Hi all,
I had a user who somehow managed to make herself and administrator, unbeknown to me, and went and deleted all her posts!
Does anyone know of such a system flaw that a user on a forum for Grandparents (not usually technologically inclined) with custody of their Grandchildren, could so easily do this?
Is there any way of restoring all that valuable content?
I am even willing to edit MySQL database tables individually if needed!
Thanks in advance for any and all help with this.
BTW this seemed to be just prior to my most recent upgrade if that makes any difference!
TSG!
Well, if they are her own posts - that is no flaw at all. Users are allowed to delete their own posts by default. If you wish to change this:
Admin CP --> Board Settings --> Change --> Posting --> Edit Time Limit
Change that to something like '120' to allow 2 hours edit time. After this time is up, users will be unable to delete or edit their posts.
And just to clarify, you can't get the posts back unless you have a backup.
MrDoom Wrote:And just to clarify, you can't get the posts back unless you have a backup.
Indeed. I always forget to say that. :[
Probably because I never take backups. I should start doing that.
Hmmm no that was not the case...as I did set that to 15 minutes, and when I was looking at the administrator logs (for the first time lol) showing a new admin around the site she is going to take care of for me, is when I saw not only the deleted posts, but that she (the other older one) was listed as an administrator and neither I nor my partner did this, hence the question about there being a security gap issue or not!
Unless this was a setting that returned to default after the upgrade? I will check...as far as the system generated back up goes i can maybe restore that on local server then migrate just those posts to the live forum? As this looks like it happened last sept or there abouts, and this was during the time me and my co admin could not log in (to control panel) for almost two weeks till I found the fix here!
So restoring a back up would result in more loss than already incurred.
Ok I checked and it does look like it reset to the default of 0 for post edit time, but that still does not explain her ability to make herself an administrator!
Thanks for the replies...and look forward to your input again!
TSG!
I wish mybb would change that default settings. It's so dangerous to allow members to delete their own posts. If they start a thread and it has dozens or even hundreds of post that member can delete them all. Many admins don't realize that members have the power to delete their own posts by default and as stated above..no way to get them back besides a backup WHICH would negate any posts made since the backup.
Quote:was listed as an administrator
Are you sure about that? Did you look at her profile or because you saw her in the admin/mods log? The log will display any user making moderator changes even if they are not in admin group.