public/tt-rss
1
0
Fork 0
mirror of https://git.tt-rss.org/git/tt-rss.git synced 2025-12-13 17:45:55 +00:00
Code Issues Releases Wiki Activity

replace old-style published feed with universal secretkey-based approach used for all feeds; do not allow user/pass handling in generated feed urls; bump schema

Browse Source
This commit is contained in:
Andrew Dolgov
2010-11-08 13:11:56 +03:00
parent 811bea0522
commit 8801fb017c
12 changed files with 226 additions and 137 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
backend.php
View File

@@ -466,31 +466,10 @@
module_pref_feed_browser($link);
break; // pref-feed-browser
case "publish":
$key = db_escape_string($_REQUEST["key"]);
$limit = (int)db_escape_string($_REQUEST["limit"]);
$result = db_query($link, "SELECT login, owner_uid
FROM ttrss_user_prefs, ttrss_users WHERE
pref_name = '_PREFS_PUBLISH_KEY' AND
value = '$key' AND
ttrss_users.id = owner_uid");
if (db_num_rows($result) == 1) {
$owner = db_fetch_result($result, 0, "owner_uid");
$login = db_fetch_result($result, 0, "login");
generate_syndicated_feed($link, $owner, -2, false, $limit);
} else {
print "<error>User not found</error>";
}
break; // publish
case "rss":
$feed = db_escape_string($_REQUEST["id"]);
$user = db_escape_string($_REQUEST["user"]);
$pass = db_escape_string($_REQUEST["pass"]);
$key = db_escape_string($_REQUEST["key"]);
$is_cat = $_REQUEST["is_cat"] != false;
$limit = (int)db_escape_string($_REQUEST["limit"]);
@@ -503,8 +482,13 @@
authenticate_user($link, "admin", null);
}
if (!$_SESSION["uid"] && $user && $pass) {
authenticate_user($link, $user, $pass);
if ($key && !$_SESSION["uid"]) {
$result = db_query($link, "SELECT owner_uid FROM
ttrss_access_keys WHERE access_key = '$key' AND feed_id = '$feed'");
if (db_num_rows($result) == 1)
$_SESSION["uid"] = db_fetch_result($result, 0, "owner_uid");
}
if ($_SESSION["uid"] || http_authenticate_user($link)) {