Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.I just had an idea about a module to perform a paranoia audit trail of everything that is happening on the site in terms of changes: Simple log of all form submissions with uid, hostname, form id and form values. Maybe something similar to Macro from Devel module.
Using this module, it would be very easy to create an audit trail of all form submits on the site (with a whitelist?). I got this idea when analyzing a situation where it appears that one of employees of our customer is changing random content on the site and is blaming us for suddenly missing values. We were able to identify him from apache access log using his IP address compared to sessions but we don't have a means to actuallyprove he changed particular data.
Implementation should be pretty straightforward since it might only require a separate submit callback for ALL forms. Question - how it will affect performance.
I am posting here before I do any implementation because it seems it might make sense to integrate this with paranoia module, instead of creating my own.
Any followups? Questions? Ideas? :)
| Comment | File | Size | Author |
|---|---|---|---|
| #1 | paranoia.install.txt | 1.06 KB | meba |
| #1 | paranoia.module.txt | 450 bytes | meba |
Comments
Comment #1
meba commentedProof of concept module (no patch yet)
Comment #2
boris mann commentedSimilar to Journal - http://drupal.org/project/journal - you might want to make a small paranoia_journal module that transparently logs everything using journal.
Comment #3
gregglesI agree on all the ideas here. I just came looking for a module to do this and was going to add a feature request to paranoia.
One point is that we need to make sure we don't log things like passwords or credit cards or...any other sensitive data.
Comment #4
gerhard killesreiter commentedI've wanted something like this for a long time. I haven't used journal yet, although it sounds very intersting.
Comment #5
coltraneI think we need a system that's comprehensive for core but is extendable to other modules. Capturing form submits is certainly comprehensive, but are there cases it would miss? And we certainly need to be careful about what data is being saved. Is Paranoia the right place for this system?
Comment #6
meba commentedAs I wrote earlier, I built this to get a trail of a rogue employee. I can help extending this further. We can get inspiration from latest Mollom vulnerability? #912412: SA-CONTRIB-2010-091 - Mollom - Information Disclosure
Comment #7
gregglesYes, we definitely want to avoid saving things like a password field into the log.
Comment #8
gregglesI think this shouldn't be done in paranoia. Journal may have bugs or may not work (right now) the way a paranoid site admin wants, but effort can go into making it work better. If the maintainer is philosophically opposed to something then this can be re-opened.
Anyway, it's been 1.5+ years with no action on this so it seems people aren't truly passionate about it in paranoia.
Comment #9
gregglesA similar module has been started - http://drupal.org/project/audit-trail
I filed #1709402: Clarify how this differs from similar modules (or join forces) to track how they differ, but this makes me feel more strongly that this issue can be "won't fixed."