XF 2.2 Losing a group

[Mendalla]

I opened up my PWA this morning to discover that all my forums were marked "Private" except for the private forums used by mods and admins. I tried logging out and back in. Same result. Logged into ACP and checked my account and it was missing the Registered group (Administrative was set as my primary). So it all makes sense, since access to those private forums is controlled by the Administrative group and a group called Council, both of which I still had, while the regular forums are controlled by Registered. So I readded Registered and all was well.

However, when I logged in with my superadmin and checked the Admin Log, the last time my account was saved by an admin (me) prior to me fixing it this morning was on April 1. But everything has been fine all through the month of April on all devices. So if Registered got removed on April 1 (and I am still parsing that log because the details are a bit cryptic so I am not 100% sure that's when it happened), why did it not become a problem earlier? Could my groups have been changed without it showing up as a save of my account in the Admin Log?

It is likely the result of me having a slip of the finger, but it worries me a little that I am having trouble pinning down when and how it happened. Any tips or advice on tracing events like this?

 

[Paul B]

If it was done via the UI and not via third party code or direct DB manipulation, then it will show in the user change log.

 

[Mendalla]

Thanks @Brogan.

So it shows my groups being changed at 12:25am. A couple questions arise.

If it only shows my username, not "username by username", that means I made the change?

Second question is what time zone is shown, local or UTC? Because 12:25am is long past this aging ape's bedtime.

I have changed my password as a precaution but want to make sure that I understand this correctly.

 

[Mendalla]

Okay, answered the second one myself. Based on the time given for my password change it is local time (EDT in my case). So apparently I was sleep forum-ing last night or I've been hacked.

 

[Paul B]

You can check the

If it only shows my username, not "username by username", that means I made the change?

Correct.

So apparently I was sleep forum-ing last night or I've been hacked.

The IP addresses tab will show who was logged in to your admin account.