From a7ca080c208fa10fb07158e2162f6afad64da655 Mon Sep 17 00:00:00 2001
From: Andrew Davis <andrew@affinitysoftware.net>
Date: Mon, 4 Oct 2010 07:13:09 +0000
Subject: [PATCH] rss MDLSITE-1007 processing the user token to make sure its a
 string and not an int to prevent bogus user matches occuring

---
 lib/rsslib.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/rsslib.php b/lib/rsslib.php
index 3159960e934..5e8d9936a06 100644
--- a/lib/rsslib.php
+++ b/lib/rsslib.php
@@ -346,7 +346,8 @@ function rss_geterrorxmlfile($errortype = 'rsserror') {
 
 function rss_get_userid_from_token($token) {
     global $DB;
-    $record = $DB->get_record('user_private_key', array('script'=>'rss','value' => $token), 'userid', IGNORE_MISSING);
+    //using strval() to make sure the token is a string not an int. Otherwise passing in numbers like 1 can cause lots of rows to match
+    $record = $DB->get_record('user_private_key', array('script'=>'rss','value' => strval($token)), 'userid', IGNORE_MISSING);
     if ($record) {
         return $record->userid;
     }