fix: missing authentication check (#133)

docs: add security policy

endpoints/payments/payment.php

@@ -17,7 +17,12 @@ if (!isset($_GET['paymentId']) || !isset($_GET['enabled'])) {
 
 $paymentId = $_GET['paymentId'];
 
-$inUse = $db->querySingle('SELECT COUNT(*) as count FROM subscriptions WHERE payment_method_id=' . $paymentId) === 1;
+$stmt = $db->prepare('SELECT COUNT(*) as count FROM subscriptions WHERE payment_method_id=:paymentId');
+$stmt->bindValue(':paymentId', $paymentId, SQLITE3_INTEGER);
+$result = $stmt->execute();
+$row = $result->fetchArray();
+$inUse = $row['count'] === 1;
+
 if ($inUse) {
     die(json_encode([
         "success" => false,

endpoints/subscriptions/export.php

@@ -4,6 +4,13 @@ require_once '../../includes/connect_endpoint.php';
 
 session_start();
 
+if (!isset($_SESSION['loggedin']) || $_SESSION['loggedin'] !== true) {
+    die(json_encode([
+        "success" => false,
+        "message" => translate('session_expired', $i18n)
+    ]));
+}
+
 require_once '../../includes/getdbkeys.php';
 
 $query = "SELECT * FROM subscriptions";