Security update for Core, with self-updated composer

[yaffs-website] / web / core / lib / Drupal / Core / Config / Entity / Query / Condition.php

diff --git a/web/core/lib/Drupal/Core/Config/Entity/Query/Condition.php b/web/core/lib/Drupal/Core/Config/Entity/Query/Condition.php
index 6764d01ea6eab259f60fadd0bbaf3d8c97a4e891..bd2facd18fe8070c3b6c918ccd52d27a19ecb81f 100644 (file)
--- a/web/core/lib/Drupal/Core/Config/Entity/Query/Condition.php
+++ b/web/core/lib/Drupal/Core/Config/Entity/Query/Condition.php
@@ -50,7 +50,7 @@ class Condition extends ConditionBase {
           // matter and this config object does not match.
           // If OR and it is matching, then the rest of conditions do not
           // matter and this config object does match.
-          if ($and != $match ) {
+          if ($and != $match) {
             break;
           }
         }
@@ -154,6 +154,13 @@ class Condition extends ConditionBase {
    *   TRUE when matches else FALSE.
    */
   protected function match(array $condition, $value) {
+    // "IS NULL" and "IS NOT NULL" conditions can also deal with array values,
+    // so we return early for them to avoid problems.
+    if (in_array($condition['operator'], ['IS NULL', 'IS NOT NULL'], TRUE)) {
+      $should_be_set = $condition['operator'] === 'IS NOT NULL';
+      return $should_be_set === isset($value);
+    }
+
     if (isset($value)) {
       // We always want a case-insensitive match.
       if (!is_bool($value)) {
@@ -183,15 +190,11 @@ class Condition extends ConditionBase {
           return strpos($value, $condition['value']) !== FALSE;
         case 'ENDS_WITH':
           return substr($value, -strlen($condition['value'])) === (string) $condition['value'];
-        case 'IS NOT NULL':
-          return TRUE;
-        case 'IS NULL':
-          return FALSE;
         default:
           throw new QueryException('Invalid condition operator.');
       }
     }
-    return $condition['operator'] === 'IS NULL';
+    return FALSE;
   }
 
 }