From b30dc391e7d2a002c6889f89bcfdc1aa0bd4a12d Mon Sep 17 00:00:00 2001 From: Dan Poltawski Date: Wed, 6 Jun 2012 23:28:52 +0800 Subject: [PATCH 1/2] MDL-33514 - rss: only retrieve RSS feeds for valid users --- lib/rsslib.php | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/lib/rsslib.php b/lib/rsslib.php index 01ac161659d..81a5afbae21 100644 --- a/lib/rsslib.php +++ b/lib/rsslib.php @@ -402,11 +402,12 @@ function rss_geterrorxmlfile($errortype = 'rsserror') { */ function rss_get_userid_from_token($token) { global $DB; - $record = $DB->get_record('user_private_key', array('script'=>'rss','value' => $token), 'userid', IGNORE_MISSING); - if ($record) { - return $record->userid; - } - return null; + + $sql = 'SELECT u.id FROM {user} u + JOIN {user_private_key} k ON u.id = k.userid + WHERE u.deleted = 0 AND u.confirmed = 1 + AND k.value = ?'; + return $DB->get_field_sql($sql, array($token), IGNORE_MISSING); } /** From 85aec6a4a2aa36e0031aa19fcbe0275172167520 Mon Sep 17 00:00:00 2001 From: Dan Poltawski Date: Mon, 11 Jun 2012 10:26:29 +0800 Subject: [PATCH 2/2] MDL-33514 - rss: also exclude suspended users feeds Thanks Petr! --- lib/rsslib.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/rsslib.php b/lib/rsslib.php index 81a5afbae21..761109e3aad 100644 --- a/lib/rsslib.php +++ b/lib/rsslib.php @@ -406,7 +406,7 @@ function rss_get_userid_from_token($token) { $sql = 'SELECT u.id FROM {user} u JOIN {user_private_key} k ON u.id = k.userid WHERE u.deleted = 0 AND u.confirmed = 1 - AND k.value = ?'; + AND u.suspended = 0 AND k.value = ?'; return $DB->get_field_sql($sql, array($token), IGNORE_MISSING); }