Updated Drupal to 8.6. This goes with the following updates because it's possible...

[yaffs-website] / web / core / lib / Drupal / Core / Routing / UrlGenerator.php

diff --git a/web/core/lib/Drupal/Core/Routing/UrlGenerator.php b/web/core/lib/Drupal/Core/Routing/UrlGenerator.php
index 3b5c8d256b1037266fcd1c0d20b4855c545f0ee3..853a5f7b4e1babda77e423a4777e49b433b12f2d 100644 (file)
--- a/web/core/lib/Drupal/Core/Routing/UrlGenerator.php
+++ b/web/core/lib/Drupal/Core/Routing/UrlGenerator.php
@@ -297,6 +297,11 @@ class UrlGenerator implements UrlGeneratorInterface {
     if ($options['path_processing']) {
       $path = $this->processPath($path, $options, $generated_url);
     }
+    // Ensure the resulting path has at most one leading slash, to prevent it
+    // becoming an external URL without a protocol like //example.com.
+    if (strpos($path, '//') === 0) {
+      $path = '/' . ltrim($path, '/');
+    }
     // The contexts base URL is already encoded
     // (see Symfony\Component\HttpFoundation\Request).
     $path = str_replace($this->decodedChars[0], $this->decodedChars[1], rawurlencode($path));