Unpublished content accessible via front-end API

[technicallyerik]

Unpublished content is accessible to unauthenticated users via the front-end API.

curl -X GET "http://localhost/api/contents?status=draft" -H "accept: application/ld+json"

A user might have a draft news release, product launch, embargoed product review, etc they might not want a crafty user accessing before it's public.

Details

Question	Answer
Relevant Bolt Version	4.0-RC 15
Install type	Composer install
PHP version	7.3.9
Web server	Apache

Reproduction

Steps to reproduce

In your console, enter curl -X GET "http://localhost/api/contents?status=draft" -H "accept: application/ld+json"

(I assume the same is with the GraphQL endpoints)

Expected result

Only content with a published status is accessible with or without a status parameter when accessing the API as an unauthenticated user.

Actual result

Unpublished content can be accessed by unauthenticated users via the API.

[I-Valchev]

@technicallyerik thanks for the detailed issue.

A fix for this is in the pipeline. I think we'll sneak in your other PR #1296 before launch too.