Commit 05dac1d4 authored by catch's avatar catch
Browse files

Issue #2986539 by alexpott:... 

Issue #2986539 by alexpott: \Drupal\user\Plugin\EntityReferenceSelection\UserSelection::entityQueryAlter() should escape the fake condition column on replacement

(cherry picked from commit 0f02ad4c)
parent 89b92c51

core/modules/user/src/Plugin/EntityReferenceSelection/UserSelection.php

+1 −1
Changes for core/modules/user/src/Plugin/EntityReferenceSelection/UserSelection.php: 1 added line, 1 removed line.
Original line number Diff line number Diff line
@@ -242,7 +242,7 @@ public function entityQueryAlter(SelectInterface $query) { 
          $value_part->condition('anonymous_name', $condition['value'], $condition['operator']);

          $value_part->compile($this->connection, $query);

          $or->condition((new Condition('AND'))

            ->where(str_replace('anonymous_name', ':anonymous_name', (string) $value_part), $value_part->arguments() + [':anonymous_name' => \Drupal::config('user.settings')->get('anonymous')])

            ->where(str_replace($query->escapeField('anonymous_name'), ':anonymous_name', (string) $value_part), $value_part->arguments() + [':anonymous_name' => \Drupal::config('user.settings')->get('anonymous')])

            ->condition('base_table.uid', 0)

          );

          $query->condition($or);