Protected Data Fields are rendered via Populate.

[tkalmar]

Describe the bug

Protected Components should not be rendered in GET Requests (like Password). But when i use:

https://formio.form.io/user/login?populate=owner

i clearly see the password field of the owner

Version/Branch
Latest

To Reproduce
Steps to reproduce the behavior:
call: https://formio.form.io/user/login?populate=owner
the owner property gets populated including protected fields.

Expected behavior
protected fields are not populated

Screenshots

Additional context
Similar Bug was #531 but marked as closed

[lane-formio]

Thanks for reporting this. We will investigate this further.

For internal reference I have created a ticket: FIO-8231