Unpublished translations are visible to non-administrators

Please, confirm this still exists in the latest dev.

It's the same in the latest dev versione... please fix it because is very problematic

I just tried a clean installation of D7 + the latest dev. I have a published english node with an unpublished italian translation. The anonymous user can only see the english values both on node/1 and on it/node/1.

To fix this I need a more detailed explation of what the expected behavior is wrt the actual behavior. And most importantly the exact steps to reproduce the issue starting from a clean D7 installation and possibly installing additional modules (specify their versions!).

@plach: maybe a dup of #2155529: Enabling Title Broke Entity Translation "This translation is published" feature ?

I found the reason why this may happen and it seems to be reproducible. Moving the issue to Title queue.

Prerequisites:
* Install Entity Translation module. Enable translation for a node type.
* Install Title module and enable title replacement for that node type.
* Create a node of that type, add a translation and make it unpublished.

What happens:
Unpublished translation is displayed when visiting node page on language different then original.

Correct behavior:
Original version should be displayed.

And this is what happens:

1. Title module changes implementations order and places itself to the top of implementations list in title_module_implements_alter().
2. Now when an entity is loaded and entity_load hook is triggered, title module takes the lead BEFORE entity_translation loads translations to the entity
3. Title module calls title_field_sync_get() which calls field_language():

For comfortable viewing use this gist instead.

function field_language($entity_type, $entity, $field_name = NULL, $langcode = NULL) {
  $display_languages = &drupal_static(__FUNCTION__, array()); // *** This is cache for field languages
  ...
  if (!isset($display_languages[$entity_type][$id][$langcode])) { // *** This is triggered only once, when cache is empty
    ...
    drupal_alter('field_language', $display_language, $context);
      ->
      function entity_translation_field_language_alter(&$display_language, $context) {
        if (variable_get('locale_field_language_fallback', TRUE) && entity_translation_enabled($context['entity_type'])) {
          ...
          $handler = entity_translation_get_handler($entity_type, $entity);
          $translations = $handler->getTranslations(); // *** This is EMPTY as the translations are not loaded
          ...
          if (isset($translations->data[$context['language']]) && !entity_translation_access($entity_type, $translations->data[$context['language']])) {
            // *** NOT TRIGGERED, so no field language filtering/processing happens
      <- // ** returns untouched entity
    $display_languages[$entity_type][$id][$langcode] = $display_language; // *** Wrong language data drop into cache

4. Now when the node is viewed and field_langauge() is called again (from field_attach_prepare_view()), it returns wrong language data.

I'm not sure about the proper fix, but I think that Title module's entity_load hook should be triggered AFTER Entity Translation's hook.

Possible patch is provided.

This might be a duplicate of #2085457: Wrong cache is initialized in field_language() ? That patch clears the field_language cache that is populated by the title field, so then it should show the correct language data?