Stop visitors from writing to the live table.

save_data() trusted the action and id in the POST data. A visitor can
now only add a new story to the queue, and cannot delete.

get_data.lib.php

@@ -338,8 +338,10 @@ function which_table($move = FALSE, $action = 'read') {
   global $is_admin;
   $queue = get_queue();
 
-  // Editing
-  if ($action == 'delete' && $move && $is_admin) {
+  // Editing: a visitor can never write to the live table
+  if (!$is_admin && in_array($action, array('post', 'save', 'submit', 'delete'))) {
+    return 'queue';
+  } else if ($action == 'delete' && $move && $is_admin) {
     return 'queue';
   } else if ($action == 'post' && $is_admin) {
     return 'xxx';