Hiding user names in members list for non-logged-in visitors
On my site, I regularly get attempts to log in with user name admin. Presumably, bots trying it on. I have no use name admin for that reason.
Recently, there are malicious attempts about every minute to log on using actual user names. They get locked out after three tries but I cannot be sure some users have guessable passwords, although I try to prevent that when a password is changed.
I guess the user names are leaking through the public version of the members’ directory. You can see that here. This public page contains links in the avatar and user handle which contain the member’s user name. I want to retain this publically-viewable directory but need to remove the links when the visitor is not logged on.
I have my own custom plugin that hooks onto ‘bp_directory_members_item’ and which displays the summary data you can see. Logged-in members see more detail than public visitors.
I am looking for a way to filter the avatar and displayed name in which I could remove the links to the member’s profile and just display the image and the display name as text, thus hiding the member’s user name.
Some users have their recent activity displayed and this has a view link to the activity. Although this link is anonymous, if it is followed, it also gives away the user name. Simplest would be to remove the View link for non-logged-in members.
Any pointers or advice will be gratefully received.
- You must be logged in to reply to this topic.