From 331de0b54626e4b124cd8c1ca3872242ffd00a12 Mon Sep 17 00:00:00 2001
From: Dan Poltawski <dan@moodle.com>
Date: Wed, 6 Jun 2012 23:28:52 +0800
Subject: [PATCH] MDL-33514 - rss: only retrieve RSS feeds for valid users

---
 lib/rsslib.php | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/lib/rsslib.php b/lib/rsslib.php
index 15dd6eb2832..0e86245f33a 100644
--- a/lib/rsslib.php
+++ b/lib/rsslib.php
@@ -346,11 +346,12 @@ function rss_geterrorxmlfile($errortype = 'rsserror') {
 
 function rss_get_userid_from_token($token) {
     global $DB;
-    $record = $DB->get_record('user_private_key', array('script'=>'rss','value' => $token), 'userid', IGNORE_MISSING);
-    if ($record) {
-        return $record->userid;
-    }
-    return null;
+
+    $sql = 'SELECT u.id FROM {user} u
+            JOIN {user_private_key} k ON u.id = k.userid
+            WHERE u.deleted = 0 AND u.confirmed = 1
+            AND k.value = ?';
+    return $DB->get_field_sql($sql, array($token), IGNORE_MISSING);
 }
 
 function rss_get_token($userid) {