From: Andrew Dolgov <noreply@fakecake.org>
Date: Sat, 23 Jan 2016 09:13:03 +0000 (+0300)
Subject: prevent frontend updating of feeds on view if open_basedir is set to prevent plugins... 
X-Git-Tag: 16.3~45
X-Git-Url: https://git.wh0rd.org/?a=commitdiff_plain;h=29c92d7b080152bfc8c60b90c185e2faab2a6bbb;p=tt-rss.git

prevent frontend updating of feeds on view if open_basedir is set to prevent plugins potentially not working correctly (i.e. if backend system has open_basedir disabled)
---

diff --git a/classes/api.php b/classes/api.php
index c3ea627f..9be04cff 100644
--- a/classes/api.php
+++ b/classes/api.php
@@ -416,7 +416,9 @@ class API extends Handler {
 
 		$feed_id = (int) $this->dbh->escape_string($_REQUEST["feed_id"]);
 
-		update_rss_feed($feed_id, true);
+		if (!ini_get("open_basedir")) {
+			update_rss_feed($feed_id, true);
+		}
 
 		$this->wrap(self::STATUS_OK, array("status" => "OK"));
 	}
diff --git a/classes/feeds.php b/classes/feeds.php
index eff66dda..cb1b032d 100755
--- a/classes/feeds.php
+++ b/classes/feeds.php
@@ -166,7 +166,7 @@ class Feeds extends Handler_Protected {
 
 		$method_split = explode(":", $method);
 
-		if ($method == "ForceUpdate" && $feed > 0 && is_numeric($feed)) {
+		if ($method == "ForceUpdate" && $feed > 0 && is_numeric($feed) && !ini_get("open_basedir")) {
 			// Update the feed if required with some basic flood control
 
 			$result = $this->dbh->query(