From: Colin Vidal <colin@cvidal.org>
Date: Sun, 14 Jan 2018 19:55:39 +0000 (+0100)
Subject: rpc: addfeed: gets login and pass only if need_auth is checked.
X-Git-Tag: 18.8~86^2
X-Git-Url: https://git.wh0rd.org/?p=tt-rss.git;a=commitdiff_plain;h=c217de557f172871e85472c4aa21651d32ae680e

rpc: addfeed: gets login and pass only if need_auth is checked.

Because of browser form auto-completion, the hidden field login and
password can be automatically filled when adding a feed. It would
enable feed authentication even if the user doesn't click on need_auth
button.
---

diff --git a/classes/rpc.php b/classes/rpc.php
index f8cf7a82..bd4337fb 100755
--- a/classes/rpc.php
+++ b/classes/rpc.php
@@ -97,8 +97,9 @@ class RPC extends Handler_Protected {
 	function addfeed() {
 		$feed = clean($_REQUEST['feed']);
 		$cat = clean($_REQUEST['cat']);
-		$login = clean($_REQUEST['login']);
-		$pass = trim(clean($_REQUEST['pass']));
+		$need_auth = isset($_REQUEST['need_auth']);
+		$login = $need_auth ? clean($_REQUEST['login']) : '';
+		$pass = $need_auth ? trim(clean($_REQUEST['pass'])) : '';
 
 		$rc = Feeds::subscribe_to_feed($feed, $cat, $login, $pass);