Commit 48c20b83 authored by Jess's avatar Jess
Browse files

SA-CORE-2022-003 by ciss, xjm, larowlan, benjy, mcdruid, jenlampton,... 

SA-CORE-2022-003 by ciss, xjm, larowlan, benjy, mcdruid, jenlampton, quicksketch, Fabianx, effulgentsia

(cherry picked from commit 8fabbc61)
parent 51c1ef6e

core/lib/Drupal/Core/Form/FormBuilder.php

+1 −1
Original line number Diff line number Diff line
@@ -1217,7 +1217,7 @@ protected function handleInputElement($form_id, &$element, FormStateInterface &$ 
    // #access=FALSE on an element usually allow access for some users, so forms

    // submitted with self::submitForm() may bypass access restriction and be

    // treated as high-privilege users instead.

    $process_input = empty($element['#disabled']) && (($form_state->isProgrammed() && $form_state->isBypassingProgrammedAccessChecks()) || ($form_state->isProcessingInput() && (!isset($element['#access']) || $element['#access'])));

    $process_input = empty($element['#disabled']) && ($element['#type'] !== 'value') && (($form_state->isProgrammed() && $form_state->isBypassingProgrammedAccessChecks()) || ($form_state->isProcessingInput() && (!isset($element['#access']) || $element['#access'])));



    // Set the element's #value property.

    if (!isset($element['#value']) && !array_key_exists('#value', $element)) {