XF 2.0 Very strange problem

[Abraham54]

Which site: https://www.nationaalcomputerforum.nl/

Problem: when logged in there is a problem with a forum that is in Private modus; another subforum not even shows.

Not logged in:



When logged in:



In Admin there is no problem with the nodes, nothing is in Private modus; permissions are normally set.

Until now I have not figured out what is wrong.

 

[Chris D]

You’ll likely need to use the Permission analyzer too see how permissions are being applied properly.

 

[Abraham54]

I have already done that as one of the first things for all members and none problems were reported.

 

[Abraham54]

Problem is solved.
Somebody unknown has been tampering with permissions.
One user group had complete moderator rights.
Ik took me more than five hours today set the node permissions back to normal.

 

[Ozzy47]

Sounds like you need to change staff or at least their permissions.

 

[Abraham54]

I checked the adminlogs - nothing suspicious there!

 

[Ozzy47]

Someone had to had changed them, permissions or any settings for that matter don't simply change in their own. Only way around that is if someone manipulated the DB somehow, either by hand or a script.

 

[Abraham54]

Your mentioning of the database, is exactly what I am thinking of.

But that would mean the server is compromised!

 

[Ozzy47]

Yes, the only way to the DB is if it is comprised, either by a known password or a bad addon.

 

[Abraham54]

What do you mean by a bad add-on?

 

[Ozzy47]

Well one that would have a backdoor written into it, giving the developer access to the DB

 

[Chris D]

So, the server is compromised, and they used all that power to merely change permissions on a single node?

Sorry, that doesn't seem likely, at all

I think the most likely scenario is that it was changed by someone with access to permissions, perhaps unintentionally. You may have not been able to identify it in the logs, as it could have been done unintentionally with a legitimate change or someone did it and simply didn't understand the repercussions of it.

Obviously keep an eye out for strange goings on, but there's nearly always a more logical explanation.

 

[Abraham54]

All nodes were affected!

 

[Abraham54]

The server is not compromised and what is more, so far I can see it is not possible in the database to chance node permessions.

After resetting all nodes permissions I controlled the User groups.
And found what I see as the culprit.

Originally i have renamed Newly Registered to Nieuw lid.
In the original XenForo permission settings I only changed a few settings.

By controlling last Sunday the group Nieuw lid I noticed that all moderator permissions where applied.

I don't know how this came about, but the settings for the moderator permissions were deactivated.