Publisher Merge, specifically edit/ps_merge.py, doesn't verify that the submitted data is consistent. Inconsistencies can arise if the hidden "record" values in edit/pv_merge.py were tampered with. They are supposed to start with "record1", "record2", etc and go up to the maximum number of selected publisher records. If the submitter manipulates the HTML to use "record1", "record2" and "record" instead of "record 1", "record2" and "record3" and the values selected via radio buttons reference "3", it can create an invalid submission.
Anonymous