backend/pubsub: better 404 handling, do not cause PHP warning when invalid feed id...

[tt-rss.git] / backend.php

diff --git a/backend.php b/backend.php
index c4edd92eaa62849aa5f92a60e4fffd4f64d1a076..113c2832e05c6c84b706e79b400f52e4e0f1f041 100644 (file)
--- a/backend.php
+++ b/backend.php
@@ -62,8 +62,14 @@
                        $op != "rss" && $op != "getUnread" && $op != "getProfiles" &&
                        $op != "fbexport" && $op != "logout" && $op != "pubsub") {
 
-               header("Content-Type: text/plain");
-               print json_encode(array("error" => array("code" => 6)));
+               if ($op == 'pref-feeds' && $_REQUEST['subop'] == 'add') {
+                       header("Content-Type: text/html");
+                       login_sequence($link);
+                       render_login_form($link);
+               } else {
+                       header("Content-Type: text/plain");
+                       print json_encode(array("error" => array("code" => 6)));
+               }
                return;
        }
 
@@ -181,7 +187,8 @@
                        $id = db_escape_string($_REQUEST['id']);
 
                        $result = db_query($link, "SELECT link FROM ttrss_entries, ttrss_user_entries
-                               WHERE id = '$id' AND id = ref_id AND owner_uid = '".$_SESSION['uid']."'");
+                               WHERE id = '$id' AND id = ref_id AND owner_uid = '".$_SESSION['uid']."'
+                               LIMIT 1");
 
                        if (db_num_rows($result) == 1) {
                                $article_url = db_fetch_result($result, 0, 'link');
@@ -546,34 +553,41 @@
                        $result = db_query($link, "SELECT feed_url FROM ttrss_feeds
                                WHERE id = '$feed_id'");
 
-                       $check_feed_url = db_fetch_result($result, 0, "feed_url");
+                       if (db_num_rows($result) != 0) {
 
-                       if ($check_feed_url && ($check_feed_url == $feed_url || !$feed_url)) {
-                               if ($mode == "subscribe") {
+                               $check_feed_url = db_fetch_result($result, 0, "feed_url");
 
-                                       db_query($link, "UPDATE ttrss_feeds SET pubsub_state = 2
-                                               WHERE id = '$feed_id'");
+                               if ($check_feed_url && ($check_feed_url == $feed_url || !$feed_url)) {
+                                       if ($mode == "subscribe") {
 
-                                       print $_REQUEST['hub_challenge'];
-                                       return;
+                                               db_query($link, "UPDATE ttrss_feeds SET pubsub_state = 2
+                                                       WHERE id = '$feed_id'");
 
-                               } else if ($mode == "unsubscribe") {
+                                               print $_REQUEST['hub_challenge'];
+                                               return;
 
-                                       db_query($link, "UPDATE ttrss_feeds SET pubsub_state = 0
-                                               WHERE id = '$feed_id'");
+                                       } else if ($mode == "unsubscribe") {
 
-                                       print $_REQUEST['hub_challenge'];
-                                       return;
+                                               db_query($link, "UPDATE ttrss_feeds SET pubsub_state = 0
+                                                       WHERE id = '$feed_id'");
+
+                                               print $_REQUEST['hub_challenge'];
+                                               return;
 
-                               } else if (!$mode) {
+                                       } else if (!$mode) {
 
-                                       // Received update ping, schedule feed update.
+                                               // Received update ping, schedule feed update.
 
-                                       update_rss_feed($link, $feed_id, true, true);
+                                               update_rss_feed($link, $feed_id, true, true);
 
+                                       }
+                               } else {
+                                       header('HTTP/1.0 404 Not Found');
+                                       echo "404 Not found";
                                }
                        } else {
                                header('HTTP/1.0 404 Not Found');
+                               echo "404 Not found";
                        }
 
                break; // pubsub
@@ -585,8 +599,7 @@
 
                case "fbexport":
 
-                       // TODO: change to _POST
-                       $access_key = db_escape_string($_REQUEST["key"]);
+                       $access_key = db_escape_string($_POST["key"]);
 
                        // TODO: rate limit checking using last_connected
                        $result = db_query($link, "SELECT id FROM ttrss_linked_instances
@@ -596,7 +609,7 @@
 
                                $instance_id = db_fetch_result($result, 0, "id");
 
-                               $result = db_query($link, "SELECT feed_url, title, subscribers
+                               $result = db_query($link, "SELECT feed_url, site_url, title, subscribers
                                        FROM ttrss_feedbrowser_cache ORDER BY subscribers DESC LIMIT 100");
 
                                $feeds = array();
@@ -605,7 +618,7 @@
                                        array_push($feeds, $line);
                                }
 
-                               db_query($link, "UPDATE ttrss_linked_instances SET last_connected = NOW(),
+                               db_query($link, "UPDATE ttrss_linked_instances SET
                                        last_status_in = 1 WHERE id = '$instance_id'");
 
                                print json_encode(array("feeds" => $feeds));