Security update for Core, with self-updated composer

[yaffs-website] / web / core / modules / rest / rest.install

diff --git a/web/core/modules/rest/rest.install b/web/core/modules/rest/rest.install
index 32c5b1d27023a1235f2798ef7bf43b8df357fd79..2113b0bbc3bd6e261a6787e481db46d4b61cf927 100644 (file)
--- a/web/core/modules/rest/rest.install
+++ b/web/core/modules/rest/rest.install
@@ -84,3 +84,39 @@ function rest_update_8203() {
   $rest_settings->set('bc_entity_resource_permissions', TRUE)
     ->save(TRUE);
 }
+
+/**
+ * Ensure the right REST authentication method is used.
+ *
+ * This fixes the bug in https://www.drupal.org/node/2825204.
+ */
+function rest_update_8401() {
+  $config_factory = \Drupal::configFactory();
+  $auth_providers = \Drupal::service('authentication_collector')->getSortedProviders();
+  $process_auth = function ($auth_option) use ($auth_providers) {
+    foreach ($auth_providers as $provider_id => $provider_data) {
+      // The provider belongs to the module that declares it as a service.
+      if (strtok($provider_data->_serviceId, '.') === $auth_option) {
+        return $provider_id;
+      }
+    }
+
+    return $auth_option;
+  };
+
+  foreach ($config_factory->listAll('views.view.') as $view_config_name) {
+    $save = FALSE;
+    $view = $config_factory->getEditable($view_config_name);
+    $displays = $view->get('display');
+    foreach ($displays as $display_name => $display) {
+      if ('rest_export' === $display['display_plugin'] && !empty($display['display_options']['auth'])) {
+        $displays[$display_name]['display_options']['auth'] = array_map($process_auth, $display['display_options']['auth']);
+        $save = TRUE;
+      }
+    }
+    if ($save) {
+      $view->set('display', $displays);
+      $view->save(TRUE);
+    }
+  }
+}