Stop visitors from writing to the live table.

save_data() trusted the action and id in the POST data. A visitor can
now only add a new story to the queue, and cannot delete.

get_data.lib.php

@@ -338,8 +338,10 @@ function which_table($move = FALSE, $action = 'read') {
   global $is_admin;
   $queue = get_queue();
 
-  // Editing
+  // Editing: a visitor can never write to the live table
-  if ($action == 'delete' && $move && $is_admin) {
+  if (!$is_admin && in_array($action, array('post', 'save', 'submit', 'delete'))) {
+    return 'queue';
+  } else if ($action == 'delete' && $move && $is_admin) {
     return 'queue';
   } else if ($action == 'post' && $is_admin) {
     return 'xxx';

publish/post.lib.php

@@ -4,13 +4,6 @@ require_once('../get_data.lib.php');
 
 function save_data($id = NULL) {
   global $db, $is_admin, $queue, $action;
-  $queue = get_queue();
-  // Are we posting a story from the queue?
-  if ($queue && $action == 'post')
-    $move = TRUE;
-  else
-    $move = FALSE;
-  $table = which_table($move, $action);
   $image_file = FALSE;
   $queue_id   = NULL;
 
@@ -19,6 +12,25 @@ function save_data($id = NULL) {
   // assign their keys and values to the symbol table
   extract($result[0], EXTR_OVERWRITE);
 
+  // Visitors can only add a new story to the queue. They cannot pick the
+  // table, overwrite an existing story, or set editor-only fields.
+  if (!$is_admin) {
+    $action   = 'submit';
+    $id       = NULL;
+    $date     = NULL;
+    $hidden   = NULL;
+    $comments = NULL;
+    $editor   = 'original author';
+  }
+
+  $queue = get_queue();
+  // Are we posting a story from the queue?
+  if ($is_admin && $queue && $action == 'post')
+    $move = TRUE;
+  else
+    $move = FALSE;
+  $table = which_table($move, $action);
+
   // Process data...
   $story = sanitise($story);
   // Add the date if it's not got one
@@ -116,6 +128,9 @@ function save_data($id = NULL) {
 
 function delete_story($id, $move = FALSE) {
   global $db, $is_admin, $queue;
+  // Only editors can delete stories
+  if (!$is_admin)
+    return '';
   $queue = get_queue();
   $table = which_table($move, 'delete');