direct call to ajax.php bypasses ACLs, authentication

Our site allows only authenticated users to access information about the individuals in the system. But using the same query used by the auto-complete of the search box, I was able to dump a list of contacts in the system.

To reproduce:

wget "http://example.org/sites/all/modules/civicrm/extern/ajax.php?q=civicrm/search&d=1&s=t"

will return all contacts starting by the letter T, will not check authentication nor ACLs.

mathieu, "bgm" on irc in #civicrm.