BuddyPress.org

There is a feature in WordPress that’s very useful for a blog owner who administers his/her own blog, but that same feature presented to the user who is NOT a site admin is downright malicious and exposes the site owner to a serious security risk or at least a serious and even more costly privacy risk.
BuddyPress and bbPress are both guilty of doing just that.

But the interesting thing is:
The administrators of BuddyPress.org apparently do have a brain because they’ve made sure that this giant security/privacy hole is closed on this bbPress forum here.

So, WHY THEN ARE THEY EXPOSING every other normal BuddyPress and bbPress user to that malicious behavior of BuddyPress and bbPress???
WHY???

That’s what I wanna know.

Oh, you wanna know what’s that malicious behavior/security risk that BuddyPress and bbPress is exposing you to?
Easy!
Go to your own installation of bbPress, create a new topic/post and while creating it highlight a word and click that “insert link” button you see in the top row!
Does it ring a bell?

In case you are very slow, lemme ring the bell for you here:

First, you need to open your eyes. That’s quite important.
Listening to the bell alone isn’t gonna help you.

Secondly, take a look at that “Or link to existing content” thingy and explore the list that appears below!
See how it lists ALL OF YOUR PAGES including the secret thank-you pages with content that is supposed to be visible ONLY TO PEOPLE WHO HAVE PAID FOR THE PRODUCT!
As well as all of your test pages and other secret/private pages that you don’t want anyone to have access to.

And in case you don’t think that’s a good idea, you are not alone.
The admins of BuddyPress.org don’t think that’s a good idea either.
That’s why on this website, on this bbPress forum here they have removed that security/privacy threat!

That’s right! If you try the “insert link” feature in this forum here, you’ll immediately notice that this malicious “Or link to existing content” feature has been disabled.
It’s not suggesting any of the internal pages on BuddyPress.org here.

GOOD THINKING!
And it’s good to know that at least the admins of BuddyPress.org do have a brain.

Now, in a bbPress forum you could sort of “fix” this issue by making your forum extremely inconvenient for your users.
Just go to your forum settings and uncheck “Add toolbar & buttons to textareas to help with HTML formatting”.

But is that something you really want to do???

Do you really want your forum appear as if was coded in 1997?
Do you really want to deprive all normal forum users of being able to format their posts?
And even users who know HTML, would they want to type HTML markup when posting in a forum?

But hey, while bbPress offers at least a 1997-style kill switch to switch off that malicious behavior of bbPress, BuddyPress does NOT offer such switch at all.

So, if, for example, you have something like BuddyPress Docs installed (a very helpful plugin by the way), then you’ll find yourself facing the same damn problem!

Now for my final question to the admins of BuddyPress.org:
Do you know what negligence is?

You are guilty of negligence because while having protected your own site with some custom coding, you are exposing all other people using your software to a serious security/privacy risk!

FIX IT!
I want people to be able to easily format my forum posts and BuddyPress posts (using TinyMCE) WITHOUT exposing my private pages!
Otherwise I might just as well publish my admin password on my home page.

WHY THE HELL is the custom code that you have implemented on this site here (and on WordPress.org to protect your sites from malicious attacks) is not part of the core BuddyPress code???????

P.S.
I couldn’t keep this post any shorter because when I see such a tremendous amount of stupidity (or negligence in this case) it just drives me mad.

I’ll do my best to answer these before asking my question, per moderator request.
1. Which version of WordPress are you running? 4.5.2

2. Did you install WordPress as a directory or subdomain install? unsure. Installed as program at my host. domain is bennypointer.com

3. If a directory install, is it in root or in a subdirectory?

4. Did you upgrade from a previous version of WordPress? If so, from which version? Not today.

5. Was WordPress functioning properly before installing/upgrading BuddyPress (BP)? e.g. permalinks, creating a new post, commenting. Still working basically

6. Which version of BP are you running? 2.5.9

7. Did you upgraded from a previous version of BP? If so, from which version?

8. Do you have any plugins other than BuddyPress installed and activated? If so, which ones? Buddypress not activated now (BBpress is). Also running Beaver Builder Lite, Page Builder by Site Origin, Site Origins Widgets Bundle, Title Remover, and UPdrafts plus backup. Not my idea to use most of these. . . trying to help a friend out.

9. Are you using the standard WordPress theme or customized theme? Using Off the Shelf theme

10. Have you modified the core files in any way? No

11. Do you have any custom functions in bp-custom.php? Not that I’m aware of unless a plugin altered them

12. If running bbPress, which version? Or did your BuddyPress install come with a copy of bbPress built-in? bbpress 2.5.9

13. Please provide a list of any errors in your server’s log files. n/a

14. Which company provides your hosting? will have to check

15. Is your server running Windows, or if Linux; Apache, nginx or something else? unsure, but Apache, I think.
____________________________
Bennypointer.com is to have a forum (/forums). I have it built, have registration/login/lost-password pages that seem to work, except upon registration, no email gets sent (doing automatic registration for the moment). I’ve scoured everything I can find, and cannot seem to fix this. Ideas?

Also, I am trying to get a right sidebar on the forum page with registration, etc. but cannot get it up. On Benny’s Forum page (/forums), I have ‘right sidebar’ as page type. I with widgets setup with login URI and lost password URI fields accurate, and did the same at appearance>widgets where there is only Blog Sidebar and Footer listed on the right (where I drag the widgets to). I cannot find a place to “create new sidebar” that I have in my Karma wordpress theme. I have tried having the widgets in both the Appearance>customization area, and on the appearance>widegets page).

Help? I’ve got about 12 BBpress and codex pages open on topics ranging from learning child-themes, to BB press, etc.

Thanks y’all
Jon

Customizing Labels, Messages, and URLs

Not sure if this is the only one, but any image you are hosting from skitch stopped working 6 months ago.

Hello!

Since the newest buddypress version my profile settings page will not load. Just sits on a blank screen. I tried turning off recently installed plugins and switching to the Twenty Thirteen theme, still no luck. WP version 4.5.2. Any help would be appreciated!

http://happyhourgamers.com/

Thanks,

Tyler

How to add a dropdown menu in topbar (a menu above the primary menu)? My site is under construction.

Hello,

I have Buddypress installed for the WPLMS theme (WordPress learning management system)

Right now, when I send a message or notification to multiple recipients, when someone replies, it is sent to the entire group.

Is it possible to make the reply private between the Admin (me) and the replying user?

Why would I want to do this?

Let’s say I want to send the same message to every student taking a course on my site asking them for their feedback, then when someone replies to that message, everyone will see that reply. I don’t want that. It’s spammy and will annoy people.

The alternative is to hand deliver each message to each user, but at times I want to compose the same message to everyone, and composing the same message a hundred times isn’t practical.

Is there a workaround for this?

Thanks.