Collections with Draft Versions cannot be Access filtered when they have Hidden Fields about payload HOT 4 CLOSED

Hey @mckinley — this is an interesting find. We do indeed restrict querying on fields unless you have public access to the field because this prevents security vulnerabilities. But I guess that if field queries are passed via access control, querying on those fields does not present a security vuln because your backend code is what's responsible for filtering on them and you define them.

It's possible that we could resolve this. @kendelljoseph let's look into this!

from payload.

@mckinley we've dug into this a bit and here is what we're thinking.

We don't want to introduce any security risks by adding a flag that would allow for a field that is hidden to behave differently via the API and the local API. Any flag that partially change access behavior is too subtle and could have catastrophic behaviors.

Options we think could be used as an alternative to this approach:

• use an afterRead hook.
• the doc is available in the read access function where data can be passed and used by the to determine access conditions.

from payload.

Thanks so much @kendelljoseph. Ok I had put my payload project on hold for a bit, but when I jump back in Ill continue to see if there is anything I can do to work around the problem.

Thanks again!

from payload.

This issue has been automatically locked.
Please open a new issue if this issue persists with any additional detail.

from payload.