add additional ownership checks to getfeedcounters/getcategorycounters

1 files changed, 2 insertions, 0 deletions

diff --git a/include/functions.php b/include/functions.php
index 41f6c9db5..0bb761f5d 100644
--- a/include/functions.php
+++ b/include/functions.php
@@ -1506,6 +1506,7 @@
 				WHERE c2.parent_cat = ttrss_feed_categories.id) AS num_children
 			FROM ttrss_feed_categories, ttrss_cat_counters_cache
 			WHERE ttrss_cat_counters_cache.feed_id = id AND
+			ttrss_cat_counters_cache.owner_uid = ttrss_feed_categories.owner_uid AND
 			ttrss_feed_categories.owner_uid = " . $_SESSION["uid"]);
 
 		while ($line = db_fetch_assoc($result)) {
@@ -1843,6 +1844,7 @@
 				last_error, value AS count
 			FROM ttrss_feeds, ttrss_counters_cache
 			WHERE ttrss_feeds.owner_uid = ".$_SESSION["uid"]."
+				AND ttrss_counters_cache.owner_uid = ttrss_feeds.owner_uid
 				AND ttrss_counters_cache.feed_id = id";
 
 		$result = db_query($link, $query);