BuddyPress.org

With standard buddypress (no modifications) you can freely view anyone’s messages without even logging in. Personally I think that is not very good security/privacy, whatever you want to call it.

I made a ticket as I don’t think that “private messages” should be publicly viewable
(https://buddypress.trac.wordpress.org/ticket/6504#ticket)

What privacy/security checks would you recommend for people who don’t want users private data publicly viewable?

Also, to answer your question:

How would you do the security check?

These must be done server side. You’re right to think that anything done via the client can be tainted (manipulated by an end user).

The general process is:

• Make an AJAX call passing any client-side data to the server
• Process the data (secure it and perform necessary privacy checks) and then send a response
• Do something client-side with that response

For more info on AJAX and WordPress, check out the AJAX in Plugins article.

The following active BuddyPress Components do not have associated WordPress Pages: Activate, Register. Repair

Those pages are not created automatically. When you get this error message, you have to create the pages manually first.

Go back to bp settings > pages tab and allocate the new pages to the respective component. Save.

You have also to set pretty permalinks to something other thant “by default”. Save.

Now BP has his page assigned and should work.

About the missing button.
Clear your browser cache.
If you use a cache plugin, clear it.
Go to wp-config.php and activate debug mode at the end of the file.

Deactivate all plugins except BP and activate one of WP’s theme (2015, 2014 or 2013…)

See if you get some error message and correct the errors (if exist).

If after tracking/repairing errors, the button is still not showing, deactivate buddypress, delete it and upload a fresh copy of BuddyPress to your site. Sometimes files can be corrupted and need to be replaced. No worry, this will not affect any data in your DB.

If still nothing, check that your host plan has the required php version to be used with WP and BP: at least 5.2.4

hi @wpthemes,

thank you for sharing, even if bp-default theme is no more maintained. This old theme is only in for backward compatibility with older install.
More here:
The future of the bp-default theme

@shaquana_folks,

do you plan to ask the same question each day ? It’s the fourth time now, and you received many answers in the past 3 days. Or you received erroneous answers or you didn’t understand them or couldn’t find a solution by yourself. That’s life and i’m sorry for you but it’s just a forum here, not a miracle shop.

You say My hosting plan server is iPage (which uses NGINX), running a 5.0 PHP version.

If 5.0 is really the php version, you can’t use WP or BP with this old version as both require at least 5.2 version.

For Nginx server, have you read WP’s codex ?
https://codex.wordpress.org/Nginx
Search for nginx install on wordpress.org brings also several answers…

For paid consultants, post the job to http://jobs.wordpress.net/ or BP Jobs Board.

Hi,
searching for a while now for a plug-in that watermarks the image that a user uploads.

Depends which image you’re speaking about. On a WP install, most images are loaded to Media Library. And for this you have at least a dozen of plugins to watermark pictures.

If you’re using a plugin with his own upload directory, you could try this plugin which let you select a specific folder.

By default, BP only handles with profile pictures, stored in /uploads/avatars/

Rendez Vous is the closest thing I know of. Feel free to search the Plugin Directory to see if anything else is available.

Have you tried Rendez Vous?

Have you tried WordPress SEO by Yoast?

Try Limit Groups Per User

This sounds like a job for WordPress Cron. Note that WordPress Cron works slightly different to the UNIX version in that it runs only if there is a site visit. So if your website has low traffic then use a service such as Pingdom to ensure your site is hit regularly.

@sebastianpierre BuddyPress is compatible with nearly all WordPress themes out of the box. I am assuming that you’re on the latest WordPress and BuddyPress verions. Change theme to either Twenty Fifteen or Twenty Fourteen, check if all the BP pages are showing up as expected. If it is, then double-check that you have the_title and the_content template tags in your custom theme’s page.php file.

bp-template-pack files in my root folder

Just to be clear, if you’re referring to this plugin https://github.com/boonebgorges/bp-template-pack then I suggest that you deactivate it and remove the folder/files you moved to your theme folder. If you’re referring to the bp-legacy files then I suggest that you resolve the issue of BP pages showing up in your theme first before doing any kind of customization.

Which theme do you use ?
Can you test youre install with Twenty Fifteen theme and see if anything is translated ?
Are the terms not translated on front-end, or also in back-end ?

FYI, the spanish translation for BP is only completed to 96%, but activity is translated. To ensure you have the most recent copy, download the spanish .mo file from here and install it in wp-content/languages/plugins/buddypress-es_ES.mo

Something may be getting lost in translation, but if you mean you want the user who has just logged in to be redirected to his/her profile, then check out https://wordpress.org/plugins/bp-redirect-to-profile/

You could use current_user_can() to check the member’s capabilities. For example:

if ( current_user_can( 'edit_pages' ) ) {
    // Output button
}

Ref: https://codex.wordpress.org/Roles_and_Capabilities

I made some “progress”

I found this and I can agree that it is still true.
https://buddypress.trac.wordpress.org/ticket/5971
Filtering is inconsistent and sometime happens twice.

I think this should be something to look into somewhat soon.

Anyway here is the minimum you have to do to turn off html filtering.

BUT it makes you website a lot more vulnerable to attacks and errors so use it at your own risk.

Add this code to your child theme function.php

//Unfilter xprofile *risky*

remove_filter( 'bp_get_the_profile_field_value',           'xprofile_filter_kses', 1 );
remove_filter( 'bp_get_the_profile_field_edit_value',      'wp_filter_kses',       1 );
remove_filter( 'xprofile_get_field_data',                  'wp_filter_kses', 1 );
remove_filter( 'bp_xprofile_set_field_data_pre_validate',  'xprofile_filter_pre_validate_value_by_field_type', 10, 3 );
remove_filter( 'xprofile_data_value_before_save',          'xprofile_sanitize_data_value_before_save', 1, 4 );

There’s a ticket about this here:
https://buddypress.trac.wordpress.org/ticket/3789

View the comments in that ticket for some approaches that you can take. If you need some hooks in BuddyPress to make this happen, let us know by replying to that ticket. Login using the same credentials as you use here on buddypress.org.

You could also think about using Gravatar and disabling avatar uploads as well. It’s probably not a valid option for your site, but just making sure you know! 🙂

Not that I know of. Have a read of How to Take Control of The WordPress Heartbeat API for an overview of the performance issues associated with it.

It seems this is in-progress. See 6057 for updates.