Potential privacy problem fixed in 5.0.2

Note: If you are not using a link to run a search, you are not affected by this change, and you can upgrade BP Profile Search as usual.

BP Profile Search (BPS) allows to run a search from a link, a menu item, or a bookmark, using the members directory URL with a custom query string. The query string is the same string that BPS generates when you choose Form Method: GET in the Form Settings box.

The query string contains the ID of the form that generates the search. Previous BPS versions didn’t check the form ID, so users could manipulate the query string to run any possible search on your member profiles, even on fields with restricted visibility.

To fix this potential privacy breach, BP Profile Search 5.0.2 checks the form ID in the query string, and allows only the searches specified in that form.

The price of the fix is a backwards incompatibility if you are using a link to run a search on your site. In this case, you have to check that link and make sure it uses a valid form ID. For instance, if you used a link like:

http://your-site/members/?field_1_contains=john&bp_profile_search=50

make sure that your form with ID 50 allows for that search, and replace that link with:

http://your-site/members/?field_1_contains=john&bps_form=50

If you used a link like:

http://your-site/members/?field_1_contains=john&bp_profile_search

create a new search form that allows for that search, and replace that link with:

http://your-site/members/?field_1_contains=john&bps_form=75

where 75 is your new search form ID.

Please note that the key bp_profile_search is replaced by the key bps_form.

As already mentioned, if you are not using a link to run a search you are not affected by this change.

New form template structure

The original form template structure used by BP Profile Search is almost four years old now, and the need for a better structure, easier to customize and able to support new features, is becoming increasingly apparent.

The new structure is already in place, it’s used by the most recent form template, bps-form-default, and is described in my page Form Templates.

The old form templates are no longer updated with new features, and will stop working in January 2020. If, for some reasons, you’ll need to use old form templates after that date, you’ll be able to do so using the latest 2019 BP Profile Search version.

Starting with version 5.0, BP Profile Search warns you if you are using an old template, so you have plenty of time to switch to bps-form-default or to rewrite your custom templates, if you are using one, following the new structure.

A few WordPress themes come with their own custom BP Profile Search form templates. These templates should also be rewritten by the theme authors according to the new template structure, to make the new BP Profile Search features available to their customers.

Of course I’m ready to support both plugin users and theme authors in this transition. As usual, you can use the Support Forum for support requests, or my Contact page to contact me privately.

BP Distance Search

Following many user requests, today I’ve released BP Distance Search.

BP Distance Search adds a new Google Place Autocomplete field type to your BuddyPress extended profiles.

You can then create Google Place Autocomplete fields, and add them to your BP Profile Search forms, selecting either the new distance search mode or one of the usual text search modes contains, is, or is like.

I hope you’ll find this new plugin useful. For questions, suggestions and bug reports you can use the BP Profile Search Support Forum.

WPML compatibility

With BP Profile Search 4.9.1, the friendly and supportive WPML team have completed their compatibility testing, so now we can announce full compatibility between BP Profile Search and WPML itself.

Using BP Profile Search with WPML is really simple. The relevant user-entered strings (form title, field label, field description) are automatically registered for translation, so you only need to provide your translations and forget about it.

Of course, if something doesn’t work for you as intended, please feel free to use our Support Forum.

BP Profile Search 4.8.4

Version 4.8.4 introduces the ability to search for user meta data, i.e. data in the (wp_)usermeta table.

This table contains a variety of data, e.g. the user’s first and last name, user roles, and many others, added by WordPress core or by plugins.

Out of the box, BP Profile Search supports only a handful of user meta data: first_name, last_name, role, total_friend_count, total_group_count.

To add your favorite user meta data to that basic initial list, see User Meta Data.

BP Profile Search 4.8.1

Version 4.8.1 brings two often requested enhancements, and a necessary break of backwards compatibility.

1. The ability to search for data in the Users table, e.g. the user ID, login name, or registration date.

The full field list is: ID, user_login, user_email, user_url, user_registered, user_status, display_name. This list can be modified using the bps_users_columns filter hook.

2. The ability to enable or disable the persistent search feature.

When persistent search is enabled, a search is cleared when the user hits the Clear button – this is now the default option.

When persistent search is disabled, a search is cleared when the user hits the Clear button, or navigates away from the results page – this used to be the default before version 4.7.7.

3. The old interface for custom profile field types has been removed, see my post On custom field types.

Unfortunately not all the affected plugins have been updated to the new interface, and in this case you won’t be able to use those field types in BP Profile Search 4.8.1 forms. If that’s a problem, please keep using BP Profile Search 4.8.

BP Profile Search 4.8

BP Profile Search 4.8 introduces the hidden filters feature.

Hidden filters are used within the [bps_directory] shortcode to build specific Members directories.

For instance, if you have a profile field (with ID 39) where Members can select their preferred pets (Cats, Dogs, …), you may want to build a directory showing only Members who prefer Cats. That’s easy, put this shortcode into an empty page:

[bps_directory field_39="Cats"]

Done! you have the directory of cat loving people.

You can build very specific Members directories using any number of hidden filters. All the search modes available to build search forms are also available as hidden filter types. See the Custom Directories page for additional details.

BP Profile Search 4.7

BP Profile Search version 4.7 allows you to sort your search results using profile fields, adding those options to the Order By drop-down in the search results page.

As you may recall, the ability to build a custom search results page with the [bps_directory] shortcode was added in version 4.1. Now that shortcode accepts a new attribute:

[bps_directory order_by=field_xyz]

where xyz is the ID of the profile field you wish to use. For instance, if you have a profile field City with ID 35, and a field Graduation Date with ID 12, the shortcode:

[bps_directory order_by=field_35]

adds the option City to the Order By drop-down.

When a visitor selects City from the Order By drop-down, the directory (or the search results if a search is active) will be sorted by city, ascending. At the same time, the value of the City field will be displayed in each member’s entry.

The sort direction is asc (ascending) by default, but you can specify desc (descending) or both (both directions). For instance the shortcode:

[bps_directory order_by='field_35 both, field_12 desc']

adds the options City ⇡, City ⇣ and Graduation Date to the Order By drop-down. When a visitor selects Graduation Date from the Order By drop-down, the directory (or the search results if a search is active) will be sorted by graduation date, descending. If they select City ⇡ or City ⇣, the directory will be ordered by city, respectively ascending or descending.

For a complete overview of the [bps_directory] shortcode, see the Custom Directories tutorial.