Possible security hole in submitting answers

[Matthew Wilkes]

Hi all,

I was just reading your code, specifically getSurveyId. The line:

user_id = request.form['survey_user_id']

Looks to me like it allows anyone to specify the user that submitted
the survey in a query string. I don't have time to do testing, I'm
afraid, as I don't use PloneSurvey, but it might be worth a look.

Matt