security fix for op=digestTest

diff --git a/backend.php b/backend.php
index 74cc973036e6e2caa0415b7f881d9d89308d359f..430086bf3862706d1cfaeae48b565bcee1780773 100644 (file)
--- a/backend.php
+++ b/backend.php
@@ -3946,6 +3946,7 @@
 
        if ($op == "digestTest") {
                header("Content-Type: text/plain");
+
                echo prepare_headlines_digest($link, $_SESSION["uid"]);
                $print_exec_time = false;
 

diff --git a/functions.php b/functions.php
index 7ec46f097f987543c4e69e6647afd733f9ef54db..3dbe0f84b0fec57eab3355896578174af8c9333e 100644 (file)
--- a/functions.php
+++ b/functions.php
@@ -2398,6 +2398,7 @@
                        WHERE 
                                ref_id = ttrss_entries.id AND feed_id = ttrss_feeds.id 
                                AND $interval_query
+                               AND ttrss_user_entries.owner_uid = $user_id
                                AND unread = true ORDER BY ttrss_feeds.title, date_entered DESC
                        LIMIT $limit");