Monday, April 4, 2011

User Change Log

As shown in the previous blogs, new admins appeared  in the admin control panel on July 18th.  How did that happen?  When and how did they get access?

The userchangelog records when changes are made, including the changes from one group to another.  When a member becomes staff, they are moved from group 2 (registered users) into one of the staff groups (shown in red; 5, 6, 7, 11, 14). 

usergroupid
title
1
Unregistered / Not Logged In
2
Registered Users
3
Users Awaiting Email Confirmation
4
(COPPA) Users Awaiting Moderation
5
Sueper Moderators
6
Administrators
7
Moderators
8
Banned Users
11
Technology Analysts
12
Premium Users
13
Honorary Premium Members
14
Admin
15
Time Out

The user change log shows when any changes were made to a member’s account.  It records when they replied to the welcome email and were moved from user group 3 (Users Awaiting Email Confirmation) to user group 4 (Users Awaiting Moderation).  It records when the account was approved by a moderator and moved to user group 2 (Registered Users).  It also records other changes, such as a change of name or email address. 

Userid is the user number of the member whose account was changed.  Fieldname indicates the type of change; name, email, group, etc.  Oldvalue is the original status and newvalue is the new status.  Adminid is user id of the person making the change.  The time and a unique change code are recorded, as is the IP address of the person making the changes.

The userchangelog record for EvaMarie (user id = 8036) shows that she was moved from user group 3 to group 4 on June 30th.  That happened when she replied to the welcome email.  The IP address used to reply was shown in the log and was the same as that used by Danileo.  (In this chart, IP addresses are shown in decimal form, which I have converted to the more common dot-quad form.) 

A few minutes later, member 8036 was approved by Danileo (admin id = 57) and moved to group 2 (registered users).  Still later that evening, a name change was recorded.  The name had been danileo-test.  It was changed to Fangler by JudyOkla (admin id = 250).

changeid
userid
fieldname
newvalue
oldvalue
adminid
change_time
change_uniq
ipaddress
7777
8036
User
groupid
4
3
8036
(EvaMarie)
1277952512
06 / 30 / 10 @ 9:48:32pm EST
caab83a8026e9c3df724b9173fae7d9f
1xxxxxxxx9
(6x.xxx.xx.xx7)
Danileo
7778
8036
User
groupid
2
4
57
(Danileo)
1277952723
06 / 30 / 10 @ 9:52:03pm EST
a1070c332aaf839fadd7a9e1f031db6c
1xxxxxxxx9
(6x.xxx.xx.xx7)
Danileo
7781
8036
username
Fangler
danileo-test
250
(JudyOkla)
1277959865
06 / 30 /10 @ 11:51:05pmEST
4aedcb5c306e63d43f84e8b533460ca6
1xxxxxxxx9
(9x.xxx.xxx.x7)
JudyOkla
7906
8036
username
EvaMarie
Fangler
57
(Danileo)
1279355314
07 / 17 / 10 @ 3:28:34am EST
dba30542e93e444c94407ff380414257
1xxxxxxxx9
(6x.xxx.xx.xx7)
Danileo
7920
8036
Member goupids
6

57
(Danileo)
1279495301
07 / 18 / 10 @ 6:21:41pm EST
53d4c06cc08520057d27fd5ddf48b492
1xxxxxxxx9
(6x.xxx.xx.xx7)
Danileo
7969
8036
Member groupids

6
99
(lchris)
1279683562
07 / 20 / 10 @ 10:39:22pm EST
4e2bdcf2d4c69d48ca68187592432241
1xxxxxxxx9
(7x.xx.xx.xx9)
lchris


On July 17th, the name of member 8036 was changed from Fangler to EvaMarie.  Was this in preparation for using the account anonymously? Fangler may have been associated with the signature Danileo had used, "Got Fangs?".

On July 18th, at 6:21 pm EST, Danileo (user id = 57) moved EvaMarie to group 6 (Adminstrators).  On July 20th, lchris (user id = 99) removed EvaMarie from group 6. 

The chart above is pretty straight forward and easy to understand.  It shows the changes one would expect when a member joins, is approved and is made an administrator.  It shows who approved the member and who made them an administrator.  The record is not so clear for the other new admins.

The first kaydaniels account (8101) shows a move into group 6 (administrators).  It also shows a name change.  Both of those actions were done by JudyOkla (admin id = 250) and show her IP address.  After that it shows movement back and forth between users groups 2 and 6, all done by Danileo (admin id = 57), using her IP address.  All changes took place on July 18th.

changeid
userid
fieldname
newvalue
oldvalue
adminid
change_time
change_uniq
ipaddress
7918
8101
Member
groupids
6

250
(JudyOkla)
1279493992
07 / 18 / 10 @ 5:59:52pm EST
21c599c3422cedadc2dbd5d1281d7fb6
1xxxxxxxx9
(9x.xxx.xxx.x7)
JudyOkla
7919
8101
username
kaydaniels
kay daniels
250
(JudyOkla)
1279494480
07 / 18 / 10 @ 6:08:00pm EST
469fd09b825897302de30b3adfe68ef7
1xxxxxxxx9
(9x.xxx.xxx.x7)
JudyOkla
7922
8101
usergroupid
6
2
57
(Danileo)
1279501126
07 / 18 / 10 @ 7:58:46pm EST
3bd860b95430188787392c97aeea7745
1xxxxxxxx9
(6x.xxx.xx.xx7)
Danileo
7923
8101
Member
groupids
2
6
57
(Danileo)
1279501126
07 / 18 / 10 @ 7:58:46pm EST
3bd860b95430188787392c97aeea7745
1xxxxxxxx9
(6x.xxx.xx.xx7)
Danileo
7924
8101
usergroupid
2
6
57
(Danileo)
1279501152
07 / 18 / 10 @ 7:59:12pm EST
1d1bac29b3c457d682fa20d1d234c6ac
1xxxxxxxx9
(6x.xxx.xx.xx7)
Danileo
7925
8101
Member
groupids
6
2
57
(Danileo)
1279501152
07 / 18 / 10 @ 7:59:12pm EST
1d1bac29b3c457d682fa20d1d234c6ac
1xxxxxxxx9
(6x.xxx.xx.xx7)
Danileo

What is missing?  There is no evidence of the user group changes that should have been shown when kaydaniels replied to the welcome email and was approved.  That is not recorded for many of the members who signed up earlier, because the same procedures were not in place when they joined.  But requiring reply to an email and approval by a moderator was the procedure at the time kaydaniels became a member.

The same is true for user 8102.  There was a name change from rosa miller to roseym.  And roseym was moved to group 6 (administrators).  Both actions were done by JudyOkla on July 18th.  Lchris moved roseym out of group 6 on July 20th.  But the changes that should have been shown when user 8102 was activated and approved are missing.


changeid
userid
fieldname
newvalue
oldvalue
adminid
change_time
change_uniq
ipaddress
7921
8102
username
roseym
rosa miller
250
(JudyOkla)
1279495643
07 / 18 / 10 @ 6:27:23pm EST
7283f72957fa06e9309d58c0e54c9e05
1xxxxxxxx9
(9x.xxx.xxx.x7)
JudyOkla
7927
8102
Member
groupids
6

250
(JudyOkla)
1279503321
07 / 18 / 10 @ 8:35:21pm EST
1f701b9fcfbbe6932cc3968cb2dd81fe
1xxxxxxxx9
(9x.xxx.xxx.x7)
JudyOkla
7972
8102
Member
groupids

6
99
(lchris)
1279683830
07 / 20 / 10 @ 10:43:50pm EST
246214f10df5b20c6307eab15a5de7cd
1xxxxxxxx9
(7x.xx.xx.xx9)
lchris


The second kaydaniels account (user id = 8106) shows even less information.  The only thing shown is when lchris moved her out of group 6 (administrators) on July 20th.  Where are the other changes?  She must have activated her account and been approved.  There should be entries showing a change from user group 3 to group 4 and then a change from group 4 to group 2.  In order to be moved out of group 6, she must have been moved into group 6 first.  But there is no record of those actions.


changeid
userid
fieldname
newvalue
oldvalue
adminid
change_time
change_uniq
ipaddress
7970
8106
Member
groupids

6
99
(lchris)
1279683719
07 /20/ 10 @ 10:41:59pm EST
21e78a50f7491c208571a5747031eade
1xxxxxxxx9
(7x.xx.xx.xx9)
lchris

 The record for Looie (userid = 8108) is the same.  It only shows when he was moved out of group 6 by lchris.  The other information is missing.
changeid
userid
fieldname
newvalue
oldvalue
adminid
change_time
change_uniq
ipaddress
7971
8108
Member
groupids

6
99
(lchris)
1279683811
07 / 20 / 10 @ 10:43:31pm EST
3104e1fabfb76496cb3125e465893d07
1xxxxxxxx9
(7x.xx.xx.xx9)
lchris


The remaining account is jayme.  This one, too, is missing information.  It does not show when the account was activated or by whom it was approved.  It shows only when he was removed from user group 6, but this time it was by kaydaniels (admin id = 8106) on July 19th. The IP address used by kaydaniels was that of JudyOkla.


changeid
userid
fieldname
newvalue
oldvalue
adminid
change_time
change_uniq
ipaddress
7941
8109
Member
groupids

6
8106
(kaydaniels)
1279559601
07 / 19 / 10 @ 12:13:21pm EST
8c0f338db239054098329b09a4e730a9
1xxxxxxxx9
(9x.xxx.xxx.x7)
JudyOkla

There is information about the new admins missing from the user change log. Only the record for EvaMarie, created in June, shows all of the changes which were made.  Each of the others is missing information, in some cases, most of it. 

Each of these members had to reply to the welcome email.  So there should have been entries showing when they replied and were moved from user group 3 to group 4.  Each of these members had to be approved by a moderator.  So there should have been entries showing when each member was approved and moved from group 4 to user group 2 (registered users).  These members were moved out of user group 6 (administrators).  So there should have been entries showing when they were moved into the administrator group.  What happened to that information?  Why is it not there?