ApostropheCMS: Unauthenticated PublicApiProjection Bypass Via Search And Sort Query Builders In The Public REST API

Summary ApostropheCMS lets a module expose an anonymous read API by setting "publicApiProjection", which whitelists the document fields unauthenticated callers may see. The public REST GET handler applies every launderable query builder from the query string before forcing that projection. Two of...