From c217de557f172871e85472c4aa21651d32ae680e Mon Sep 17 00:00:00 2001 From: Colin Vidal Date: Sun, 14 Jan 2018 20:55:39 +0100 Subject: [PATCH] rpc: addfeed: gets login and pass only if need_auth is checked. Because of browser form auto-completion, the hidden field login and password can be automatically filled when adding a feed. It would enable feed authentication even if the user doesn't click on need_auth button. --- classes/rpc.php | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/classes/rpc.php b/classes/rpc.php index f8cf7a82..bd4337fb 100755 --- a/classes/rpc.php +++ b/classes/rpc.php @@ -97,8 +97,9 @@ class RPC extends Handler_Protected { function addfeed() { $feed = clean($_REQUEST['feed']); $cat = clean($_REQUEST['cat']); - $login = clean($_REQUEST['login']); - $pass = trim(clean($_REQUEST['pass'])); + $need_auth = isset($_REQUEST['need_auth']); + $login = $need_auth ? clean($_REQUEST['login']) : ''; + $pass = $need_auth ? trim(clean($_REQUEST['pass'])) : ''; $rc = Feeds::subscribe_to_feed($feed, $cat, $login, $pass);