Nice but…

  • I’m running the latest invite anyone on a patched 2.1 buddypress. The buddypress had to be patched due to my specific configuration

    • Multisite
    • Not network enabled but only one site

    This setup now basically works, but I think ‘Invite Anyone’ is not used to this configuration yet. When I invite someone on my site Growing Green Cities I get a list of people to choose from from ALL my users, not just the site’s users (this is a buddypress issue which is still open I believe, don’t think it should work like that) but when sending the invites through invite anyone I also get an error message telling me that a user already exists (which is true, just not on that one site but on an entirely unrelated one)

    NOTE: I just realized that the problem I described above is actually an information disclosure bug. It’s not just a feature request for a next version, it discloses information on other users on multisite that you don’t want shared with users of one particular site.

Viewing 5 replies - 1 through 5 (of 5 total)
  • Plugin Author Boone Gorges

    (@boonebgorges)

    Thanks for the report. You are correct that Invite Anyone is not designed to support this particular configuration. Perhaps in the future, I’ll look into better support for inviting users who have accounts on the installation but are not members of the current site.

    Thread Starter fredleeflang

    (@fredleeflang)

    I updated my report as I just realized that as I’m getting more users on my site, more and more people that I don’t know myself, I do no longer know who are the people that can see all the subscriber information.

    I run my business site on one wordpress site, a non-profit on another. I cannot afford to have people from the non-profit ogling through my business site subscribers!!!

    Please fix this as soon as you get an opportunity. I also won’t mind digging through the code and see if I can figure it out myself and provide you with a patch.

    Thread Starter fredleeflang

    (@fredleeflang)

    Boone, I apologize but the above is actually incorrect I believe.

    Invite Anyone doesn’t generate the picklist with names from other blogs I believe, it must be Buddypress itself that’s doing that.

    Thread Starter fredleeflang

    (@fredleeflang)

    Well okay there is some problem with it still, which is that you can’t invite-anyone somebody who’s already in the database, that is invite-anyone, so withholding 5 star rating for now ??

    Plugin Author Boone Gorges

    (@boonebgorges)

    I’d welcome a patch (see https://github.com/boonebgorges/invite-anyone) but unfortunately I don’t think it will be trivial to build. The plugin is designed for the invitation of people who do not have accounts on the site. To support the case where you want to invite users who have accounts but are not members of the current blog, all of that internal logic will have to be abstracted, and switched out depending on the current site configuration, etc. At the moment, none of my clients who fund the development of this plugin are in need of this edge-case functionality, so I’m afraid I’m unable to build it myself at the moment. But please do have a look, and if you can get even part of the way there, maybe I can help to put things together.

Viewing 5 replies - 1 through 5 (of 5 total)
  • The topic ‘Nice but…’ is closed to new replies.