blallo/tt-rss
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

security fixes in filter editor

Browse source
This commit is contained in:
Andrew Dolgov 2006-05-22 06:13:44 +01:00
parent 4220b0bddb
commit 9cd30721df
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
backend.php
View file

@ -2099,7 +2099,7 @@
$filter_id = db_escape_string($_GET["id"]);
$result = db_query($link,
"SELECT * FROM ttrss_filters WHERE id = '$filter_id'");
"SELECT * FROM ttrss_filters WHERE id = '$filter_id' AND owner_uid = " . $_SESSION["uid"]);
$reg_exp = htmlspecialchars(db_unescape_string(db_fetch_result($result, 0, "reg_exp")));
$filter_type = db_fetch_result($result, 0, "filter_type");
@ -2199,7 +2199,7 @@
feed_id = $feed_id,
action_id = '$action_id',
filter_type = '$filter_type'
WHERE id = '$filter_id'");
WHERE id = '$filter_id' AND owner_uid = " . $_SESSION["uid"]);
}
if ($subop == "remove") {
@ -2209,7 +2209,7 @@
$ids = split(",", db_escape_string($_GET["ids"]));
foreach ($ids as $id) {
db_query($link, "DELETE FROM ttrss_filters WHERE id = '$id'");
db_query($link, "DELETE FROM ttrss_filters WHERE id = '$id' AND owner_uid = ". $_SESSION["uid"]);
}
}