mcrider/ojs — comment on commit f701ad55991e1fe197611c7de4cb807ee3c807f4
File: pages/sectionEditor/SubmissionEditHandler.inc.php line 678
By asmecher:

OTOH it looks like you're missing the validate call, which means this is open to anyone to invoke (!!!)