Description

Any user who can publish their article can protect it using a password before publishing. So, a valid password to the article is required to view the contents of the article. But when a request is made to article /2022/04/10/<article-title> the UI show it requires a password to view content. But the content of the article is leaked in meta tags of the response.

Proof of Concept

Steps to Reproduce:

1. Login to app as Admin and create an article and protect it with a password and publish it
2. Now, login as a demo user and navigate to the newly published article. You can see the UI shows it requires a password to view.
3. But the content of the article is already leaked in the meta tags of the response body