public-mirrors/NewsBlur-viq
1
0
Fork 0
mirror of https://github.com/viq/NewsBlur.git synced 2025-08-05 16:49:45 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #1817 from aladh/patch-1

Browse source 
Prevent unauthorized access to feeds with a single subscriber
This commit is contained in:
Samuel Clay 2023-11-07 20:37:27 -05:00 • committed by GitHub
commit 67b1041401
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
apps/reader/views.py
View file

@ -672,6 +672,10 @@ def load_single_feed(request, feed_id):
# User must be subscribed to a newsletter in order to read it # User must be subscribed to a newsletter in order to read it
raise Http404 raise Http404
if feed.num_subscribers = 1 and not usersub:
# This feed could be private so user must be subscribed in order to read it
raise Http404
if page > 400: if page > 400:
logging.user(request, "~BR~FK~SBOver page 400 on single feed: %s" % page) logging.user(request, "~BR~FK~SBOver page 400 on single feed: %s" % page)
assert False assert False