Note: If you are not using a link to run a search, you are not affected by this change, and you can upgrade BP Profile Search as usual.
BP Profile Search (BPS) allows to run a search from a link, a menu item, or a bookmark, using the members directory URL with a custom query string. The query string is the same string that BPS generates when you choose Form Method: GET in the Form Settings box.
The query string contains the ID of the form that generates the search. Previous BPS versions didn’t check the form ID, so users could manipulate the query string to run any possible search on your member profiles, even on fields with restricted visibility.
To fix this potential privacy breach, BP Profile Search 5.0.2 checks the form ID in the query string, and allows only the searches specified in that form.
The price of the fix is a backwards incompatibility if you are using a link to run a search on your site. In this case, you have to check that link and make sure it uses a valid form ID. For instance, if you used a link like:
http://your-site/members/?field_1_contains=john&bp_profile_search=50
make sure that your form with ID 50 allows for that search, and replace that link with:
http://your-site/members/?field_1_contains=john&bps_form=50
If you used a link like:
http://your-site/members/?field_1_contains=john&bp_profile_search
create a new search form that allows for that search, and replace that link with:
http://your-site/members/?field_1_contains=john&bps_form=75
where 75 is your new search form ID.
Please note that the key bp_profile_search
is replaced by the key bps_form
.
As already mentioned, if you are not using a link to run a search you are not affected by this change.