Like for old publicVariable _fnc_MP funcs there is still a BIG security lack. It's not possible to check who has called this function per remote. This allows script kiddies or even "hackers" to execute functions for other users. It would also obviate the player object as a param if I could get this by a hardcoded variable in the executed script.
My solution for this problem:
Add a hardcoded variable "_caller" or "_from" handled by the engine that can be accessed in the executed script. Content should be the executed player object. In case caller is server this should be a representative server object or just objNull. Alternatively the content could be the netID.