Security fix: any user can delete any feed

Regression introduced in commit 51fb949.

2 files changed, 7 insertions, 1 deletions

diff --git a/storage/feed.go b/storage/feed.go
index b3126ab8..5b571054 100644
--- a/storage/feed.go
+++ b/storage/feed.go
@@ -381,7 +381,7 @@ func (s *Storage) RemoveFeed(userID, feedID int64) error {
 		}
 	}
 
-	if _, err := s.db.Exec(`DELETE FROM feeds WHERE id=$1`, feedID); err != nil {
+	if _, err := s.db.Exec(`DELETE FROM feeds WHERE id=$1 AND user_id=$2`, feedID, userID); err != nil {
 		return fmt.Errorf(`store: unable to delete feed #%d: %v`, feedID, err)
 	}
 
diff --git a/ui/feed_remove.go b/ui/feed_remove.go
index c70d77a2..15d997d2 100644
--- a/ui/feed_remove.go
+++ b/ui/feed_remove.go
@@ -14,6 +14,12 @@ import (
 
 func (h *handler) removeFeed(w http.ResponseWriter, r *http.Request) {
 	feedID := request.RouteInt64Param(r, "feedID")
+
+	if !h.store.FeedExists(request.UserID(r), feedID) {
+		html.NotFound(w, r)
+		return
+	}
+
 	if err := h.store.RemoveFeed(request.UserID(r), feedID); err != nil {
 		html.ServerError(w, r, err)
 		return