[buddypress-trac] [BuddyPress] #3666: bp_core_catch_no_access() not 404ing for spammers

[buddypress-trac at lists.automattic.com]

#3666: bp_core_catch_no_access() not 404ing for spammers
-----------------------------------+--------------------
 Reporter:  DJPaul                 |       Owner:
     Type:  defect (bug)           |      Status:  new
 Priority:  normal                 |   Milestone:  1.5.1
Component:  Core                   |     Version:
 Severity:  major                  |  Resolution:
 Keywords:  has-patch 2nd-opinion  |
-----------------------------------+--------------------
Changes (by boonebgorges):

 * keywords:   => has-patch 2nd-opinion


Comment:

 There are a bunch of things happening here. Not sure the best way to solve
 it.

 The first issue is that bp_core_catch_no_access() is hooked way too late.
 It will almost never catch, because our screen functions get loaded before
 wp:10, and we kill all output after that. 01.patch hooks it to bp_init:8,
 which is after our globals and nav have been established, but early enough
 to be effective.

 The second issue is that a bp_do_404() launched in
 bp_core_catch_no_access() doesn't seem to work in any case. Not sure what
 to do about that.

 The third issue, and how we can at least fix this ticket for today, is
 that we should move the displayed_user spammer check where we set
 displayed_user, in bp_core_set_uri_globals(). See 01.patch to see what I
 mean. That fix alone will solve the problem in this ticket.

-- 
Ticket URL: <https://buddypress.trac.wordpress.org/ticket/3666#comment:1>
BuddyPress <http://buddypress.org/>
BuddyPress