Yes it is a security issue (IMHO), which is why I fixed it with a quick and dirty patch.
one other thing:
http://myserver.com:3689/databases/1/it … :Lagwagon’
gives me a valid xml file with all items found.
It requires a login after my patch. Just tried it. So what you found is the same issue really. The patch fixes it as well.
Oh, and you need to set a user password. Otherwise you simply opt to give that info out unprotected. But I guess you did that as otherwise also the download is the same. No password=global sharing.
The bug here was that it was also sharing globally with a password without that patch.