feed debugger: only allow debugging users own feeds

1 files changed, 8 insertions, 0 deletions

diff --git a/classes/feeds.php b/classes/feeds.php
index 30d26f361..95987f733 100755
--- a/classes/feeds.php
+++ b/classes/feeds.php
@@ -1195,6 +1195,14 @@ class Feeds extends Handler_Protected {
 		@$do_update = $_REQUEST["action"] == "do_update";
 		$csrf_token = $_REQUEST["csrf_token"];
 
+		$sth = $this->pdo->prepare("SELECT id FROM ttrss_feeds WHERE id = ? AND owner_uid = ?");
+		$sth->execute([$feed_id, $_SESSION['uid']]);
+
+		if (!$sth->fetch()) {
+		    print "Access denied.";
+		    return;
+        }
+
 		$refetch_checked = isset($_REQUEST["force_refetch"]) ? "checked" : "";
 		$rehash_checked = isset($_REQUEST["force_rehash"]) ? "checked" : "";