Fix issue #238: possibilité d'actualiser avec token

En précisant le token il est possible maintenant d'actualiser les flux
sans avoir besoin de se connecter

1 files changed, 8 insertions, 1 deletions

diff --git a/app/controllers/feedController.php b/app/controllers/feedController.php
index 0fd362065..31bade9f5 100755
--- a/app/controllers/feedController.php
+++ b/app/controllers/feedController.php
@@ -2,7 +2,14 @@
 
 class feedController extends ActionController {
 	public function firstAction () {
-		if (login_is_conf ($this->view->conf) && !is_logged ()) {
+		$token = $this->view->conf->token();
+		$token_param = Request::param ('token', '');
+		$token_is_ok = ($token != '' && $token == $token_param);
+		$action = Request::actionName ();
+
+		if (login_is_conf ($this->view->conf) &&
+				!is_logged () &&
+				!($token_is_ok && $action == 'actualize')) {
 			Error::error (
 				403,
 				array ('error' => array (Translate::t ('access_denied')))