bbpress user profile pages are not secure – need workaround
-
In my profile page bbpress states:
“This is how your profile appears to a logged in member.”
<b>You don’t have to be logged in to see a user profile page.</b> I’ve tried this with other member names in the forums in different browsers with cleared out caches. You can see any member profile with the direct URL: http://bbpress.org/forums/profile/username (Try this with any valid user name)
(Could it be that this security hole causes a lot of spam attacks?)
On my site, until I did some tweaking with a membership plugin you could not only access the bbpress profile, but also edit the user profile, change the password, whatever. Now that this is more secure I can give an example:
http://kyebay.ca/forums/admin/Fritzi (styles fall apart)
I want to redirect author links to a custom bbpress profile page with proper site styles applied and separate the user profile from the bbpress profile.
How can that be done? Can you point me to the code I need to use? I could really use some help with this. I’ve posted on this matter in another topic, which had no response, because I may not have described the problem properly. Using WP 3.4 with updated Twenty Eleven theme. Please advise.
-
User profiles are always public, and no – you cannot edit a profile that is not yours unless you are a keymaster.
If it was a security hole (which it’s not) posting about it in a public forum is a no-no.
The “…This is how your profile…” string is part of bbPress 1.1, and not part of 2.0, but I see you’re using 2.0 on your site.
All of this, makes me confused.
- You must be logged in to reply to this topic.
