{"action":"created","issue":{"url":"https://api.github.com/repos/contao/core/issues/8149","repository_url":"https://api.github.com/repos/contao/core","labels_url":"https://api.github.com/repos/contao/core/issues/8149/labels{/name}","comments_url":"https://api.github.com/repos/contao/core/issues/8149/comments","events_url":"https://api.github.com/repos/contao/core/issues/8149/events","html_url":"https://github.com/contao/core/issues/8149","id":120610203,"number":8149,"title":"Front end preview as non-admin bypasses protection","user":{"login":"asaage","id":4138336,"avatar_url":"https://avatars.githubusercontent.com/u/4138336?v=3","gravatar_id":"","url":"https://api.github.com/users/asaage","html_url":"https://github.com/asaage","followers_url":"https://api.github.com/users/asaage/followers","following_url":"https://api.github.com/users/asaage/following{/other_user}","gists_url":"https://api.github.com/users/asaage/gists{/gist_id}","starred_url":"https://api.github.com/users/asaage/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/asaage/subscriptions","organizations_url":"https://api.github.com/users/asaage/orgs","repos_url":"https://api.github.com/users/asaage/repos","events_url":"https://api.github.com/users/asaage/events{/privacy}","received_events_url":"https://api.github.com/users/asaage/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":12,"created_at":"2015-12-06T05:50:57Z","updated_at":"2016-04-18T07:01:09Z","closed_at":null,"body":"![image](https://cloud.githubusercontent.com/assets/4138336/11611841/2600a8f8-9be2-11e5-8dd3-65d33ee4ec72.png)\r\nThat might be a duplicate of #567 but as that was closed 4 years ago without solution **i suggest to change at least the wording**.\r\nNot only does that selection allow to show unpublished elements but also protected elements and pages.\r\nIn my use-case that's definitely a security issue - so i am going to disable the Frontendpreview completely for non-admin BE-users.\r\nAny Info on that for contao4 is appreciated."},"comment":{"url":"https://api.github.com/repos/contao/core/issues/comments/211233972","html_url":"https://github.com/contao/core/issues/8149#issuecomment-211233972","issue_url":"https://api.github.com/repos/contao/core/issues/8149","id":211233972,"user":{"login":"aschempp","id":1073273,"avatar_url":"https://avatars.githubusercontent.com/u/1073273?v=3","gravatar_id":"","url":"https://api.github.com/users/aschempp","html_url":"https://github.com/aschempp","followers_url":"https://api.github.com/users/aschempp/followers","following_url":"https://api.github.com/users/aschempp/following{/other_user}","gists_url":"https://api.github.com/users/aschempp/gists{/gist_id}","starred_url":"https://api.github.com/users/aschempp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aschempp/subscriptions","organizations_url":"https://api.github.com/users/aschempp/orgs","repos_url":"https://api.github.com/users/aschempp/repos","events_url":"https://api.github.com/users/aschempp/events{/privacy}","received_events_url":"https://api.github.com/users/aschempp/received_events","type":"User","site_admin":false},"created_at":"2016-04-18T07:01:08Z","updated_at":"2016-04-18T07:01:08Z","body":"I think the suggestion is valid, but hard to change because people are very used to it\r\n 1. Change `BE_USER_LOGGED_IN` to not change frontend access permission (only publishing).\r\n 2. Only allow frontend user login if the backend user has access to `tl_member`\r\n\r\nSo if you want to see certain frontend pages you need to login as that user. That's actually why there is such an option, because I usually login as a user but do not show unpublished content..."}}