Skip to:
Content

BuddyPress.org

Opened 12 years ago

Closed 12 years ago

Last modified 9 years ago

#3767 closed defect (bug) (worksforme)

1.5.1: Activity stream for private groups displayed to everyone!

Reported by: johjoergensen's profile johjoergensen Owned by:
Milestone: Priority: normal
Severity: critical Version: 1.5.1
Component: Groups Keywords:
Cc:

Description

I just realized that when logged out, the activity stream for private groups is displayed!
This is a serious security concern!

I run WP 3.2.1 + BP 1.5.1

Change History (6)

#1 @boonebgorges
12 years ago

  • Keywords needs-patch removed
  • Resolution set to worksforme
  • Status changed from new to closed

I can't reproduce this.

I'm guessing that you created activity in a public group, and then changed the group to private. When changing the privacy settings on a group, previously created group activity content does not have its visibility changed.

If I'm mistaken about this, and you can provide detailed steps to reproduce the issue, please reopen the ticket and provide those instructions.

#2 @peeld
12 years ago

Is there a way to go back and change this? This MAY be my problem as well...

#3 @boonebgorges
12 years ago

Well, you can run a sql query. It will look something like this. (Assuming here that your group id is 67, and that the prefix on your db tables is wp_.)

UPDATE wp_bp_activity SET hide_sitewide = 1 WHERE component = 'groups' AND item_id = 67;

WARNING! If you are going to run direct queries, do a backup first! Do not simply cut and paste what I've written here, as there is no UNDO - show it first to a friend who understands MySQL!!!

#4 @peeld
12 years ago

Already figured it out, did it, SWEET, fixed!!! Phew :) Now to remember the fix for NEXT time; I start each class session out with groups public so others can see the activity and get interested in joining but I want to clamp it down after a week or so.

Daisy

#5 @johnjamesjacoby
12 years ago

  • Milestone Awaiting Review deleted

#6 @r-a-y
9 years ago

In 9301:

Messages: Refactor bp_has_message_threads() stack to use array-style parameters.

Props Mamaduka.

See #3767.

Note: See TracTickets for help on using tickets.