valvin
/
ttrss
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

rpc: addfeed: gets login and pass only if need_auth is checked. 

Because of browser form auto-completion, the hidden field login and
password can be automatically filled when adding a feed. It would
enable feed authentication even if the user doesn't click on need_auth
button.
This commit is contained in:
Colin Vidal 2018-01-14 20:55:39 +01:00
parent c30f5e1811
commit c217de557f
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
classes/rpc.php
View File

@ -97,8 +97,9 @@ class RPC extends Handler_Protected {
function addfeed() {
$feed = clean($_REQUEST['feed']);
$cat = clean($_REQUEST['cat']);
$login = clean($_REQUEST['login']);
$pass = trim(clean($_REQUEST['pass']));
$need_auth = isset($_REQUEST['need_auth']);
$login = $need_auth ? clean($_REQUEST['login']) : '';
$pass = $need_auth ? trim(clean($_REQUEST['pass'])) : '';
$rc = Feeds::subscribe_to_feed($feed, $cat, $login, $pass);