1.5.1: Activity stream for private groups displayed to everyone!

[johjoergensen]

I just realized that when logged out, the activity stream for private groups is displayed!
This is a serious security concern!

I run WP 3.2.1 + BP 1.5.1

[boonebgorges]

I can't reproduce this.

I'm guessing that you created activity in a public group, and then changed the group to private. When changing the privacy settings on a group, previously created group activity content does not have its visibility changed.

If I'm mistaken about this, and you can provide detailed steps to reproduce the issue, please reopen the ticket and provide those instructions.

[peeld]

Is there a way to go back and change this? This MAY be my problem as well...

[boonebgorges]

Well, you can run a sql query. It will look something like this. (Assuming here that your group id is 67, and that the prefix on your db tables is wp_.)

UPDATE wp_bp_activity SET hide_sitewide = 1 WHERE component = 'groups' AND item_id = 67;

WARNING! If you are going to run direct queries, do a backup first! Do not simply cut and paste what I've written here, as there is no UNDO - show it first to a friend who understands MySQL!!!

[peeld]

Already figured it out, did it, SWEET, fixed!!! Phew :) Now to remember the fix for NEXT time; I start each class session out with groups public so others can see the activity and get interested in joining but I want to clamp it down after a week or so.

Daisy

[r-a-y]

In 9301:

Messages: Refactor bp_has_message_threads() stack to use array-style parameters.

Props Mamaduka.

See #3767.