Security update for Core, with self-updated composer

[yaffs-website] / web / core / modules / comment / src / Entity / Comment.php

diff --git a/web/core/modules/comment/src/Entity/Comment.php b/web/core/modules/comment/src/Entity/Comment.php
index 8ce0c73edb9efd967d04e34160155edd6330c718..233c752c59f6bcacd327512f20f00dd895eb7e27 100644 (file)
--- a/web/core/modules/comment/src/Entity/Comment.php
+++ b/web/core/modules/comment/src/Entity/Comment.php
@@ -57,6 +57,7 @@ use Drupal\user\UserInterface;
  *     "canonical" = "/comment/{comment}",
  *     "delete-form" = "/comment/{comment}/delete",
  *     "edit-form" = "/comment/{comment}/edit",
+ *     "create" = "/comment",
  *   },
  *   bundle_entity_type = "comment_type",
  *   field_ui_base_route  = "entity.comment_type.edit_form",
@@ -72,6 +73,8 @@ class Comment extends ContentEntityBase implements CommentInterface {
 
   /**
    * The thread for which a lock was acquired.
+   *
+   * @var string
    */
   protected $threadLock = '';
 
@@ -138,17 +141,20 @@ class Comment extends ContentEntityBase implements CommentInterface {
         } while (!\Drupal::lock()->acquire($lock_name));
         $this->threadLock = $lock_name;
       }
-      // We test the value with '===' because we need to modify anonymous
-      // users as well.
-      if ($this->getOwnerId() === \Drupal::currentUser()->id() && \Drupal::currentUser()->isAuthenticated()) {
-        $this->setAuthorName(\Drupal::currentUser()->getUsername());
-      }
       $this->setThread($thread);
       if (!$this->getHostname()) {
         // Ensure a client host from the current request.
         $this->setHostname(\Drupal::request()->getClientIP());
       }
     }
+    // The entity fields for name and mail have no meaning if the user is not
+    // Anonymous. Set them to NULL to make it clearer that they are not used.
+    // For anonymous users see \Drupal\comment\CommentForm::form() for mail,
+    // and \Drupal\comment\CommentForm::buildEntity() for name setting.
+    if (!$this->getOwner()->isAnonymous()) {
+      $this->set('name', NULL);
+      $this->set('mail', NULL);
+    }
   }
 
   /**
@@ -559,7 +565,7 @@ class Comment extends ContentEntityBase implements CommentInterface {
    * @see ::baseFieldDefinitions()
    *
    * @return bool
-   *  TRUE if the comment should be published, FALSE otherwise.
+   *   TRUE if the comment should be published, FALSE otherwise.
    */
   public static function getDefaultStatus() {
     return \Drupal::currentUser()->hasPermission('skip comment approval') ? CommentInterface::PUBLISHED : CommentInterface::NOT_PUBLISHED;