SiYuan: The Publish Filter For Database Backlinks Consults The Forbidden List Instead Of The Visibility List, Disclosing

Summary "/api/av/getAttributeViewBacklinks" filters its results for reader roles through "FilterAttributeViewBacklinksByPublishAccess". That function resolves its ignore list with "GetDisablePublishAccess", which covers only the forbidden tier. Documents at the hidden tier are absent from that...