Allow and Deny permissions for user roles to use V2 API in browser.
Hi Lithium Team,
Just found it very strange on all over the communities, any type of user role or anonymous can read the users public data in community using V2 API by just hitting this URL (http://community.lithium.com/api/2.0/search?q=SELECT%20login%20from%20users%20where+roles.id%3D%27t%3AAdministrator%27+limit%201000), and there is no way by which community members can disable this from admin or there is any permissions for that. Using this API any user can read usernames of role type(admins) from API URL and can misuse of it.
Even this article(https://community.lithium.com/t5/Developer-Documentation/bd-p/dev-doc-portal?section=commv2&v2.main=gettingstarted#apiBrowser) also states that anonymous users also can read users public data.
There should be set of permissions which can apply for anonymous users to not read users data through API by adding restrictions to API V2.
Attached are some of the screen-shots for this.