the-events-calendar / ql-events

The Events Calendar binding to WPGraphQL
15 stars 7 forks source link

wooAttendees accessible without auth! #33

Open sn3h opened 3 years ago

sn3h commented 3 years ago

Hi, I am not sure if I am doing everything right, but it seems to me that Attendees are accessibel without any authorization with graphql.

For example:

orders{ nodes{ total date status billing { ... all fields } } }

returns "orders": { "nodes": [] },

but

wooAttendees(first:100) { edges{ node{ id title order{ total date status billing { ... all fields }

returns all the data even to anonymous user. This has to be private and accesibel only after authorization.

Is there some way to set this up? thanks