From 1f16f9b8ae77bcd2f3610f6e6e44bd2a24d3a660 Mon Sep 17 00:00:00 2001 From: Andrew Dolgov Date: Sun, 3 Dec 2017 13:35:18 +0300 Subject: [PATCH] feed debugger: only allow debugging users own feeds --- classes/feeds.php | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/classes/feeds.php b/classes/feeds.php index 30d26f36..95987f73 100755 --- a/classes/feeds.php +++ b/classes/feeds.php @@ -1195,6 +1195,14 @@ class Feeds extends Handler_Protected { @$do_update = $_REQUEST["action"] == "do_update"; $csrf_token = $_REQUEST["csrf_token"]; + $sth = $this->pdo->prepare("SELECT id FROM ttrss_feeds WHERE id = ? AND owner_uid = ?"); + $sth->execute([$feed_id, $_SESSION['uid']]); + + if (!$sth->fetch()) { + print "Access denied."; + return; + } + $refetch_checked = isset($_REQUEST["force_refetch"]) ? "checked" : ""; $rehash_checked = isset($_REQUEST["force_rehash"]) ? "checked" : ""; -- 2.39.5