[gibhut]

You can make a post to anyone's blog if you know their blog id

In journal.php there is an error in the Function.
on line 94

PHP Code:

function journalist_check($jid,$checkid)
{
    global $db;
    $check= $db->query_first("SELECT journalist_id FROM " . TABLE_PREFIX . "journals WHERE journal_id='".$jid."'");
    if($check['journalist_id']!=$checkid)
    {
        return "false";
    }
    else
    {
        return "true";
    }
} 


you are returning the string false and true. so the
!journalist_check will be bypassed. it needs to be

PHP Code:

function journalist_check($jid,$checkid)
{
    global $db;
    $check= $db->query_first("SELECT journalist_id FROM " . TABLE_PREFIX . "journals WHERE journal_id='".$jid."'");
    if($check['journalist_id']!=$checkid)
    {
        return false;
    }
    else
    {
        return true;
    }
}