I've had a hacker that's hijacked 2 different profiles and deleted the yearbook photo. Is there a way to protect the yearbook photos I've worked so hard to scan and upload?

Thanks for the help,
Cheryl

No, classmates themselves can also delete the yearbook photo. You can download the yearbook photos, so if this happened again, you will have a backup and be able to upload it again.

Kyle Erickson wrote:

Kyle, isn't this different than what we were originally told? I'm remembering that the classmate could only upload a yearbook photo if there was none. I think I was told that if there is already a yearbook photo, it could not be deleted or overwritten with another photo by the classmate.

Did I imagine all that? Or, did CC change policy?

I found the discussion I was remembering. It's from December 2013. Somehow I missed when this policy was changed and classmates are allowed to remove the yearbook photo.

http://forums.classcreator.com/messages.cfm?messageid=975DEDCD-90B1-1C17-D1BE22ADEB808874#975DEDCD-90B1-1C17-D1BE22ADEB808874

Note Kyle's assurance that the classmate cannot overwrite or delete the yearbook photo.

What are the names of the hijacked classmates?

Our site was set up 5 years ago, so I don't know all the ins and outs.

The situation of hijacked accounts--have you contacted classmates to confirm that situation? I wonder if people actually took down their yearbook photo because they didn't want it shown for some reason.

Hijacked accounts are concerning, although I haven't run into that yet. To join, all people have to do is click on a name, add an email and password and they are in the group. How often do you hear about hijacked accounts?

For folks whose name isn't on the list, they have to contact us via CC. Some people ask a question that only alumni would know the answer to. However, we haven't done that because we haven't had the nijacking issue.

I am unaware of controls on any photos. For some reason I have assumed that classmates are responsible for posting any photos on their profiles (yearbook or otherwise) as well as in the photo galleries.

Administrators can only upload yearbook photos for people, but they can delete any photos or written posts that are made in case something objectionable was shared.

Is my understanding correct?

Kathy Vannoy wrote:

Kathy, I have a multi-year site (1890-2013)that was established in 2009. So, there's lots of opportunity for someone to "claim" a profile by deleting the name and photo. Thank goodness, I as Administrator receive a notice from CC with each new registration. If the name has been changed I know it's a hijack. I just delete the profile and add the original unclaimed profile and photo back to the site.

In over 5 years I've probably had about 20-25 hijacks, but I hate to use verification. I don't understand people that do this. They could always ask to be added. I believe they may think they can join and start spamming the other members by getting email addresses. Thank goodness that's not readily possible.

Kyle Erickson wrote:

Kyle, there have been many in the last 5 years and I have always deleted the intruders and re-established the original unclaimed profile and added the yearbook photo again.

CC does a good job of notifying of profile changes and new registrations so I can always see name changes, etc. The problem is I don't know when the yearbook photo has been removed. At one time that was not possible.

Can CC add info to the notification that the yearbook photo has been removed?

If you can give me a date of when members were allowed to remove the yearbook photo, I'll go back and check which ones have been deleted. I'll add the yearbook photo back to the profile. It's my site and I want the yearbook photo on it. Of course, I have removed the yearbook photo when someone requests that it be removed.

Kathy Vannoy wrote:

I have scanned every yearbook ever published and cut out every senior photo and uploaded to my site. I want to keep the yearbook photos as the profile photo unless I am contacted by a registered member to remove the photo.

Back before the Social profile was introduced, yearbook photos were an 'admin only' function and could only be added from the "Enter/Edit Classmates" page. Only admins could upload or delete a yearbook photo. Members who did not like their yearbook photo could ask their admin to delete it.

There were multiple forum threads about yearbook photos around that time, and the end result was an agreement that they would remain an 'admin only' option - with an exception where a member who did not have a yearbook photo was allowed to upload one.

If that's changed, I suspect most of us who spent a lot of time adding yearbook photos would prefer that it revert to what we all agreed on.

I vote with John.

Yes, John, that was my understanding, too. Thank you for speaking up. I wonder if enough of us state our preferences will CC go back to the original policy? Sure hope so. I have a multi-year site from 1890-2013. I don't even want to know how many senior photos I scanned and cut out and uploaded!

I posted above the link to one of my threads from December 2013 regarding the yearbook photos. Here's what Kyle said, but his link appears to lead to something that has been deleted, I'm afraid. However, his comments are what we all understood to be the policy.

Tuesday, December 17, 2013 at 12:42 PM - Response #1

Answer is found in this forum:
http://forums.classcreator.com/messages....C17-D1BED2D636943787

Classmates can upload a yearbook photo, but cannot over write the admin-uploaded yearbook photo. The classmate cannot delete the admin uploaded yearbook photo.
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

Class Creator Moderator and
Spanish Fork High School Class of 1981 Administrator

I honestly do not recall reading where this changed.

Correct. Classmates can only upload their own yearbook photo if there isn't one. If the Admin has already uploaded a yearbook photo, or should the Admin choose to overwrite the classmate's yearbook photo, then the Admin's yearbook photo becomes locked and the classmate cannot change it. This policy was derived from considerable forum conversation and has worked extremely well.

Thank you, Brad. That's what I understood. However, I've had several yearbook photos deleted by the person that joined. One was a hacker that deleted photos on 2 different profiles.

Is there a special setting that I need to check to prevent this from happening again?

I have a programmer looking into this.

The programmer added some additional checks to make sure that only the root admin and assigned co-admins can overwrite the image that an admin has uploaded.

Jessica
Class Creator Support

Thank you all, CC, for clarifying and protecting all the work some of us have done over the years.

I'll certainly let y'all know if any yearbook photos get deleted again.

Cheryl

Forgive me for asking this question. I did read everything here but still not clear. If as ADMIN, I add a yearbook photo does that mean the classmate can not remove that photo? Or that they can?

I thought I was having senior moments when I would not see a yearbook photo, thinking maybe I didn't add, when I was sure I did.

If the photo is still there, where would I find it if the classmate removed it?

Meg Davis wrote:

Meg, Since Scott told us back in May 2015 (see above) that the problem was fixed and a classmate could NOT remove or overwrite a photo uploaded by an admin, I have not had anyone on my multi-year site pull that trick. So, I thought our photos were secure.

I hate to hear that it's happening again. You'll understand if I hope it is a senior moment on your part? LOL

Cheryl

Thanks!! I now am going to look at the yearbook photos and see how many are missing.
If I put them back, then they can't delete. I will respect anyone asking me to remove it though.

As I recall, there was a problem for a while because the older YB photos were being stored locally on CC servers and the newer YB photos were being stored on Amazon's servers. And it appeared that the newer ones did not have the same security/restrictions. It also appeared that older YB photos were slowly being move to Amazon.

So I did some testing last night. A random check of older YB photos did not find any which had not been moved to Amazon. And when I added a YB photo on my test account, (1) it was placed on Amazon, and (2) logging in as the test member did have a "remove" option but clicking on it displayed a message that only the Admin could remove admin loaded YB photos.

So it looks like the original problem has been resolved. The only difference I'd mention is that a member who does NOT have an admin loaded YB photo is allowed to upload their own - and delete it or change it if they wish.

Well, a LOT of our yearbooks are still on the 'old' location, however, once you 'visit' a profile they get moved to the NEW location. Haven't verified again but that's how it worked before. I didn't want to disturb for this purpose.

A very quick way to check the current location in FF is to view the profile page showing yearbook photos.

Now click the upper left icon right before the URL.

Click More Information and then media.

Scroll down the list and you'll see the URL storage locations of all the images.

Btw, these "old" locations were causing problems for the Badge program - these images don't show up

Btw, these "old" locations were causing problems for the Badge program - these images don't show up