From fc9de939857feb3dc0b46e674464bc7e68a72130 Mon Sep 17 00:00:00 2001
From: Andrew Dolgov <fox@fakecake.org>
Date: Wed, 15 Aug 2012 19:34:50 +0400
Subject: [PATCH] add additional ownership checks to
 getfeedcounters/getcategorycounters

---
 include/functions.php | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/functions.php b/include/functions.php
index 41f6c9db5..0bb761f5d 100644
--- a/include/functions.php
+++ b/include/functions.php
@@ -1506,6 +1506,7 @@
 				WHERE c2.parent_cat = ttrss_feed_categories.id) AS num_children
 			FROM ttrss_feed_categories, ttrss_cat_counters_cache
 			WHERE ttrss_cat_counters_cache.feed_id = id AND
+			ttrss_cat_counters_cache.owner_uid = ttrss_feed_categories.owner_uid AND
 			ttrss_feed_categories.owner_uid = " . $_SESSION["uid"]);
 
 		while ($line = db_fetch_assoc($result)) {
@@ -1843,6 +1844,7 @@
 				last_error, value AS count
 			FROM ttrss_feeds, ttrss_counters_cache
 			WHERE ttrss_feeds.owner_uid = ".$_SESSION["uid"]."
+				AND ttrss_counters_cache.owner_uid = ttrss_feeds.owner_uid
 				AND ttrss_counters_cache.feed_id = id";
 
 		$result = db_query($link, $query);