search

ColdTrick / profile_manager

Manage profile fields for users and groups in Elgg
https://elgg.org/plugins/385114
30 stars 32 forks source link

Something allowed a user to like river:comment:site:default and appear on all profile pages #93

Closed topdog08 closed 8 years ago

topdog08 commented 8 years ago

Hi, I reported this to Elgg and Steve Clay closed the ticket saying I should report it here instead:

A user was trying to "Like" a new user or their content, they don't remember which, but instead got:

1 like

river:comment:site:default 7 days ago .

From that point on this user appeared in the activity profile widget for all users, or at least users whose activity for joining the site still appeared in the activity widget, which somehow matches with that text, although I could not find that string in the en.php language files, at least not the default language file.

It is possible the new user they were trying to like was deleted or had some type of error, I don't know.

However this user was able to like river:comment:site:default, which should be avoided to prevent this. Deleting the comment fixed it, but wasn't intuitive to find and users thought our site had been hacked.

Our site is running Elgg 2.1.2.

Looking in the profile_manager language files I saw this message but it is not an exact match: // river events 'river:join:site:default' => '%s joined the site', Which is probably why there is no message substitution, but the bottom line is how can you Like something in the format of a message template? That doesn't seem like it should be allowed right?

topdog08 commented 8 years ago

Forgot to add we are using version 10.0 of Profile Manager.

jdalsem commented 8 years ago

Before Elgg 2.0 it was possible to Like site entities in the system, but since 2.0 site entities are no longer likeable by default (https://github.com/Elgg/Elgg/issues/5996). Profile Manager does not make site entities likeable.

Profile Manager does add the river notice of a new site join, but does not add the comment/like feature. The missing language key hints to a feature where the user was able to 'comment' (so not like), but i do not know where the feature is coming from.

Do you have information on how to reproduce the problem? Do you see 'Like' or 'Comment' icons in the river activity of a user joining a site?

My guess this issue happened before Elgg 2.0 and/or is not caused by Profile Manager.

jdalsem commented 8 years ago

@topdog08 did you have any more information?

topdog08 commented 8 years ago

Hi no I do not have any more information, it was a very strange problem but this is all the detail I have.

topdog08 commented 8 years ago

You asked "Do you see 'Like' or 'Comment' icons in the river activity of a user joining a site?" The answer is no, only on their river activity for adding photo albums or photos in tidy pics.

topdog08 commented 8 years ago

More specifically I see several Like buttons on river activity for users commenting on tidy pics photos too.

jdalsem commented 8 years ago

could it come from tidypics in some way? Are the links still present when you disable Profile Manager?

topdog08 commented 8 years ago

Unfortunately I can not recreate the problem so I can not answer this.

jdalsem commented 8 years ago

closing it for now due to lack of information... if something comes up please let me know