From: Andrew Dolgov <noreply@fakecake.org>
Date: Sun, 3 Dec 2017 10:35:18 +0000 (+0300)
Subject: feed debugger: only allow debugging users own feeds
X-Git-Tag: 17.12~2
X-Git-Url: https://git.wh0rd.org/?a=commitdiff_plain;h=1f16f9b8ae77bcd2f3610f6e6e44bd2a24d3a660;p=tt-rss.git

feed debugger: only allow debugging users own feeds
---

diff --git a/classes/feeds.php b/classes/feeds.php
index 30d26f36..95987f73 100755
--- a/classes/feeds.php
+++ b/classes/feeds.php
@@ -1195,6 +1195,14 @@ class Feeds extends Handler_Protected {
 		@$do_update = $_REQUEST["action"] == "do_update";
 		$csrf_token = $_REQUEST["csrf_token"];
 
+		$sth = $this->pdo->prepare("SELECT id FROM ttrss_feeds WHERE id = ? AND owner_uid = ?");
+		$sth->execute([$feed_id, $_SESSION['uid']]);
+
+		if (!$sth->fetch()) {
+		    print "Access denied.";
+		    return;
+        }
+
 		$refetch_checked = isset($_REQUEST["force_refetch"]) ? "checked" : "";
 		$rehash_checked = isset($_REQUEST["force_rehash"]) ? "checked" : "";