Strange behavior in getListQuery() function and getState('filter.published') value

[Pavel Bezdienezhnykh]

Hello.

Few weeks ago I mentioned that on my joomla 3.5 site there are unpublished articles that are visible for everyone.
I know that I can see them when I'm logged in as admin, but that articles steel visible for other user (and in private browsing mode or at other devices).
After some investigations I have found that in
www/components/com_content/models/articles.php
in
function getListQuery()
there is a line
// Filter by published state
$published = $this->getState('filter.published');

and this call returns list with values 0,1,2
so unpublished items can be selected by this query.
$query->where($publishedWhere . ' IN (' . $published . ')');

I'm not so good in deep understanding of joomla and can't find the place and cause where and why this values are set to 'filter.published' property.

May be someone can help me with this issue?

Thanks in advice,
Pavel.

[Bakual]

The filter.published state is set in the model after an ACL check:

https://github.com/joomla/joomla-cms/blob/staging/components/com_content/models/articles.php#L113-L117

So if you're not allowed to edit the article state (eg publish an unpublished article), you will only see the published ones.