Protected Data Fields are rendered via Populate.
tkalmar opened this issue · comments
Describe the bug
Protected Components should not be rendered in GET Requests (like Password). But when i use:
https://formio.form.io/user/login?populate=owner
i clearly see the password field of the owner
Version/Branch
Latest
To Reproduce
Steps to reproduce the behavior:
call: https://formio.form.io/user/login?populate=owner
the owner property gets populated including protected fields.
Expected behavior
protected fields are not populated
Additional context
Similar Bug was #531 but marked as closed
Thanks for reporting this. We will investigate this further.
For internal reference I have created a ticket: FIO-8231