Post-Python 3: mod/submitlinkreview.py doesn't validate title_id's existence. It checks that "title_id" in the submitted form exists and is numeric, but if the HTML form is crafted to have a title_id value that doesn't correspond to a valid title, the script will error out on line 66 after it get an empty "title" tuple from SQLloadTitle on line 65.
In addition, mod/submitlinkreview.py should confirm that the loaded "title" tuple's title type is REVIEW.
Anonymous