Solidity: How unlocked account can obtain return values from a call function?

Question

Unlocked Account can obtain return values from a call function. Basically I assign eth.defaultAccount with some valid address, which only have access to the some state variables as you can see under getIndexReadFrom() as clusterContract[msg.sender].getIndexReadFrom().

[Q] Is it normal that even I didn't unlocked the account, I can use that account as msg.sender when I call a contract's function and reach that account's mapped information? Is there any lock mechanism that can I prevent this from happening, where only who can unlocks the account could reach the mapped information?

> eth.defaultAccount = "0x6af0204187a93710317542d383a1b547fa42e706"
> eth.defaultAccount
"0x6af0204187a93710317542d383a1b547fa42e706"
> myContract.getIndexReadFrom()
10 //Returns a valid information.

Example function:

   function getIndexReadFrom() constant returns ( uint ) {
    return clusterContract[msg.sender].getIndexReadFrom();
   }

Answer 1

They're two separate issues.

Q1: Yes. Since your function is marked constant, there will be no gas cost and therefore no need for the user's account to be unlocked. They will use their own copy of the blockchain and their own computing resources to find their own results.

Q2: Yes. This isn't related to account unlocking. Contract access control is enforced by contracts. For example, the function can check if the msg.sender is a member of a list of address that are permitted to use the function. This is independent of unlocking accounts, as it doesn't rely on anything the user does/doesn't do to make the determination.

Below is a very contrived example in which the deployer is at first the only "authorized" user and only authorized users can permit/revoke access to functions by other users.

I should point out that the "free" getter for the authorized[] mapping is not protected. Read-only functions are generally left open since efforts to conceal data stored on the blockchain will not prevent determined adversaries from acquiring the information.

pragma solidity ^0.4.6;

contract ACL {

    mapping (address => bool) public authorized;

    modifier onlyIfAuthorized {
        if(!authorized[msg.sender]) throw;
        _;
    }

    function ACL() {
        authorized[msg.sender] = true; // authorize the deployer
    }

    function authorizeAddress(address newUser)
        onlyIfAuthorized
        returns(bool success)
    {
        authorized[newUser] = true;
        return true;
    }

    function revokeAccess(address removeUser)
        onlyIfAuthorized
        returns(bool success)
    {
        authorized[removeUser] = false;
    }

}

Hope it helps.

Answer 2

All information stored on the Blockchain is public. If you are only reading data (using constant functions or .call()) and not modifying the state of the Blockchain, you don't need to send/request any information from other nodes. You can just read the information from your local node, as it is already being synced with the rest of the network.

So answering your question: All the data stored in that mapping is stored in all nodes and anyone can access it. You cannot prevent them from reading it.