Issue #3045608 by heddn: Contrib extension PSA version logic is broken

automatic_updates.module

@@ -27,7 +27,7 @@ function automatic_updates_page_top(array &$page_top) {
     ];
     // These routes don't need additional nagging.
     if (in_array(\Drupal::routeMatch()->getRouteName(), $disabled_routes, TRUE)) {
-        return;
+      return;
     }
     /** @var \Drupal\automatic_updates\Services\AutomaticUpdatesPsaInterface $psa */
     $psa = \Drupal::service('automatic_updates.psa');

src/Services/AutomaticUpdatesPsa.php

@@ -211,11 +211,8 @@ class AutomaticUpdatesPsa implements AutomaticUpdatesPsaInterface {
    *   The extension version.
    */
   protected function contribMessage(array &$messages, $json, $extension_version) {
-    array_walk($json->secure_versions, function (&$version) {
-      $version = \Drupal::CORE_COMPATIBILITY . '-' . $version;
-    });
     $version_string = implode('||', $json->secure_versions);
-    $constraint = new Constraint($extension_version, \Drupal::CORE_COMPATIBILITY);
+    $constraint = new Constraint("<=$extension_version", \Drupal::CORE_COMPATIBILITY);
     if (!$constraint->isCompatible($version_string)) {
       $messages[] = $this->t('Drupal Contrib Project PSA: <a href=":url">:message</a>', [
         ':message' => $json->title,

tests/modules/test_automatic_updates/src/Controller/JsonTestController.php

@@ -17,6 +17,7 @@ class JsonTestController extends ControllerBase {
    *   Return JSON feed response.
    */
   public function json() {
+    $feed = [];
     $feed[] = [
       'title' => 'Critical Release - PSA-2019-02-19',
       'link' => 'https://www.drupal.org/psa-2019-02-19',
@@ -52,7 +53,7 @@ class JsonTestController extends ControllerBase {
       'project' => 'node',
       'extensions' => ['node'],
       'type' => 'module',
-      'secure_versions' => ['8.10.99'],
+      'secure_versions' => ['8.2.0'],
       'pubDate' => 'Tue, 19 Mar 2019 12:50:00 +0000',
     ];
     $feed[] = [
@@ -82,6 +83,15 @@ class JsonTestController extends ControllerBase {
       'secure_versions' => ['8.10.99'],
       'pubDate' => 'Tue, 19 Mar 2019 12:50:00 +0000',
     ];
+    $feed[] = [
+      'title' => 'Token - Moderately critical - Access bypass - SA-CONTRIB-2019',
+      'link' => 'https://www.drupal.org/sa-contrib-2019',
+      'project' => 'token',
+      'extensions' => ['token'],
+      'type' => 'module',
+      'secure_versions' => ['1.5'],
+      'pubDate' => 'Tue, 19 Mar 2019 12:50:00 +0000',
+    ];
     return new JsonResponse($feed);
   }
 

tests/src/Functional/AutomaticUpdatesTest.php

@@ -52,12 +52,12 @@ class AutomaticUpdatesTest extends BrowserTestBase {
     $this->drupalGet(Url::fromRoute('system.admin'));
     $this->assertSession()->pageTextContains('Drupal Core PSA: Critical Release - PSA-2019-02-19');
     $this->assertSession()->pageTextNotContains('Drupal Core PSA: Critical Release - PSA-Really Old');
-    $this->assertSession()->pageTextContains('Drupal Contrib Project PSA: Node - Moderately critical - Access bypass - SA-CONTRIB-2019');
+    $this->assertSession()->pageTextNotContains('Drupal Contrib Project PSA: Node - Moderately critical - Access bypass - SA-CONTRIB-2019');
     $this->assertSession()->pageTextContains('Drupal Contrib Project PSA: Seven - Moderately critical - Access bypass - SA-CONTRIB-2019');
     $this->assertSession()->pageTextContains('Drupal Contrib Project PSA: Standard - Moderately critical - Access bypass - SA-CONTRIB-2019');
 
     // Test cache.
-    $end_point = $this->buildUrl(Url::fromRoute('test_automatic_updates.json_test_denied_controller'));
+    $end_point = 'http://localhost/automatic_updates/test-json-denied';
     $this->config('automatic_updates.settings')
       ->set('psa_endpoint', $end_point)
       ->save();