XF 1.2 Strange admin log

[nodle]

So I was browsing around in my Admin panel and went to "Admin logs" I noticed that I could filter the user name. There is another user name in there besides mine. It's a user that has one post on our forums. When I filter activity by this user name I am seeing stuff poster below. This user is not an Admin and only I am. They have never been. Should I be worried about this?

 

[nodle]

Changed my passwords - deleted the user and dumped the tables. I'm gonna have to say it was a bug because there is no way they could have had admin privileges. Not only that why would you ran a youtube replacement? I'll keep an eye on the logs. Thanks for the input guys.

 

[CTXMedia]

You don't have an add-on that lets you login as another user do you? Perhaps this might explain it - if the cookie retains the 'other' user ID somehow?

 

[nodle]

Nope no add ons. In fact the only add-on that I have ever installed was the post-replace one that was deleted the same day as the import.

 

[CTXMedia]

Ghost in the machine then ...

If that user has never done anything malicious, you've never had any run-ins with them, and you're confident they'd never do anything to harm you or your board, then I'd put it down to an error with the add-on and let the add-on author know (probably via PM so you can share the details of the log info with them).

 

[nodle]

I looked though my files to see if anything had a date from June 16th. The only file with an old date is: cron.php

<?php

$startTime = microtime(true);
$fileDir = dirname(__FILE__);

require($fileDir . '/library/XenForo/Autoloader.php');
XenForo_Autoloader::getInstance()->setupAutoloader($fileDir . '/library');

XenForo_Application::initialize($fileDir . '/library', $fileDir);
XenForo_Application::set('page_start_time', $startTime);

XenForo_Cron::runAndOutput();

Is this safe to delete? I just want to delete anything that might had been left over with the post replace addon.

 

[Chris D]

cron.php is important if you're still running XenForo 1.1.X.

It is no longer used in XenForo 1.2.

 

[nodle]

One last thing is there an option to have the admin logs purged after so many days? I see an option for IPs and moderator logs but no admin logs?

 

[Paul B]

http://xenforo.com/community/threads/frequently-asked-questions.5183/#post-180456

How do I change the number of days for which the Admin Log in the ACP is retained?
Edit the library/config.php file and add the following:

$config['adminLogLength'] = 30;

Change the value to the number of days required. The default setting is 60 days.

 

[CTXMedia]

How would you set it to retain them indefinitely?

 

[Paul B]

Having just done a quick test, 0 seems to work.

 

[CTXMedia]

Having just done a quick test, 0 seems to work.

Great - thanks - can I use it bare, or do I need to enclose it in quotes, i.e.; = '0' ?

 

[Paul B]

$config['adminLogLength'] = 0;

 

[Mike]

Just to check here, have you ever deleted or merged any users? Particularly one who might've had this ID.

If you've deleted users, it could've bee an a previous one who was use 28. We semi intentionally don't delete the admin log entries with user deletion (as this could cover up tracks) and MySQL generally won't reuse auto increment numbers except if the MySQL server gets restarted and the new maximum ID is less than that number.

 

[nodle]

Yes I did delete members that probably used the same ID since I had some spam around that time. So that could had been it I guess. I really have no clue to be honest. But whats strange is why would the user show that it was trying to run a replace tool for youtube and quotes. I think it had something to do with the merge replace tool since that is what it seems to have tried to do. But that makes no sense since it was deleted almost a month to the day before. I'm gonna have to say it was a ghost in the machine like @Clickfinity said. I know no one had my passwords, I know that I have been the only admin and they were never admin. I mean why would you log into my acp and try to run a youtube replace and quote replace for me lol? You can see my post here where I asked for help with the same thing right after conversion.

http://xenforo.com/community/threads/trying-to-finish-ipb-3-4-5-import.52658/#post-563359

You know as I was typing this something just clicked. When I did the conversion I know I made a test user for @Jake Bunce . He helped me out with that tool. Then I deleted the user which the next user which would had been #28 would had taken that number. Hence it all makes sense now! According to @Mike

 

[JulianD]

Maybe a suggested fix would be to delete the user_id from the log tables when a user deletion occurs.