Security update for Core, with self-updated composer

[yaffs-website] / web / core / modules / field_layout / src / FieldLayoutBuilder.php

diff --git a/web/core/modules/field_layout/src/FieldLayoutBuilder.php b/web/core/modules/field_layout/src/FieldLayoutBuilder.php
index 8ef5d048fc72f48a6ae563bb54bb72c79341f39d..fdbefd5e8d38c797a4b663daa3e950df829c54cd 100644 (file)
--- a/web/core/modules/field_layout/src/FieldLayoutBuilder.php
+++ b/web/core/modules/field_layout/src/FieldLayoutBuilder.php
@@ -67,12 +67,15 @@ class FieldLayoutBuilder implements ContainerInjectionInterface {
       $regions = array_fill_keys($layout_definition->getRegionNames(), []);
 
       foreach ($fields as $name => $field) {
-        // Move the field from the top-level of $build into a region-specific
-        // section.
+        // If the region is controlled by the layout, move the field from the
+        // top-level of $build into a region-specific section. Custom regions
+        // could be set by other code at run-time; these should be ignored.
         // @todo Ideally the array structure would remain unchanged, see
         //   https://www.drupal.org/node/2846393.
-        $regions[$field['region']][$name] = $build[$name];
-        unset($build[$name]);
+        if (isset($regions[$field['region']])) {
+          $regions[$field['region']][$name] = $build[$name];
+          unset($build[$name]);
+        }
       }
       // Ensure this will not conflict with any existing array elements by
       // prefixing with an underscore.
@@ -103,7 +106,7 @@ class FieldLayoutBuilder implements ContainerInjectionInterface {
         // avoids breaking hook_form_alter() implementations by not actually
         // moving the field in the form structure. If a #group is already set,
         // do not overwrite it.
-        if (!isset($build[$name]['#group'])) {
+        if (isset($regions[$field['region']]) && !isset($build[$name]['#group'])) {
           $build[$name]['#group'] = $field['region'];
         }
       }