Doctoring logs in ACP?

Do not post support requests, bug reports or feature requests. Discuss phpBB here. Non-phpBB related discussion goes in General Discussion!
Get Involved
Post Reply
jeltz
Registered User
Posts: 10
Joined: Thu Feb 14, 2013 11:58 am

Doctoring logs in ACP?

Post by jeltz »

Finally joined after having read the forums many times! So hello all.

I have an issue on a forum that I and 4 others administer.

One of the admins has accused one of the rest of us of making alterations to his posts and doctoring the logs in the ACP to hide the fact. Personally I don't think that's possible but before I tell him so, I want to know for sure. After all if we do have a rogue admin the rest of us want to know.
User avatar
KevC
Support Team Member
Support Team Member
Posts: 70389
Joined: Fri Jun 04, 2004 10:44 am
Location: Oxford, UK
Contact:

Re: Doctoring logs in ACP?

Post by KevC »

If someone edits a post it shows up in the maintenance tab > moderator log, saying who carried it out and which topic was edited and when.

You can delete that log entry. But then the admin log says Cleared moderator log next to the name of the person and the time.

If you try and cover your tracks by deleting that record it then says Cleared admin log next to the name of the person and the time.

You would need access to the database to clear it with no record.
-:|:- Support Request Template -:|:-
Image
Cheap UK Hosting
"In the land of the blind the little green bloke with no pupils is king - init!"
jeltz
Registered User
Posts: 10
Joined: Thu Feb 14, 2013 11:58 am

Re: Doctoring logs in ACP?

Post by jeltz »

Thanks,

Editing the database would require logging into the server then. Hopefully there will be sign in logs available to show the IP address of anyone who has done that recently. The guy who claims this has been done is the only person who would normally be looking after the DB.

So unless someone had the presence of mind to use a proxy then it should be easy to find.

I assume that they would have had to download the forum make changes and upload it again, sorry if this is a daft question but although I "get" the principle I don't have the practical knowledge of how it would be done.
User avatar
KevC
Support Team Member
Support Team Member
Posts: 70389
Joined: Fri Jun 04, 2004 10:44 am
Location: Oxford, UK
Contact:

Re: Doctoring logs in ACP?

Post by KevC »

jeltz wrote: I assume that they would have had to download the forum make changes and upload it again, sorry if this is a daft question but although I "get" the principle I don't have the practical knowledge of how it would be done.
No, they would just log in to the database server, go to phpmyadmin and delete the right line of the _logs table.
It's a lot of effort to cover up a couple of simple post edits though.
-:|:- Support Request Template -:|:-
Image
Cheap UK Hosting
"In the land of the blind the little green bloke with no pupils is king - init!"
Pony99CA
Registered User
Posts: 4783
Joined: Thu Sep 30, 2004 3:13 pm
Location: Hollister, CA
Name: Steve
Contact:

Re: Doctoring logs in ACP?

Post by Pony99CA »

If a post is edited, isn't there an "Edited by..." entry in the post? That can't be cleared by clearing the logs, right? You would have to have database access to the delete those. (Technically, you could restore the database to a previous version, but that would just revert his post back to what it was.)

Steve
Silicon Valley Pocket PC (http://www.svpocketpc.com)
Creator of manage_bots and spoof_user (ask me)
Need hosting for a small forum with full cPanel & MySQL access? Contact me or PM me.
User avatar
KevC
Support Team Member
Support Team Member
Posts: 70389
Joined: Fri Jun 04, 2004 10:44 am
Location: Oxford, UK
Contact:

Re: Doctoring logs in ACP?

Post by KevC »

Pony99CA wrote: If a post is edited, isn't there an "Edited by..." entry in the post?
Only if you have it turned on in the post settings. I have a funny feeling there are some other associated characteristics with that too such as who did the edit and the time frame but I can't remember what they are.
-:|:- Support Request Template -:|:-
Image
Cheap UK Hosting
"In the land of the blind the little green bloke with no pupils is king - init!"
Pony99CA
Registered User
Posts: 4783
Joined: Thu Sep 30, 2004 3:13 pm
Location: Hollister, CA
Name: Steve
Contact:

Re: Doctoring logs in ACP?

Post by Pony99CA »

Kevin Clark wrote:
Pony99CA wrote: If a post is edited, isn't there an "Edited by..." entry in the post?
Only if you have it turned on in the post settings. I have a funny feeling there are some other associated characteristics with that too such as who did the edit and the time frame but I can't remember what they are.
Even if it's not turned on, does it still save that information in the posts table (in case somebody does turn it on later)? If so, the paranoid admin could check those fields and see who edited his posts (unless somebody erased the logs and that information in the database).

Steve
Silicon Valley Pocket PC (http://www.svpocketpc.com)
Creator of manage_bots and spoof_user (ask me)
Need hosting for a small forum with full cPanel & MySQL access? Contact me or PM me.
User avatar
KevC
Support Team Member
Support Team Member
Posts: 70389
Joined: Fri Jun 04, 2004 10:44 am
Location: Oxford, UK
Contact:

Re: Doctoring logs in ACP?

Post by KevC »

Yes it looks like there are 5 post edit fields in the posts table. It's a heck of a secret agent job to go and do all of that though!
-:|:- Support Request Template -:|:-
Image
Cheap UK Hosting
"In the land of the blind the little green bloke with no pupils is king - init!"
User avatar
HGN
Former Team Member
Posts: 4706
Joined: Wed Dec 03, 2008 1:53 pm
Location: The Netherlands
Name: Alfred
Contact:

Re: Doctoring logs in ACP?

Post by HGN »

AFAIK an edit is not stored in the posts table in case it is the last post of a topic and in case it is a moderator editing the post. When editing a post as moderator it will only show edited if a reason is entered during editing.

Still the moderator logs will show the post is edited.
Post Reply

Return to “phpBB Discussion”