Tighten up when disabled sites are included

craftcms · Oct 12, 2021 · e4165bd · e4165bd
1 parent ab65b36
commit e4165bd
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -14,6 +14,7 @@
 - Fixed a bug where entry drafts weren’t getting propagated to other sites automatically after a section’s Propagation Method setting was changed. ([#9944](https://github.com/craftcms/cms/issues/9944))
 - Fixed a bug where user indexes weren’t immediately showing changes to users’ activation/suspension states. ([#9947](https://github.com/craftcms/cms/issues/9947))
 - Fixed an element query performance issue. ([#9806](https://github.com/craftcms/cms/discussions/9806))
+- Fixed a bug where front-end action requests could resolve to disabled sites.
 
 ## 3.7.16 - 2021-10-06
 

diff --git a/src/services/Sites.php b/src/services/Sites.php
@@ -1286,7 +1286,10 @@ private function _allSites(bool $withDisabled = null)
     {
         if ($withDisabled === null) {
             $request = Craft::$app->getRequest();
-            $withDisabled = !$request->getIsSiteRequest() || $request->getIsActionRequest();
+            $withDisabled = (
+                $request->getIsConsoleRequest() ||
+                ($request->getIsCpRequest() && !Craft::$app->getUser()->getIsGuest())
+            );
         }
 
         return $withDisabled ? $this->_allSitesById : $this->_enabledSitesById;