BuddyPress.org

From doing some testing I have discovered the BuddyPress private message system appears to accept only the “user_nicename” value in the “Send To” field of message compose page. When I attempt to use the “user_login” value and send a test message it fails with the below.

Message could not be sent because you have entered an invalid username. Please try again.

Is there any way to get Buddypress to accept the “user_login” value when doing a message compose? I have a modification that pre-populates this field with the “user_logon” value and that seems the only way to get this to work. Appreciate any feedback/support. Thank you.

i’m new to buddypress. i want to create a private one where only members can view and add info. this is for a closed group that only has about 30 members.

i had been using simple membership to control what pages were viewable. do i need this still? or is nothing viewable in buddy press until they login?

does the buddy press member accounts use the info from the wp user accounts? or do i have to go in and add all the wp users and set them up as buddy press members?

There is a feature in WordPress that’s very useful for a blog owner who administers his/her own blog, but that same feature presented to the user who is NOT a site admin is downright malicious and exposes the site owner to a serious security risk or at least a serious and even more costly privacy risk.
BuddyPress and bbPress are both guilty of doing just that.

But the interesting thing is:
The administrators of BuddyPress.org apparently do have a brain because they’ve made sure that this giant security/privacy hole is closed on this bbPress forum here.

So, WHY THEN ARE THEY EXPOSING every other normal BuddyPress and bbPress user to that malicious behavior of BuddyPress and bbPress???
WHY???

That’s what I wanna know.

Oh, you wanna know what’s that malicious behavior/security risk that BuddyPress and bbPress is exposing you to?
Easy!
Go to your own installation of bbPress, create a new topic/post and while creating it highlight a word and click that “insert link” button you see in the top row!
Does it ring a bell?

In case you are very slow, lemme ring the bell for you here:

First, you need to open your eyes. That’s quite important.
Listening to the bell alone isn’t gonna help you.

Secondly, take a look at that “Or link to existing content” thingy and explore the list that appears below!
See how it lists ALL OF YOUR PAGES including the secret thank-you pages with content that is supposed to be visible ONLY TO PEOPLE WHO HAVE PAID FOR THE PRODUCT!
As well as all of your test pages and other secret/private pages that you don’t want anyone to have access to.

And in case you don’t think that’s a good idea, you are not alone.
The admins of BuddyPress.org don’t think that’s a good idea either.
That’s why on this website, on this bbPress forum here they have removed that security/privacy threat!

That’s right! If you try the “insert link” feature in this forum here, you’ll immediately notice that this malicious “Or link to existing content” feature has been disabled.
It’s not suggesting any of the internal pages on BuddyPress.org here.

GOOD THINKING!
And it’s good to know that at least the admins of BuddyPress.org do have a brain.

Now, in a bbPress forum you could sort of “fix” this issue by making your forum extremely inconvenient for your users.
Just go to your forum settings and uncheck “Add toolbar & buttons to textareas to help with HTML formatting”.

But is that something you really want to do???

Do you really want your forum appear as if was coded in 1997?
Do you really want to deprive all normal forum users of being able to format their posts?
And even users who know HTML, would they want to type HTML markup when posting in a forum?

But hey, while bbPress offers at least a 1997-style kill switch to switch off that malicious behavior of bbPress, BuddyPress does NOT offer such switch at all.

So, if, for example, you have something like BuddyPress Docs installed (a very helpful plugin by the way), then you’ll find yourself facing the same damn problem!

Now for my final question to the admins of BuddyPress.org:
Do you know what negligence is?

You are guilty of negligence because while having protected your own site with some custom coding, you are exposing all other people using your software to a serious security/privacy risk!

FIX IT!
I want people to be able to easily format my forum posts and BuddyPress posts (using TinyMCE) WITHOUT exposing my private pages!
Otherwise I might just as well publish my admin password on my home page.

WHY THE HELL is the custom code that you have implemented on this site here (and on WordPress.org to protect your sites from malicious attacks) is not part of the core BuddyPress code???????

P.S.
I couldn’t keep this post any shorter because when I see such a tremendous amount of stupidity (or negligence in this case) it just drives me mad.

Hello,

I have Buddypress installed for the WPLMS theme (WordPress learning management system)

Right now, when I send a message or notification to multiple recipients, when someone replies, it is sent to the entire group.

Is it possible to make the reply private between the Admin (me) and the replying user?

Why would I want to do this?

Let’s say I want to send the same message to every student taking a course on my site asking them for their feedback, then when someone replies to that message, everyone will see that reply. I don’t want that. It’s spammy and will annoy people.

The alternative is to hand deliver each message to each user, but at times I want to compose the same message to everyone, and composing the same message a hundred times isn’t practical.

Is there a workaround for this?

Thanks.