From 25b488ed4ec191a8d53fe0182d544aec6f83d7a2 Mon Sep 17 00:00:00 2001
From: DariusIII <dkrisan@gmail.com>
Date: Mon, 8 Jun 2015 03:29:38 +0200
Subject: [PATCH] Update rss and user handling.

---
 newznab/controllers/BasePage.php | 14 ++++++++++----
 newznab/controllers/Users.php    | 28 +++++++++++++++++++++-------
 2 files changed, 31 insertions(+), 11 deletions(-)

diff --git a/newznab/controllers/BasePage.php b/newznab/controllers/BasePage.php
index db52445c7..fdad49494 100644
--- a/newznab/controllers/BasePage.php
+++ b/newznab/controllers/BasePage.php
@@ -145,8 +145,13 @@ class BasePage
 			if ($sab->integratedBool !== false && $sab->url != '' && $sab->apikey != '') {
 				$this->smarty->assign('sabapikeytype', $sab->apikeytype);
 			}
-			if ($this->userdata["role"] == Users::ROLE_ADMIN)
-				$this->smarty->assign('isadmin',"true");
+			switch ((int)$this->userdata['role']) {
+				case Users::ROLE_ADMIN:
+					$this->smarty->assign('isadmin', 'true');
+					break;
+				case Users::ROLE_MODERATOR:
+					$this->smarty->assign('ismod', 'true');
+			}
 
 			if ($this->userdata["hideads"] == "1")
 			{
@@ -159,8 +164,9 @@ class BasePage
 		}
 		else
 		{
-			$this->smarty->assign('isadmin',"false");
-			$this->smarty->assign('loggedin',"false");
+			$this->smarty->assign('isadmin', 'false');
+			$this->smarty->assign('ismod', 'false');
+			$this->smarty->assign('loggedin', 'false');
 			$this->floodCheck();
 			$this->handleCaptcha();
 
diff --git a/newznab/controllers/Users.php b/newznab/controllers/Users.php
index e28f1a0a4..4cead3cf0 100644
--- a/newznab/controllers/Users.php
+++ b/newznab/controllers/Users.php
@@ -404,12 +404,22 @@ class Users
 		$this->pdo->queryExec(sprintf("update users set grabs = grabs + %d where id = %d ", $num, $id));
 	}
 
-	public function getByIdAndRssToken($id, $rsstoken)
+	/**
+	 * Check if the user is in the database, and if their API key is good, return user data if so.
+	 *
+	 * @param int    $userID   ID of the user.
+	 * @param string $rssToken API key.
+	 *
+	 * @return bool|array
+	 */
+	public function getByIdAndRssToken($userID, $rssToken)
 	{
+		$user = $this->getById($userID);
+		if ($user === false) {
+			return false;
+		}
 
-		$res = $this->getById($id);
-
-		return ($res && $res["rsstoken"] == $rsstoken ? $res : null);
+		return ($user['rsstoken'] != $rssToken ? false : $user);
 	}
 
 	public function getById($id)
@@ -569,18 +579,22 @@ class Users
 		return $this->pdo->queryInsert($sql);
 	}
 
+	/**
+	 * Verify if the user is logged in.
+	 *
+	 * @return bool
+	 */
 	public function isLoggedIn()
 	{
 		if (isset($_SESSION['uid'])) {
 			return true;
-		} elseif (isset($_COOKIE['uid']) && isset($_COOKIE['idh'])) {
+		} else if (isset($_COOKIE['uid']) && isset($_COOKIE['idh'])) {
 			$u = $this->getById($_COOKIE['uid']);
 
-			if (($_COOKIE['idh'] == $this->hashSHA1($u["userseed"] . $_COOKIE['uid'])) && ($u["role"] != Users::ROLE_DISABLED)) {
+			if (($_COOKIE['idh'] == $this->hashSHA1($u["userseed"] . $_COOKIE['uid'])) && ($u["role"] != self::ROLE_DISABLED)) {
 				$this->login($_COOKIE['uid'], $_SERVER['REMOTE_ADDR']);
 			}
 		}
-
 		return isset($_SESSION['uid']);
 	}