Issue Summary

Using the JQL REST API returns all issues for the current user when the field being searched for does not exist e.g. /jira/rest/api/2/search?jql=fooField=fooUser will return all items.

fooField is a custom field of type "User Picker & Group Searcher" and fooUser is a non-existent user.

Steps to Reproduce

1. Create a custom field of type "User Picker & Group Searcher" e.g. fooField
2. Search using the following JQL

/jira/rest/api/2/search?jql=fooField=fooUser

Expected Results

No issues are returned and a warning message of "The value 'fooUser' does not exist for the field 'fooField'."

Actual Results

All issues which the user has permission to see.

Workaround

Disable the com.atlassian.jira.search.api feature flag.