XF 1.2 Strange admin log

[nodle]

So I was browsing around in my Admin panel and went to "Admin logs" I noticed that I could filter the user name. There is another user name in there besides mine. It's a user that has one post on our forums. When I filter activity by this user name I am seeing stuff poster below. This user is not an Admin and only I am. They have never been. Should I be worried about this?

 

[Chris D]

Yes.

If you don't know who that user is, you should ban their account immediately and remove their administrator permissions.

Though, it's worth noting that what they're doing is actually not malicious. It seems they are replacing certain items of text in posts. This is legitimately used to convert old BB code tags from old software or raw HTML in posts from old software.

 

[nodle]

But they have never been admin or have had admin privileges. I checked their privileges and they are just a standard user. So why would this show up in there?

 

[Chris D]

Well, they definitely have been an admin and had admin privileges. Those items can only be logged by an Administrator in the Admin CP.

 

[nodle]

Nope never. I am the only Admin and have always been. I have no moderators either. Just me, I even ran the analyzer on their permissions and they are just standard user no moderator privileges or admin privileges. I converted from IPB awhile back. But this was before this member signed up.

 

[Chris D]

Ok.

Let's look at it from another angle. Forget the username logged there. Did YOU yourself perform those actions. Do they look familiar?

It's from the Post Content Find and Replace add-on. One of the images someone has converted YouTube URLs to be XenForo [ MEDIA tags.

Was that you, on the dates shown?

 

[nodle]

No there is only one thread with their post. It was just text and never had any media posted in the whole thread. When I ran the content replace was right after IPB and it was probable 2 months solid before this user signed up. The thread is listed below with this users only post:

http://www.fluxoid.com/threads/bagging-carousels-at-stores-checkout.9829/#post-46141

Third post down. It is just text. I just can't figure it out. Another strange thing is this was performed the day after this person signed up. But their last online was only on the day they signed up

 

[Chris D]

I'm not talking about that user anymore. Forget about that user.

Are you saying that on the 16th June you definitely did not perform those actions listed in the admin log?

 

[nodle]

Nope I did not. They posted no video or photos in that thread I know of for sure.

 

[Chris D]

You did not.

Then someone did. Someone -- according to the log it is that user -- has accessed your Admin CP and used the post content find and replace tool.

There is currently no other explanation.

 

[nodle]

I also verified the IP of the admin changes to the user and they are different even though it shows up as their name that did it? But I removed the content replace tool after i moved over from IPB. I even just went back in and checked and I have no add ons.

 

[Paul B]

What is the user ID in the xf_admin_log table for those entries?

 

[Martok]

It's irrelevant what the user did or did not post.

That user registered on 15th July. The content find/replace happened on 16 Jun, a month before. So I can't see how it can be that user that did this.

To me it seems like there could be some glitch in the logs showing the wrong username for the content/replace.

So, maybe it was you that did this? You said you ran the content/replace 2 months before the user registered. Maybe you got the timescale wrong and it was 1 month before?

 

[nodle]

What is the user ID in the xf_admin_log table for those entries?

I'm not quite sure how to look this up. I am under my sql database and click on xf_admin_log how would I go about this afterwards?

 

[nodle]

It's irrelevant what the user did or did not post.

That user registered on 15th July. The content find/replace happened on 16 Jun, a month before. So I can't see how it can be that user that did this.

To me it seems like there could be some glitch in the logs showing the wrong username for the content/replace.

So, maybe it was you that did this? You said you ran the content/replace 2 months before the user registered. Maybe you got the timescale wrong and it was 1 month before?

It could had been maybe a month before. But would that had made a difference? I know it was deleted way before they signed up. Think it's just a glitch?

*actually I know the date was the June 16th I ran the tool

 

[Paul B]

Run this query:

SELECT * FROM `xf_admin_log` WHERE request_url = 'post-replace/replace'

 

[nodle]

Run this query:

SELECT * FROM `xf_admin_log` WHERE request_url = 'post-replace/replace'

Ok I did that I got a #1 and a #28 for the user ID and there are 9 entries for the #28 which would match the user.

 

[Paul B]

So those IDs match:
http://www.fluxoid.com/members/nodle.1/
http://www.fluxoid.com/members/basschica.28/

Which seems to imply that someone(s) logged in to the ACP with those two accounts and performed those actions.

 

[nodle]

I know I converted my site on June 16th for sure. That was also the day I deleted the post-replace tool. The user signed up July 15th.

 

[nodle]

So those IDs match:
http://www.fluxoid.com/members/nodle.1/
http://www.fluxoid.com/members/basschica.28/

Which seems to imply that someone logged in to the ACP with those two accounts and performed those actions.

That's impossible with their permissions and me being the only admin. Not only that I also have always had a Httacess password in place in conjunction with the ACP password.