1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

XF 1.2 Strange admin log

Discussion in 'Troubleshooting and Problems' started by nodle, Aug 4, 2013.

  1. nodle

    nodle Well-Known Member

    So I was browsing around in my Admin panel and went to "Admin logs" I noticed that I could filter the user name. There is another user name in there besides mine. It's a user that has one post on our forums. When I filter activity by this user name I am seeing stuff poster below. This user is not an Admin and only I am. They have never been. Should I be worried about this?

    1.jpg 2.jpg

    3.jpg
     
  2. Chris D

    Chris D XenForo Developer Staff Member

    Yes.

    If you don't know who that user is, you should ban their account immediately and remove their administrator permissions.

    Though, it's worth noting that what they're doing is actually not malicious. It seems they are replacing certain items of text in posts. This is legitimately used to convert old BB code tags from old software or raw HTML in posts from old software.
     
  3. nodle

    nodle Well-Known Member

    But they have never been admin or have had admin privileges. I checked their privileges and they are just a standard user. So why would this show up in there?
     
  4. Chris D

    Chris D XenForo Developer Staff Member

    Well, they definitely have been an admin and had admin privileges. Those items can only be logged by an Administrator in the Admin CP.
     
  5. nodle

    nodle Well-Known Member

    Nope never. I am the only Admin and have always been. I have no moderators either. Just me, I even ran the analyzer on their permissions and they are just standard user no moderator privileges or admin privileges. I converted from IPB awhile back. But this was before this member signed up.
     
  6. Chris D

    Chris D XenForo Developer Staff Member

    Ok.

    Let's look at it from another angle. Forget the username logged there. Did YOU yourself perform those actions. Do they look familiar?

    It's from the Post Content Find and Replace add-on. One of the images someone has converted YouTube URLs to be XenForo [ MEDIA tags.

    Was that you, on the dates shown?
     
  7. nodle

    nodle Well-Known Member

    No there is only one thread with their post. It was just text and never had any media posted in the whole thread. When I ran the content replace was right after IPB and it was probable 2 months solid before this user signed up. The thread is listed below with this users only post:

    http://www.fluxoid.com/threads/bagging-carousels-at-stores-checkout.9829/#post-46141

    Third post down. It is just text. I just can't figure it out. Another strange thing is this was performed the day after this person signed up. But their last online was only on the day they signed up
     
  8. Chris D

    Chris D XenForo Developer Staff Member

    I'm not talking about that user anymore. Forget about that user.

    Are you saying that on the 16th June you definitely did not perform those actions listed in the admin log?
     
  9. nodle

    nodle Well-Known Member

    Nope I did not. They posted no video or photos in that thread I know of for sure.
     
  10. Chris D

    Chris D XenForo Developer Staff Member

    You did not.

    Then someone did. Someone -- according to the log it is that user -- has accessed your Admin CP and used the post content find and replace tool.

    There is currently no other explanation.
     
  11. nodle

    nodle Well-Known Member

    I also verified the IP of the admin changes to the user and they are different even though it shows up as their name that did it? But I removed the content replace tool after i moved over from IPB. I even just went back in and checked and I have no add ons.
     
  12. Brogan

    Brogan XenForo Moderator Staff Member

    What is the user ID in the xf_admin_log table for those entries?
     
  13. Martok

    Martok Well-Known Member

    It's irrelevant what the user did or did not post.

    That user registered on 15th July. The content find/replace happened on 16 Jun, a month before. So I can't see how it can be that user that did this.

    To me it seems like there could be some glitch in the logs showing the wrong username for the content/replace.

    So, maybe it was you that did this? You said you ran the content/replace 2 months before the user registered. Maybe you got the timescale wrong and it was 1 month before?
     
  14. nodle

    nodle Well-Known Member

    I'm not quite sure how to look this up. I am under my sql database and click on xf_admin_log how would I go about this afterwards?
     
  15. nodle

    nodle Well-Known Member

    It could had been maybe a month before. But would that had made a difference? I know it was deleted way before they signed up. Think it's just a glitch?

    *actually I know the date was the June 16th I ran the tool
     
  16. Brogan

    Brogan XenForo Moderator Staff Member

    Run this query:
    Code:
    SELECT * FROM `xf_admin_log` WHERE request_url = 'post-replace/replace'
     
  17. nodle

    nodle Well-Known Member

    Ok I did that I got a #1 and a #28 for the user ID and there are 9 entries for the #28 which would match the user.
     
  18. Brogan

    Brogan XenForo Moderator Staff Member

  19. nodle

    nodle Well-Known Member

    I know I converted my site on June 16th for sure. That was also the day I deleted the post-replace tool. The user signed up July 15th.
     
  20. nodle

    nodle Well-Known Member

Share This Page