 7 months ago]

Make that 6.. oh, and they are all from different IP’s as well, so wp-ban also does not much good.

[@stripedsquirrel Participant 16 years, 7 months ago]

Yep, I had 5 like these today and several before past weeks:

firstnamelastname19xx as usernames, all from different email domains.

They did not post, but also did not have much time to do so.

I mark them as spam immediately, but am tired of doing so, so hope a splog solution is nearing…

[@stripedsquirrel Participant 16 years, 7 months ago]

I have never received any answer on teh original questions and I am getting really tired of deleting the splogs that happened only after installing Buddypress.

Just the last few hours 5 splogs registered, all with name-surname19xx as username, all from different email domains.

I know it is not too much to check every blog, check every user, mark him as a spammer and add the email domain to the sh*tlist under options.

But the point is that before BP I had to do this less than once per month. So I repeat, hopefully somebody wil;l at least answer the2nd question (hopefully the first as well, but I fear a standard ‘ask the plugin-author’ reply):

“So my questions to determine the best action to make sign ups easy but splogs difficult:

– why won’t the WPMU sign-up question plugin work on the BP register page? Is there a way to fix that?

– More importantly: Can the register page be renamed? If so, which file(s) and what other (internal) links?”

Many thanks,

Cheers, Harry

[@stripedsquirrel Participant 16 years, 7 months ago]

oh yes, there is an entire industry in especially central Asian countries (Bangladesh is huge) where halls of people solve captcha’s for $1 per 1000-5000 captchas.

See http://ha.ckers.org/blog/20080311/human-captcha-breaking/

Don’t forget to read the last 5 comments or so

Though I am in favour of having spammers employ and pay poor people in Asia, I hate spam even more and have abolished all captchas from my site as still too many people cannot read them, so it is chasing people away. And, as the link above proves, they do not help anyway.

[@stripedsquirrel Participant 16 years, 7 months ago]

thanks DJPaul.

FYI: After reading http://www.studiograsshopper.ch/web-development/multilingual-wordpress-setting-up-wordpress/ I realized that the basic setting in wp-config could be changed (from define (‘WPLANG’, ”); to define (‘WPLANG’, ‘es_ES’); which -I think- adds Spanish (and not replaces the main language?) support.

Not sure if this setting does anything as the admin of the main blog could already choose es_ES in his blog settings (so ALL users see the blog in Spanish instead of all in English) before I ‘added’ Spanish in wp-config. (As long as the language file was uploaded to /languages of course).

Anyway, it does not change anything

– The home/community page/main blog and the buddy bar are still in the language the admin has chosen for it, not the language of the logged-in user (or a logged-out/new user for that matter).

[@stripedsquirrel Participant 16 years, 7 months ago]

@Bpisimone. Thank, maybe I do not get what this plugin is meant to do. I though it would allow to import/export friends, messages/status etc.

For this, you should be

– Logged into both. if you are only logged in in BP you do not know if you are logged in into FB, only when you log out of BP you can check it with the button?

– you need to have some kind of trigger to crosspost etc as mentioned i.e. a button?

My site is live and I get the same error.

I also noticed that the Fxmlb.js script that is included adds 240kb to my homepage, which is loading before the main content, slowing the site down, so unless that changes (FB connect on member pages/profiles with clear info/instructions?) I am removing it.

Cheers, Harry

[@stripedsquirrel Participant 16 years, 8 months ago]

Not sure if this needs a separate thread, but as it is connected to the original post:

I have spanish speaking users and have uploaded the spanish Buddypress translations.

However:

– The buddybar follows the language settings of the blog it is on, not of the user that is logged in. Meaning that a Spanish speaker (with language settings -> Spanish on their settings) will see a nice Spanish buddybar when on their own blog, but when they go to an English blog (the main blog for example) then the buddybar turns to English, even though it is ‘their’ buddybar, with their blogs and links to their profile etc. Is this by design or a bug?

As the community homepage is almost separate from the main blog, it should follow the user-set language as well when loaded.

– As the translation is available, I think the language of the main blog/home theme should change according to the (logged in) user visiting it, else they are lost on the community homepage. However, currently it sticks strictly to the language settings of the main blog.

update: just created ticket: https://trac.buddypress.org/ticket/1245 but would like to hear your thoughts on this as well.

Cheers, Harry

[@stripedsquirrel Participant 16 years, 8 months ago]

Some more (debug?) info:

I noticed that on the BP Demo site the Connect button also disappears when you are logged in, which does not make much sense?

Also the popup window on testbp.org has a URl starting with fb.com/tos.php, while the link of my button starts with fb/com/login.php

I am logged in on FB and used both my site, FB as well as testbp from the same browser (FF).

Cheers, Harry

—-

added: I noticed when using the FB connect on testbp.org, I am logged in as my Fb name and a new account is created on Testbp.org. So now I have two accounts there, as I had to log out of my existing account in order to see the connect button?

Andy, as you are the author and there is little documentation of the plugin, maybe you can clarify what parts of the above are intended functionality and what not, so we know what to test for and (not) report? Thanks!