{"action":"created","issue":{"url":"https://api.github.com/repos/contao/core/issues/8149","labels_url":"https://api.github.com/repos/contao/core/issues/8149/labels{/name}","comments_url":"https://api.github.com/repos/contao/core/issues/8149/comments","events_url":"https://api.github.com/repos/contao/core/issues/8149/events","html_url":"https://github.com/contao/core/issues/8149","id":120610203,"number":8149,"title":"Front end preview as non-admin bypasses protection","user":{"login":"asaage","id":4138336,"avatar_url":"https://avatars.githubusercontent.com/u/4138336?v=3","gravatar_id":"","url":"https://api.github.com/users/asaage","html_url":"https://github.com/asaage","followers_url":"https://api.github.com/users/asaage/followers","following_url":"https://api.github.com/users/asaage/following{/other_user}","gists_url":"https://api.github.com/users/asaage/gists{/gist_id}","starred_url":"https://api.github.com/users/asaage/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/asaage/subscriptions","organizations_url":"https://api.github.com/users/asaage/orgs","repos_url":"https://api.github.com/users/asaage/repos","events_url":"https://api.github.com/users/asaage/events{/privacy}","received_events_url":"https://api.github.com/users/asaage/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2015-12-06T05:50:57Z","updated_at":"2015-12-06T21:33:42Z","closed_at":null,"body":"![image](https://cloud.githubusercontent.com/assets/4138336/11611841/2600a8f8-9be2-11e5-8dd3-65d33ee4ec72.png)\r\nThat might be a duplicate of #567 but as that was closed 4 years ago without solution **i suggest to change at least the wording**.\r\nNot only does that selection allow to show unpublished elements but also protected elements and pages.\r\nIn my use-case that's definitely a security issue - so i am going to disable the Frontendpreview completely for non-admin BE-users.\r\nAny Info on that for contao4 is appreciated."},"comment":{"url":"https://api.github.com/repos/contao/core/issues/comments/162349405","html_url":"https://github.com/contao/core/issues/8149#issuecomment-162349405","issue_url":"https://api.github.com/repos/contao/core/issues/8149","id":162349405,"user":{"login":"asaage","id":4138336,"avatar_url":"https://avatars.githubusercontent.com/u/4138336?v=3","gravatar_id":"","url":"https://api.github.com/users/asaage","html_url":"https://github.com/asaage","followers_url":"https://api.github.com/users/asaage/followers","following_url":"https://api.github.com/users/asaage/following{/other_user}","gists_url":"https://api.github.com/users/asaage/gists{/gist_id}","starred_url":"https://api.github.com/users/asaage/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/asaage/subscriptions","organizations_url":"https://api.github.com/users/asaage/orgs","repos_url":"https://api.github.com/users/asaage/repos","events_url":"https://api.github.com/users/asaage/events{/privacy}","received_events_url":"https://api.github.com/users/asaage/received_events","type":"User","site_admin":false},"created_at":"2015-12-06T21:33:42Z","updated_at":"2015-12-06T21:33:42Z","body":">he cannot view the frontend as any frontend user.\r\nthat is right.\r\nbut he can show the hidden elements (which are in fact the hidden and the protected ones)...\r\n\r\nmaybe i'm going to investigate more on that tomorrow.\r\n"}}