{"action":"closed","issue":{"url":"https://api.github.com/repos/documentcloud/documentcloud/issues/89","labels_url":"https://api.github.com/repos/documentcloud/documentcloud/issues/89/labels{/name}","comments_url":"https://api.github.com/repos/documentcloud/documentcloud/issues/89/comments","events_url":"https://api.github.com/repos/documentcloud/documentcloud/issues/89/events","html_url":"https://github.com/documentcloud/documentcloud/issues/89","id":30547207,"number":89,"title":"GET /api/search.json allows wrong passwords","user":{"login":"adamhooper","id":10812,"avatar_url":"https://avatars.githubusercontent.com/u/10812?v=3","gravatar_id":"","url":"https://api.github.com/users/adamhooper","html_url":"https://github.com/adamhooper","followers_url":"https://api.github.com/users/adamhooper/followers","following_url":"https://api.github.com/users/adamhooper/following{/other_user}","gists_url":"https://api.github.com/users/adamhooper/gists{/gist_id}","starred_url":"https://api.github.com/users/adamhooper/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adamhooper/subscriptions","organizations_url":"https://api.github.com/users/adamhooper/orgs","repos_url":"https://api.github.com/users/adamhooper/repos","events_url":"https://api.github.com/users/adamhooper/events{/privacy}","received_events_url":"https://api.github.com/users/adamhooper/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2014-03-31T20:38:49Z","updated_at":"2015-04-29T21:01:53Z","closed_at":"2015-04-29T21:01:53Z","body":"If I run this:\r\n\r\n    curl -v --basic \\\r\n          --user 'bad-username:bad-password' \\\r\n          'https://www.documentcloud.org/api/search.json?q=document:460983+document:460981+document:425480' \\\r\n          2>&1 | grep Status\r\n\r\nI see `Status=200`\r\n\r\nI expect `Status=403`\r\n\r\nThis causes a bug in Overview, https://www.pivotaltracker.com/story/show/67875438, which has no workaround. Here's the bug:\r\n\r\n1. (in DocumentCloud) select some private documents\r\n2. (in DocumentCloud) choose \"Analyze\" -> \"Analyze these documents in Overview\"\r\n3. (in Overview) enter the incorrect username or password\r\n\r\nAfter you enter a password, Overview tries the search. The search succeeds, even with the wrong password, but the search results are different (sometimes empty).\r\n\r\n`GET /api/projects.json` behaves as expected."}}