Personal Fund-raising Pages can be edited by anonymous users

Any personal fundraising page can by edited by anyone on the internet by adding "&action=update" to the URL. This is a serious vulnerability to spammers and other attackers.

For example :
http://sandbox.civicrm.org/civicrm/contribute/pcp/info?reset=1&id=1

Can be edited by anyone by using the URL :

http://sandbox.civicrm.org/civicrm/contribute/pcp/info?reset=1&id=1&action=update

Implementation
============
Permission to access the above URL is granted if:

• user has 'administer CiviCRM' permission

OR

• user is authenticated AND the user's contact ID = civicrm_pcp.contact_id (i.e. this is THEIR PCP)