vB 3.7.5 public threads archived by anon

[Tenth Doctor]

It's not a board I own or run, but one i used to at one point several years ago. there was a bit of a ruckus in the group a few days ago and it split in half, one forming another group, and yesterday/today morning all public threads were archived. but there are no logs to show Admin doing it, no Mods were logged in at the time. and 3SuperMods logged in 2 Hours prior to the incident.

Basically what happened is someone went in an archived all publically visible threads. i haven't found an exploit that could do it, whether SQL or vB. Thought I'd ask here if anyone has any ideas.

Logically, if they wanted maximum damage they'd likely delete all threads if not archive all that are visible to logged in users... if they had all access... so I'm stumped, anyone has any ideas?

[ssslippy]

There is no archive feature in vb. So would need more detail.

[Tenth Doctor]

Sorry. forgot to elaborate on that. basically there's a forum that's closed for new responses, but old threads get tossed in there.

[Marco van Herwaarden]

What is the URL to this board?

[Tenth Doctor]

I'm not sure. the URL was blocked by my ISP several years ago, I don't know if they've kept it the same or not. If you go to bravofleet.org or bravofleet.com there should be a link to the forums there.

[Marco van Herwaarden]

This is done with a mass prune. Looking at the forum, i see old stickied threads, normal threads only from the last couple of days. The default for the Mass Prune is "all forums" & "not stickied" and this is how the board is now.

This should be visible in the Admin or Moderator log, unless the log was cleaned (from ACP or manual).

[Tenth Doctor]

The Admins have been working on unarchiving old threads back to where they belong.

Also,, mass prune would catch threads that are visible even if you're logged in (there were things like journals on there , only visible tomembers logged in), this one caught just the threads that were visible to public without logging in.

They've checked the logs, there's nothing to indicate that it was done by an admin or a mod, there is only one admin who has permission to clean logs, and he's as stumped by this one as I am.

[Lynne]

Have you checked the access_logs from around that time?

it's easy to have coded a cronjob with no log at all... no admin access to execute the task...

i've done it already, it's a 30 seconds copy of an existing cron... changing one query and loading it back in the ftp... (so basically, someone with ftp access can edit the daily cron and change it to execute that cleanup, no trace in the logs whatsoever)