Disappearance of some forum members' badges

medelinor

My forum URL is https://foro.arsoporte.com

I noticed in the last few hours that some badges have disappeared from some forum members’ accounts. At first I thought it was my fault, but it turned out that it was not just one member who was affected, and this is causing confusion for forum members.

Did the same thing happen with another forum administrator? Is it possible that there is, for example, a conflict in extensions?

Any help or advice please.
Thank you very much in advance

medelinor

Hello @SKevo again.
Example: This is a member who has had this happen repeatedly over the last few hours.

SKevo

medelinor I am not aware of any issue that would make users’ badges disappear. I therefore assume that one of your admins is tampering with them? Note that the admin group has full permissions, just like the main admin account. Therefore, it is advised that you only share this group with people that you trust.

I unfortunately can’t confirm whether this is indeed the case, as Flarum does not log who changed the groups by default, as far as I know. I can only see that the user that you have mentioned was assigned 2 groups at 2024-09-07 07:32:31, but I don’t know who made the change.
But I believe that the Audit Log extension can log this? You can enable it for your forum, then observe who changes the groups.

medelinor

SKevo Thanks for the response

I’m familiar with website interfaces, tools and apps, so much so that I can say that I would pay attention to taking a major action like changing a badge for a member. I would also remember if I did something directly related to badges (unless some extensions were affecting others).

Because from the following screenshot, it looks like I removed two badges from the member (red) two hours ago, and then put them back at the same time (orange):

The bottom of the screenshot shows that I put the badges back for him three hours ago (blue) after they had also been strangely removed.

The most certain thing is that (red) I did not touch the member’s profile or make any changes to the extension.
This happened to another member yesterday.

As for the other admins, most of them are my accounts and there is one person I trust who did not touch the forum.
Even using the “FoF Impersonate” extension won’t work because the extension doesn’t work for me on the forum.

Honestly, it’s weird, but it wouldn’t bother me if it was just a technical issue. I just wanted to point this out because it’s hard for me to say that I took that action directly.

Thank you very much

SKevo

medelinor either it is indeed just a bug (in that case, please report to https://discuss.flarum.org) or (worse case) someone has access to your admin account. Have you checked your sessions?

medelinor

SKevo

I checked the log and it does show that I have removed badges for a number of members when I did not do these things.

I rule out the case of the admin account being hacked. Why? Because these changes are unlikely to be made by a hacker who wants to harm the account or the forum. For example, if someone hacked a forum to cause harm, do you think they would pick random members to remove badges from? I think they would do things that are even more harmful. I also say this because I do not share my login details with anyone and I am very sensitive and cautious when it comes to privacy.

Thank you very much

luceos

Disable impersonate if it misbehaves first and foremost. Secondly check sessions.

Understand that the audit log doesn’t lie. But it also logs api requests made with your api tokens under your name.

I am 99% sure this is not a flarum bug. It’s either an extension or leaked credentials somewhere.

medelinor

luceos Thank you very much
I know that the record does not lie, and I know that humans are also prone to error, but when you are sure that you did not take action, it is difficult to doubt yourself that you did, especially when it happened again during the last day.

I assumed that it was due to my work on the badges recently, and that there may be a conflict in the extensions or something similar, and I did not assume that it was a hacking operation.
I did not find any abnormal sessions recently, and I logged out of all of them + changed the password + closed the extension that you advised to close, all of this as a precaution

Thanks a lot

luceos

medelinor what might be likely is that a extension that changes users attributes incorrectly passes on the groups relation as an empty array, which is then picked up by flarum core, enacting group removal. If this is the case, then the question is what you did when these groups were removed. It could be any interaction with the user.

Is there a way to see what extensions you have enabled, cc @SKevo ?

SKevo

luceos Is there a way to see what extensions you have enabled

Flarum core: 1.8.5
PHP version: 8.3.10
MySQL version: 11.4.3-MariaDB-ubu2204
Loaded extensions: Core, date, libxml, openssl, pcre, zlib, filter, hash, json, pcntl, random, Reflection, SPL, session, standard, sodium, mysqlnd, PDO, xml, calendar, ctype, curl, dom, mbstring, FFI, fileinfo, ftp, gd, gettext, gmp, iconv, exif, mysqli, pdo_mysql, Phar, posix, readline, shmop, SimpleXML, sockets, sysvmsg, sysvsem, sysvshm, tokenizer, xmlreader, xmlwriter, xsl, zip, Zend OPcache
+--------------------------------------+---------+--------+
| Flarum Extensions                    |         |        |
+--------------------------------------+---------+--------+
| ID                                   | Version | Commit |
+--------------------------------------+---------+--------+
| flarum-flags                         | v1.8.0  |        |
| flarum-tags                          | v1.8.1  |        |
| flarum-approval                      | v1.8.1  |        |
| fof-pages                            | 1.0.8   |        |
| flarum-suspend                       | v1.8.1  |        |
| flarum-mentions                      | v1.8.3  |        |
| flarum-subscriptions                 | v1.8.0  |        |
| fof-oauth                            | 1.6.10  |        |
| fof-sitemap                          | 2.2.1   |        |
| flarum-markdown                      | v1.8.0  |        |
| flarum-sticky                        | v1.8.0  |        |
| fof-formatting                       | 1.0.3   |        |
| fof-merge-discussions                | 1.4.1   |        |
| flarum-nicknames                     | v1.8.0  |        |
| flarum-lock                          | v1.8.0  |        |
| afrux-forum-widgets-core             | v0.1.7  |        |
| fof-user-directory                   | 1.3.3   |        |
| fof-follow-tags                      | 1.2.6   |        |
| fof-byobu                            | 1.3.6   |        |
| ziiven-post-number                   | v0.1.4  |        |
| xrh0905-oauth-microsoft              | v1.0.1  |        |
| webbinaro-calendar                   | 1.7.0   |        |
| v17development-user-badges           | v1.1.0  |        |
| v17development-seo                   | v1.8.1  |        |
| therealsujitk-gifs                   | v4.1.1  |        |
| the-turk-stickiest                   | 3.0.1   |        |
| the-turk-flamoji                     | 1.0.4   |        |
| the-turk-diff                        | 1.1.2   |        |
| sycho-profile-cover                  | v1.3.5  |        |
| sycho-move-posts                     | v0.1.7  |        |
| sycho-lite-youtube                   | v0.1.1  |        |
| ramesh-dada-bbcode-alerts            | 6.21    |        |
| miniflar-bbcode-progress-bars        | 1.0.1   |        |
| migratetoflarum-canonical            | 1.0.0   |        |
| michaelbelgium-discussion-views      | v7.3    |        |
| matteocontrini-imgur-upload          | v3.9.1  |        |
| malago-achievements                  | 0.5.6   |        |
| kilowhat-audit-free                  | 1.7.0   |        |
| katosdev-signature                   | 1.6     |        |
| justoverclock-youtube-video-feed     | 0.1.2   |        |
| justoverclock-welcomebox             | 2.0.2   |        |
| justoverclock-hashtag                | 1.0.1   |        |
| justoverclock-contactme              | 0.2.3   |        |
| irmmr-rtl                            | V0.1.4  |        |
| ianm-follow-users                    | 1.4.8   |        |
| glowingblue-password-strength        | 4.0.0   |        |
| fof-username-request                 | 1.2.4   |        |
| fof-user-bio                         | 1.4.0   |        |
| fof-upload                           | 1.5.5   |        |
| fof-subscribed                       | 1.1.4   |        |
| fof-split                            | 1.1.1   |        |
| fof-socialprofile                    | 1.1.6   |        |
| fof-share-social                     | 1.2.0   |        |
| fof-nightmode                        | 1.5.3   |        |
| fof-links                            | 1.2.3   |        |
| fof-linguist                         | 1.1.2   |        |
| fof-gamification                     | 1.6.7   |        |
| fof-forum-statistics-widget          | 1.2.1   |        |
| fof-drafts                           | 1.2.10  |        |
| fof-disposable-emails                | 1.0.0   |        |
| fof-default-user-preferences         | 1.2.1   |        |
| fof-default-group                    | 1.1.2   |        |
| fof-best-answer                      | 1.4.5   |        |
| fof-bbcode-tabs                      | 1.0.3   |        |
| fof-ban-ips                          | 1.1.1   |        |
| fof-analytics                        | 1.1.0   |        |
| flarum-statistics                    | v1.8.0  |        |
| flarum-likes                         | v1.8.0  |        |
| flarum-lang-arabic                   | v0.2.1  |        |
| flarum-embed                         | v1.8.0  |        |
| flarum-bbcode                        | v1.8.0  |        |
| ffans-clipboardjs                    | v1.0.0  |        |
| datlechin-signup-button              | v0.1.1  |        |
| datlechin-posted-on                  | v0.2.1  |        |
| datlechin-keyboard-shortcuts         | v0.1.1  |        |
| datlechin-chatgpt                    | v0.4.0  |        |
| clarkwinkelmann-status               | 1.0.0   |        |
| clarkwinkelmann-shadow-ban           | 1.1.0   |        |
| clarkwinkelmann-post-permissions     | 1.0.0   |        |
| clarkwinkelmann-group-list           | 1.0.0   |        |
| clarkwinkelmann-group-invitation     | 1.0.2   |        |
| clarkwinkelmann-first-post-approval  | 1.0.1   |        |
| clarkwinkelmann-discussion-bookmarks | 2.0.1   |        |
| clarkwinkelmann-circle-groups        | 1.0.1   |        |
| clarkwinkelmann-author-change        | 1.0.3   |        |
| blomstra-welcome-login               | 0.1.0   |        |
| blomstra-mark-unread                 | 0.2.0   |        |
| blomstra-fontawesome                 | 0.1.5   |        |
| askvortsov-rich-text                 | v2.1.7  |        |
| askvortsov-pwa                       | v3.4.0  |        |
| askvortsov-moderator-warnings        | v0.6.3  |        |
| askvortsov-help-tags                 | v1.1.0  |        |
| askvortsov-checklist                 | v1.3.1  |        |
| antoinefr-bbcode-fa                  | v1.0.0  |        |
| afrux-news-widget                    | v0.1.1  |        |
| acpl-mobile-tab                      | 1.4.4   |        |
+--------------------------------------+---------+--------+
Base URL: https://foro.arsoporte.com
Installation path: /data/host/arsoporte
Queue driver: sync
Session driver: file
Scheduler status: Never run
Mail driver: mail
Debug mode: off

FYI nothing relevant in the error logs

medelinor

luceos I don’t know if I understood the response correctly because I’m using a translation, but I would like to point out that those affected were not all members of a specific group, for example, group “A” has ten members, 3 of whom were affected and the same thing happened to one of them repeatedly, and what I noticed is that his activity in the forum is high, so he publishes posts and writes replies and interacts, and he does not have an administrative badge.

What I’m thinking now is that it is possible that the extension that automatically grants badges to members gets confused when it finds that a member with a badge has not yet reached the required number of points to obtain the badge or vice versa, something like that.

medelinor

luceos Note: A member contacted me a little while ago saying that his badge was gone, and when I went back to the log it turned out that I had removed the badges from his account an hour ago, which I definitely didn’t.

medelinor

@luceos My forum is connected to Microsoft Clarity, I will go back to the registry and match the time I removed the member badges and share the registration link with you.

I hope this doesn’t take too long

medelinor

medelinor Unfortunately, I found that I was blocking my computer’s IP address from session recordings.

luceos

You mention an extension giving automatic badges. Which one is that?
I see you use oauth (Microsoft among others), can you ask the impacted user how they logged on. The oauth extension in question might also remove badges and no one would know.

medelinor

luceos I mean FoF Gamification extension:

luceos I see you use oauth (Microsoft among others)

I’m still working on the Log In With Microsoft extension, so it’s not configured with the “FoF OAuth” extension, and as far as I know, it won’t show people that they’re signing in with Microsoft.

And just to note, I’ve disabled it now.

luceos

There’s two badges starting at 1500 is that intended?

medelinor

luceos No, that’s not intentional.

medelinor

Even after fixing the issue with the numbers, I would like to point out that the issue occurred again 15 minutes ago.

medelinor

Note: I noticed a while ago that one of those badges that was disappearing, did not appear in the badge list when I wanted to invite members of that group to a post.

Before I started writing this second paragraph, I tested a callback for all badge sets, and all badge sets showed up except one badge (fas fa-vial)

I think I can delete this particular badge and create a new exact copy of it. But I wanted to share the case here, maybe some Flarom forum admin will come across it one day.

Despite my lack of programming knowledge, I am pretty sure that this badge is the reason for its disappearance and the disappearance of the badges that accompanied it on members’ profiles, and a closer look at this badge will reveal the reason behind all this problem.

Best regards