BuddyPress.org

Okay, seems like I really have to learn more about PHP. Via google I found https://wordpress.stackexchange.com/questions/60272/find-out-if-logged-in-user-is-not-subscriber. That gave me a rough idea, but I did not manage to change the code for a redirect.

However, I found a workaround. I placed the following code…

<?php if ( current_user_can('member') ) : ?>

and

<?php endif; ?>

in these files:

/wp-content/plugins/buddypress/bp-templates/bp-legacy/buddypress/members/index.php (lines 27 and 144)
/wp-content/plugins/buddypress/bp-templates/bp-legacy/buddypress/members/single/home.php (13 and 122)

There´s no redirection now, but the content is not visible anymore for the role “subscriber”, but visible for “member”.

BTW, that was tested in WordPress 4.4.2 and BuddPress 2.5.2 on local XAMPP running Apache/2.4.17, PHP/5.6.15, custom theme, 25 plugins.

1. Which version of WordPress are you running? The latest

2. Did you install WordPress as a directory or subdomain install? Normal install in root

3. If a directory install, is it in root or in a subdirectory? Root

4. Did you upgrade from a previous version of WordPress? If so, from which version? No

5. Was WordPress functioning properly before installing/upgrading BuddyPress (BP)? e.g. permalinks, creating a new post, commenting. Yes

6. Which version of BP are you running? The latest

7. Did you upgraded from a previous version of BP? If so, from which version? If there was another version around 2 months ago, yes. Issue persists through both updates.

8. Do you have any plugins other than BuddyPress installed and activated? If so, which ones?
404 to 301
All in one Favicon
bbPress
BP Profile Search
BuddyPress
BuddyPress Cover Photo
Custom Facebook Feed
Divi Builder
Elegant Themes Updater
Events Manager
Go – Responsive Pricing & Compare Tables
K Elements
List category posts
Page Links To
rtMedia for WordPress, BuddyPress and bbPress
s2Member Framework
Slider Revolution
Taxonomy Metadata
WP FullCalendar
WPBakery Visual Composer

9. Are you using the standard WordPress theme or customized theme? KLEO

10. Have you modified the core files in any way? No

11. Do you have any custom functions in bp-custom.php? No

12. If running bbPress, which version? Or did your BuddyPress install come with a copy of bbPress built-in? Latest

13. Please provide a list of any errors in your server’s log files.

14. Which company provides your hosting? Siteground

15. Is your server running Windows, or if Linux; Apache, nginx or something else? Apache I think.

Well, I’m no securities expert by any means, but I need this site to be as hard as possible. I’m just trying to take every precaution. From what I’ve read it’s a fairly common practice: http://www.firedaemon.com/blog/wordpress-hardening-guide

Also, you can block access to wp-config.php with the following in .htaccess, although I’m not sure how someone would be able to view the php anyways.

#block wp-config.php
<files wp-config.php>
order allow,deny
deny from all
</files>

Yes, it’s not a catch all. If some one is determined I’m sure there are ways to find your unique prefix. However, I think it would still stop a lot of script kiddies. If someone can inject sql I’d imagine your still in trouble. I would still like to know how to do it though.

Can some one please help me out. The site supports a good cause and they are nice clients. I really don’t want them getting sued if some ones info gets leaked.

Would disabling the BuddyPress registration process and falling back on WordPress one’s by creating a custom registration form help avoid the need to sync BuddyPress to WordPress profile? – as I interpreted from here – http://stackoverflow.com/questions/15379839/registration-form-in-buddypress. Thanks.

I figured out the solution. I had to call

add_filter( ‘wp_mail_content_type’, ‘notification_content_type’ );

in each individual email function:

add_filter( 'wp_mail', 'dirty_wp_mail_filter' );
function dirty_wp_mail_filter( $args ) {

	// you can include your custom html mail template here
	// just use file_get_contents() functions to get template file and any php replace function like
	// str_ireplace or preg_replace to replace your given placeholder in template by the content which is sent by wp

	$stripped_mail_content = preg_replace("/<http(.*)>/m", "http$1", $args['message']);
	add_filter( 'wp_mail_content_type', 'dirty_notification_content_type' );
	$dirty_wp_mail = array(
		'to'          => $args['to'],
		'subject'     => $args['subject'],
		'message'     => $stripped_mail_content,
		'headers'     => $args['headers'],
		'attachments' => $args['attachments']
	);
	return $dirty_wp_mail;
}

function dirty_notification_content_type() {
	return 'text/html';
}

found here:
core.trac.wordpress.org/ticket/21095