Security: Does AJAX Callback Check Which Blocks are Returned?

Hi again,

I was looking through the JS code, specifically, the data that is returned regarding the user settings. When the block data makes it to the server, it looks like there's no check to make sure that the returned blocks are part of the default page. I could be wrong, but it looks like someone could modify the DOM with data about other blocks in the system, and have them returned.

I haven't checked yet - but it seems possible...