Security update for Core, with self-updated composer

[yaffs-website] / web / core / modules / rest / src / Plugin / views / display / RestExport.php

diff --git a/web/core/modules/rest/src/Plugin/views/display/RestExport.php b/web/core/modules/rest/src/Plugin/views/display/RestExport.php
index 15abaa6fdfe13f2cac90c222b1006ccd097f7afa..2b59af51185dcf06550cc0f84334f576246e25a3 100644 (file)
--- a/web/core/modules/rest/src/Plugin/views/display/RestExport.php
+++ b/web/core/modules/rest/src/Plugin/views/display/RestExport.php
@@ -87,7 +87,23 @@ class RestExport extends PathPluginBase implements ResponseDisplayPluginInterfac
   protected $authenticationCollector;
 
   /**
-   * The authentication providers, keyed by ID.
+   * The authentication providers, like 'cookie' and 'basic_auth'.
+   *
+   * @var string[]
+   */
+  protected $authenticationProviderIds;
+
+  /**
+   * The authentication providers' modules, keyed by provider ID.
+   *
+   * Authentication providers like 'cookie' and 'basic_auth' are the array
+   * keys. The array values are the module names, e.g.:
+   * @code
+   *   ['cookie' => 'user', 'basic_auth' => 'basic_auth']
+   * @endcode
+   *
+   * @deprecated as of 8.4.x, will be removed in before Drupal 9.0.0, see
+   *   https://www.drupal.org/node/2825204.
    *
    * @var string[]
    */
@@ -115,6 +131,13 @@ class RestExport extends PathPluginBase implements ResponseDisplayPluginInterfac
     parent::__construct($configuration, $plugin_id, $plugin_definition, $route_provider, $state);
 
     $this->renderer = $renderer;
+    // $authentication_providers as defined in
+    // \Drupal\Core\DependencyInjection\Compiler\AuthenticationProviderPass
+    // and as such it is an array, with authentication providers (cookie,
+    // basic_auth) as keys and modules providing those as values (user,
+    // basic_auth).
+    $this->authenticationProviderIds = array_keys($authentication_providers);
+    // For BC reasons we keep around authenticationProviders as before.
     $this->authenticationProviders = $authentication_providers;
   }
 
@@ -227,7 +250,7 @@ class RestExport extends PathPluginBase implements ResponseDisplayPluginInterfac
    *   An array to use as value for "#options" in the form element.
    */
   public function getAuthOptions() {
-    return array_combine($this->authenticationProviders, $this->authenticationProviders);
+    return array_combine($this->authenticationProviderIds, $this->authenticationProviderIds);
   }
 
   /**
@@ -407,7 +430,7 @@ class RestExport extends PathPluginBase implements ResponseDisplayPluginInterfac
    */
   public function render() {
     $build = [];
-    $build['#markup'] = $this->renderer->executeInRenderContext(new RenderContext(), function() {
+    $build['#markup'] = $this->renderer->executeInRenderContext(new RenderContext(), function () {
       return $this->view->style_plugin->render();
     });
 
@@ -435,7 +458,7 @@ class RestExport extends PathPluginBase implements ResponseDisplayPluginInterfac
       $build['#markup'] = ViewsRenderPipelineMarkup::create($build['#markup']);
     }
 
-    parent::applyDisplayCachablityMetadata($build);
+    parent::applyDisplayCacheabilityMetadata($build);
 
     return $build;
   }
@@ -457,10 +480,14 @@ class RestExport extends PathPluginBase implements ResponseDisplayPluginInterfac
     $dependencies = parent::calculateDependencies();
 
     $dependencies += ['module' => []];
-    $modules = array_map(function ($authentication_provider) {
-      return $this->authenticationProviders[$authentication_provider];
-    }, $this->getOption('auth'));
-    $dependencies['module'] = array_merge($dependencies['module'], $modules);
+    $dependencies['module'] = array_merge($dependencies['module'], array_filter(array_map(function ($provider) {
+      // During the update path the provider options might be wrong. This can
+      // happen when any update function, like block_update_8300() triggers a
+      // view to be saved.
+      return isset($this->authenticationProviderIds[$provider])
+        ? $this->authenticationProviderIds[$provider]
+        : NULL;
+    }, $this->getOption('auth'))));
 
     return $dependencies;
   }