original-post

chris steipp requested that:

* in includes/Jobs/UploadMetadataJob.php, the variables put into the $_POST
  global state can be anything, since the whitelisting for MetadataMappingHandler
  is based on the templates, which are user-controlled. If you need arbitrary
  values to be input from the form, you need to use something other than $_POST
  to pass the state to the dependent objects.

Change-Id: Id2530e92ddf104161063b9a8b21964e6472b6ab6