Bug: Category filter field displays all categories from all category groups

[stanislavprokopov]

So I have added a category field to the "Search Fields" list, now when i open the frontend, the field will appear in the filters section, but it will have all categories i have defined in the admin panel, regardless of the actual category field source.

The issue is with this line:

super-filter/src/fields/Categories.php

Line 40 in 55153df

$find = ElementHelper::findSource($elementType, $source);

It does not provide the third parameter to the findSource call, this results in using the default CONTEXT_INDEX context.

Call stack:

https://github.com/craftcms/cms/blob/2eac9249964ccc553bf841c79b9ee44d58f16b61/src/helpers/ElementHelper.php#L562

https://github.com/craftcms/cms/blob/71aac29fa480dd3b09a72c4fa54a5fd4976b4dd4/src/services/ElementSources.php#L76

https://github.com/craftcms/cms/blob/71aac29fa480dd3b09a72c4fa54a5fd4976b4dd4/src/services/ElementSources.php#L341

https://github.com/craftcms/cms/blob/71aac29fa480dd3b09a72c4fa54a5fd4976b4dd4/src/base/Element.php#L795

https://github.com/craftcms/cms/blob/71aac29fa480dd3b09a72c4fa54a5fd4976b4dd4/src/elements/Category.php#L190

https://github.com/craftcms/cms/blob/71aac29fa480dd3b09a72c4fa54a5fd4976b4dd4/src/services/Categories.php#L160

getEditableGroups has this check:

if (Craft::$app->getRequest()->getIsConsoleRequest()) {
    return $this->getAllGroups();
}

$user = Craft::$app->getUser()->getIdentity();

if (!$user) {
    return [];
}

So if you are not authenticated, then you will get empty sources, this results in $criteria = $find['criteria'] ?? null; being null, so no criteria filtering gets applied to the Category element find query.

Fix: Add third parameter to the findSource call, for example this one: \craft\services\ElementSources::CONTEXT_FIELD