• This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn more.

XF 1.2 Strange admin log

nodle

Well-known member
#1
So I was browsing around in my Admin panel and went to "Admin logs" I noticed that I could filter the user name. There is another user name in there besides mine. It's a user that has one post on our forums. When I filter activity by this user name I am seeing stuff poster below. This user is not an Admin and only I am. They have never been. Should I be worried about this?

1.jpg 2.jpg

3.jpg
 

Chris D

XenForo developer
Staff member
#2
Yes.

If you don't know who that user is, you should ban their account immediately and remove their administrator permissions.

Though, it's worth noting that what they're doing is actually not malicious. It seems they are replacing certain items of text in posts. This is legitimately used to convert old BB code tags from old software or raw HTML in posts from old software.
 

nodle

Well-known member
#3
But they have never been admin or have had admin privileges. I checked their privileges and they are just a standard user. So why would this show up in there?
 

Chris D

XenForo developer
Staff member
#4
Well, they definitely have been an admin and had admin privileges. Those items can only be logged by an Administrator in the Admin CP.
 

nodle

Well-known member
#5
Nope never. I am the only Admin and have always been. I have no moderators either. Just me, I even ran the analyzer on their permissions and they are just standard user no moderator privileges or admin privileges. I converted from IPB awhile back. But this was before this member signed up.
 

Chris D

XenForo developer
Staff member
#6
Ok.

Let's look at it from another angle. Forget the username logged there. Did YOU yourself perform those actions. Do they look familiar?

It's from the Post Content Find and Replace add-on. One of the images someone has converted YouTube URLs to be XenForo [ MEDIA tags.

Was that you, on the dates shown?
 

nodle

Well-known member
#7
No there is only one thread with their post. It was just text and never had any media posted in the whole thread. When I ran the content replace was right after IPB and it was probable 2 months solid before this user signed up. The thread is listed below with this users only post:

http://www.fluxoid.com/threads/bagging-carousels-at-stores-checkout.9829/#post-46141

Third post down. It is just text. I just can't figure it out. Another strange thing is this was performed the day after this person signed up. But their last online was only on the day they signed up
 

Chris D

XenForo developer
Staff member
#8
I'm not talking about that user anymore. Forget about that user.

Are you saying that on the 16th June you definitely did not perform those actions listed in the admin log?
 

Chris D

XenForo developer
Staff member
#10
You did not.

Then someone did. Someone -- according to the log it is that user -- has accessed your Admin CP and used the post content find and replace tool.

There is currently no other explanation.
 

nodle

Well-known member
#11
I also verified the IP of the admin changes to the user and they are different even though it shows up as their name that did it? But I removed the content replace tool after i moved over from IPB. I even just went back in and checked and I have no add ons.
 

Martok

Well-known member
#13
It's irrelevant what the user did or did not post.

That user registered on 15th July. The content find/replace happened on 16 Jun, a month before. So I can't see how it can be that user that did this.

To me it seems like there could be some glitch in the logs showing the wrong username for the content/replace.

So, maybe it was you that did this? You said you ran the content/replace 2 months before the user registered. Maybe you got the timescale wrong and it was 1 month before?
 

nodle

Well-known member
#15
It's irrelevant what the user did or did not post.

That user registered on 15th July. The content find/replace happened on 16 Jun, a month before. So I can't see how it can be that user that did this.

To me it seems like there could be some glitch in the logs showing the wrong username for the content/replace.

So, maybe it was you that did this? You said you ran the content/replace 2 months before the user registered. Maybe you got the timescale wrong and it was 1 month before?
It could had been maybe a month before. But would that had made a difference? I know it was deleted way before they signed up. Think it's just a glitch?

*actually I know the date was the June 16th I ran the tool
 

nodle

Well-known member
#19
I know I converted my site on June 16th for sure. That was also the day I deleted the post-replace tool. The user signed up July 15th.