BuddyPress.org

I can view anyones messages when logged out.

And you’re definitely talking about what BuddyPress refers to as private messages?

Can you try again after disabling all plugins, reverting to TwentyFifteen and removing all custom code? If you still get to see private messages when logged out then that shouldn’t be happening.

I can view anyones messages when logged out.

And you’re definitely talking about what BuddyPress refers to as private messages?

Can you try again after disabling all plugins, reverting to TwentyFifteen and removing all custom code? If you still get to see private messages when logged out then feel free to open a bug ticket on Trac. That…[Read more]

I can view anyones messages when logged out.

And you’re definitely talking about what BuddyPress refers to as private messages? That is definitely not right.

Can you try again after disabling all plugins, reverting to TwentyFifteen and removing all custom code? If you still get to see private messages when logged out then feel free to open a…[Read more]

With standard buddypress (no modifications) you can freely view anyone’s messages without even logging in

That shouldn’t be the case for all users. Only users with admin capabilities should be able to do that. Are you able to see people’s private messages when logged in as a subscriber? If so, that’s a bug

Also, to answer your question:

How would you do the security check?

These must be done server side. You’re right to think that anything done via the client can be tainted (manipulated by an end user).

The general process is:

Make an AJAX call passing any client-side data to the server
Process the data (secure it and perform necessary privacy…[Read more]

Also, to answer your question:

How would you do the security check?

These must be done server side. You’re right to think that anything done via the client can be tainted (manipulated by an end user). The general process is:

Make an AJAX call passing any client-side data to the server
Process the data (secure it and perform necessary privacy…[Read more]

You could see hidden data that user did not want displayed.

That’s why I said privacy checks should be carried out separately.

As an aside, security and privacy are both very different things. Securing data means making sure it is safe where as privacy refers to the visibility of the data. Both these things should be addressed in your…[Read more]

You could see hidden data that user did not want displayed.

That’s why I said privacy checks should be carried out separately.

As an aside, security and privacy are both very different things. Securing data means making sure it is safe where as privacy refers to the visibility of the data. Both these things should be addressed in your…[Read more]

what harm could come from a visit to a simple profile tab?

You could see hidden data that user did not want displayed.

That’s why I said privacy checks should be carried out separately.

As an aside, security and privacy are both very different things. Securing data means making sure it is safe where as privacy refers to the visibility of the…[Read more]

Just to be clear, security and privacy checks should be carried out separately to WP nonce implementation

@codemonkeybanana this is just my own personal opinion but implementing WP nonces when loading tabs isn’t hugely necessary. WP nonces verify user intent, and even if intent cannot be verified, what harm could come from a visit to a simple profile tab?

Would that register as a tag though?

Updated :
add_action('wp_ajax_messages_star','bp_course_messages_star');
function bp_course_messages_star(){
if(function_exists('bp_messages_star_set_action') && is_numeric($_POST['message_id']) && in_array($_POST['star_status'],array('star','unstar'))){
echo bp_messages_star_set_action(array(
'action' => $_POST['star_status'],…[Read more]

What are you using for your default landing tab?

As an example, let’s say you’re using activity (which is the default tab anyway) so no need to do the following:

define( 'BP_DEFAULT_COMPONENT', 'activity' );

Now, your example.com/members/username screen can be targeted like this:

if ( bp_is_user_activity() ) {
// Do something.
}

Note: bp_…[Read more]

Instead of groups_accept_invite(), try using groups_join_group().

So in your code above, you’d use: groups_join_group( $group_id, $bp_user_id )