Support Forum

SimplePress deleting users and posts outside of SimplePress…

JM James Mueller
James Mueller
Member

On Jan-05 I discovered trashed Posts, Users, and Featured Images on our site.

These deletions occur daily. As of today 2,000+ posts – and many associated users and images — have been trashed.

To clarify: When I refer to “posts” I’m referring to the articles on the site. I am not referring to SimplePress posts, though some SimplePress posts could be missing as well. Growthtrac.com is not only a SimplePress forum -– our site contains thousands of articles (posts).  SimplePress is only a secondary, very minor piece of our site.

The last 3 days, we’ve worked with our host -– WPEngine -– and our developers to determine the cause. Admin accounts were checked, passwords changed, and a Sucuri Scan was run. The scan came back clean.

Last night we tracked content changes on the site. Sure enough, 100+ new deletions occurred and they originated from a cron.

The sph_cron_user cron is deleting content daily at 04:17am
This is of course a SimplePress cron.

 So, I located these (enabled) SimplePress settings:

–Enable auto removal of member accounts
–Remove inactive members (if auto removal enabled)
–Remove members who have not posted (if auto removal enabled)

Here’s what’s been happening: Instead of only removing inactive SimplePress members, SimplePress is also deleting non-SimplePress users (authors, etc.) and associated content.

SimplePress should only be impacting SimplePress data.

 We’re running 5.5.1

 Can you shed light on this?

15 Answers

New Answer

YS Yellow Swordfish
Yellow Swordfish
Member

The problem really is that you are mistaking the concept of users.

Simple:Press is a plugin for WordPress not a standalone forum application. There is no such thing as a ‘Simple:Press’ user as distinct from a user on your site. Simple:Press does not create, maintain or have it’s own users. They are all users on your website, controlled by the WordPress user sub-system.

So if you have those options turned on it is working on your site user-base. 

And it uses the standard WordPress core function wp_delete_user() which will remove that user and any ‘baggage’ that belongs to them.

For most websites – which are run by one or two people who control all of the content then this is a useful tool to make use of. Clearly with lots of people who have in the past, contributed items but have since gone and now fall into the terms of the option settings it is, perhaps, not so useful. And one of ther reasons, of course, we install Simple:Press with those options turned off.

RD Ron Dunn
Ron Dunn
Member

Yellow Swordfish, have you ever thought of separating WordPress users and Simple:Press users?

My forum is for ISV customers and interested parties, a bit like this support forum. I understand the thinking behind integration, but I wonder how many forum customers actually want/need their users to have WordPress integration into their site.

JM James Mueller
James Mueller
Member

As predicted: it’s “my fault”  Oh, and thanks for the empathetic response.

The forums utilize the “WP user sub-system” … Sure, everyone knows that! How intuitive. Maybe I should have enrolled in the “Simple:Press Architecture 201” class …  Sorry, my fault.

Why would a “feature” that deletes post content be “useful” ?

And, why, on such a “feature” where a misconfiguration could cause such catastrophic results, would you not provide a ‘warning’ or ‘validation’ to safeguard against such actions?

<<  … And one of the reasons, of course, we install Simple:Press with those options turned off.

And, no — these configs were not “turned off” by default.

Unbelievable  … I’m done with you guys. 

PS You’re now on the WPEngine “Blacklisted Plugin” list.

KV kvr28
kvr28
Member

are you joking? I’m on wp-engine, when does this go in affect?

JM James Mueller
James Mueller
Member

May not be on the “list’ yet, but no, I’m not joking.  I guess after investing 3 days on the issue and paying for a 3rd-party security scan, they didn’t want this to reoccur on any of their sites.  Good Luck.

KV kvr28
kvr28
Member

I’m waiting on the help desk now for clarification, if they do I guess I will have to move my site,

Instead of only removing inactive SimplePress members, SimplePress is also deleting non-SimplePress users (authors, etc.) and associated content.

Yellow was pretty clear a year ago that WP and SP users are one and the same

https://simple-press.com/support-forum/sp5-general-topics/new-install-all-users-added-by-default/

KV kvr28
kvr28
Member

well, just got done talking to wp-engine, they have no plans as of right now for disallowing it, they said it would be a 30 day notice if they do, unless it is a security or malware issue which this is not, might still be worth looking into site ground

James, it sucks that this happened, I really feel for you, we went through something similar but to a much lesser extent a couple years ago, since your join date is the second and you say you noticed it only a few days ago, have you had many blog posts the last couple days? Is your nightly backup still available for the first of January so you can revert to that and then disable that cron job and delete the plug in if you don’t want it any more?

JM James Mueller
James Mueller
Member

The correct forum join date is roughly 15 months ago.
We’ve deleted Simple:Press.

These deletions go back as far as 28-Nov-2014; WPEngine only saves backups 30-60 days, so I cannot go back any further.  My guess is the trashed posts began early 2014; there are some posts we will not be able to recover.  We have a lot of work ahead of us.

And, as stated, it’s not as simple as ‘restoring’ trashed posts — Simple:Press removes users and associated posts, images, etc.  

BTW The WPEngine team I was working with was quite pissed about the situation; you (obviously) spoke with someone unfamiliar with the issue.

KV kvr28
kvr28
Member

yeah, but the backup should restore everything, posts, users and pictures, I believe the default setting for auto removal is 365 days, so at the worst it would have happened a year from your go live date with simplepress, which would be close to your 15 months ago join date and the Nov 28th date

I just checked my dashboard and I’m showing the earliest nightly back up as Dec 8th, so you may be able to restore with just the missing 10 days from 2014, 2013 and anything from the 8th

I agree with you, I’m sure you were talking to someone way further up the totem pole than I was, good luck

MP Mr Papa
Mr Papa
Member

since 2006 when simple press started, its been very clear that we are  plugin for wp and as such use the wp users…  doesnt really make sense to have a different user db for the forum… and a big waste of resources duplicating all that effort…

and its very clear (check the code) that the auto delete option for inactive users is disabled at install…  the option has to be enabled and requires checking a box, adding in a duration and clicking the update button… so one accidental click will not even set it up…  the help button in that section also clearly state it removes wp users…

simple press does not remove posts or associated images… wp does…  technically, we dont delete the user either – wp does…  when you set it up for the inactive users to be removed, we simply use the wp api and ask wp to delete the user…  per wp standard and default api, posts and such associated with that user are also removed…

sorry you lost your users, but  vitriol being spewed at simple press is just wrong and unwarranted…

sincerely, good luck in the future…

RD Ron Dunn
Ron Dunn
Member

Mr. Papa, I understand how you and Yellow are explaining the concept from a WordPress perspective, but I think the problem is that it doesn’t fit the mental model most people have about how a forum works.

I’m new to both products (WordPress and Simple:Forum), and I’m grateful for the help I have received when I’ve hit a problem.

Where I struggle is that, on the surface, Simple:Forum has the same concepts I’m used to from years of using vBulletin and phpBB sites. Its big benefit, to me, is that it integrates very smoothly into my site. Its integration with WordPress, though, has side effects that create problems like we’re seeing in this case.

My (lowly) view of the world is that Site and Forum are two, distinct concepts. Site is something I own, and for which I provide the content. I own the Forum, also, but the members provide the content. Other than visual integration, I don’t see any relationship between Site and Forum.

I know that registering members separately would replicate work that has already been done in WordPress, but it might be something to add to the long-term wish list.

JM James Mueller
James Mueller
Member

kvr28 said
 I believe the default setting for auto removal is 365 days, so at the worst it would have happened a year from your go live date with simplepress, which would be close to your 15 months ago join date and the Nov 28th date.

I believe my earliest backup in the dashboard was Dec 08 — WPEngine Support pulled an earlier (earliest) backup ( Nov 28) manually and provided that to me separately.

I’m not sure about your calculation. Since SP acted on ALL of our users (authors), and because some of those authors published up to 10 years ago and may have been identified as “inactive” immediately at launch one year ago, those users & posts might have been deleted immediately. I don’t know how SP performs those “inactive” calculations on existing non-SP content.

I’ll know better tomorrow when we restore to Nov 28.

Oh sorry– I didn’t mean to blame SP– I meant to say WordPress deleted my content.

MP Mr Papa
Mr Papa
Member

@ron-dunn first request – maybe second for such separation since we started in 2006… but have made note of your request… 

but an awful lot of folks that use simple press do so because it is integrated with WordPress and does not have its own user db… we have many folks that run a wp site with phpbb or vbulletin or other and move to simple press because they dont want a separate user db from their site…

thanks for the feedback…

JM James Mueller
James Mueller
Member

For my purposes — a web site that is not exclusively SP (our primary purpose is to publish content) — it would have helped to distinguish the “forum” members from the other users. Perhaps, a separate user category. Maybe that’s why, by default, there are different user categories: Subscribers, Editors, Authors.  Ya think?

We were one of those sites that migrated from phpBB. When we ran phpBB on our old site, it co-existed with the rest of the site. That was our expectation with SP. Fine, utilize the WP users, but make a distinction. There’s a reason WP has user categories.

Intuitively, when that SP inactive feature is used, we expect that feature to impact only SP– not the entire user list!  When I turn on my dishwasher, the television doesn’t go on at the same time (“But sir, we told you they use the same electricity!  You’ve known that since 2006!”).

If you are dead-set on keeping your ‘user model’ (which I think you are), then sell SP to forum sites — not as an add-on to a site that also publishes.

Your arrogant responses —  “since 2006 when simple press started, its been very clear that we are  a plugin for wp and as such use the wp users… and its very clear (check the code)” — are sad.  

It’s obvious you’ve invested much energy in SP. It’s an impressive app that goes way beyond the typical plugin. But come on guys … listen to your customers.  (I’m no longer a customer.)

Jim