[BUG] "Now Playing" on Leanback shows protected/hidden content (6.11.2.3107)

This is a serious hole in parental/managed user control in the currently released version of Plex on the Play Store.

Plex/Shield is populating the Now Playing with content that is otherwise protected/hidden, even when the user to which that content belongs is no longer active in Plex.

PLATFORM:
Android TV, NVIDIA Shield Experience 6.2 update

ISSUE:
Now Playing can show video content from a library that is hidden from the dashboard and enabled only for the admin user behind a passcode, even when a different managed user is active.

STEPS:
Set up at least one managed user in addition to the main admin user
Set up a library only for the admin user with at least one video
Disable the dashboard for that library
Set a passcode for the admin user

On the Shield, start Plex, select the admin user and enter the passcode
Go to the above Library and play a video from it (note that nothing from this library appears in the dashboard)
Exit to the LeanBack launcher, optionally first pausing the video - directly with the home button or repeatedly pressing back button
Now Playing (the first and left-most tile in the recommendations row) shows a paused still frame from the video
Enter Plex again and select a managed user (who doesn’t have access to the library or video referenced above)
Exit back to Leanback Launcher and see that the original video is still displayed in Now Playing

RESULTS:
Undesired content is presented in the top level Leanback Launcher that is accessible to anyone, thereby circumventing the parental or managed user content controls put in place within Plex.

Only a screen capture is displayed on the Now Playing Tile, the video cannot be played by selecting the tile when a different user is active in Plex. It produces a non-specific error when the Plex UI starts up.

While this tile for non-accessible video is displayed, opening Plex for the first time with a managed user may present a completely empty Dashboard with only the libraries listed at the top and plugin channels listed below.

BUILD AFFECTED:
6.11.2.3107

REGRESSION:
Haven’t tested other builds

EXPECTED BEHAVIOR:

  1. Videos from Libraries that do not appear in dashboard should likewise never appear on the Now Playing of the Leanback Launcher

  2. Videos from libraries that are unavailable to the managed user currently active in Plex should never appear in Now Playing of the Leanback Launcher

3. Videos in a library that only exists for a user protected by PIN/password should not appear in Now Playing when that user is no longer active in Plex (at a time where Plex would ask for user when started)

  1. Videos of a content rating outside the scope of the ratings allowed for a specific managed user should not appear in Now Playing when that user is active in Plex.

  2. Entering Plex with a managed user after having played unaccessible video with a different user shouldn’t have any effect on the displayed content or UI.

Tested and duplicated with latest build, 6.11.3.3147

I have TWO 2017 Shield units to test with the same software installed on each (both with current Plex version). This issue is only able to be duplicated on ONE of the systems.

Differences in hardware setups between two systems:

Problem system connected only to TV and without a controller paired.
OK system connected to AVR/AVP with paired controller.

Software setup differences in Plex: Problem system has Audio Passthrough Disabled and other system has it set to AUTO.

Problem system always shows “Now Playing” tile when backing out of Plex using the back button. Other system doesn’t show Now Playing tile at all.

Additional unexpected behavior:

Changing Audio Passthrough on the problem system to AUTO immediately made this issue go away. ONE TIME. Changing it back to DISABLED didn’t bring the problem back. There was (for a time) no longer any “Now Playing” tile shown when exiting Plex with the back button. The issue returned on subsequent usage of Plex some days later

“Now Playing” is displayed on both system with playback continuing in the background if the HOME button is used to exit Plex while a video (or music) is playing.