Updated Drupal to 8.6. This goes with the following updates because it's possible...

[yaffs-website] / web / core / modules / user / src / Plugin / EntityReferenceSelection / UserSelection.php

diff --git a/web/core/modules/user/src/Plugin/EntityReferenceSelection/UserSelection.php b/web/core/modules/user/src/Plugin/EntityReferenceSelection/UserSelection.php
index d06a81c41e2db684283618df2316b6128d23bdbe..b2887afb05f9936f24aa43e051b61b99686b344c 100644 (file)
--- a/web/core/modules/user/src/Plugin/EntityReferenceSelection/UserSelection.php
+++ b/web/core/modules/user/src/Plugin/EntityReferenceSelection/UserSelection.php
@@ -242,7 +242,7 @@ class UserSelection extends DefaultSelection {
           $value_part->condition('anonymous_name', $condition['value'], $condition['operator']);
           $value_part->compile($this->connection, $query);
           $or->condition((new Condition('AND'))
-            ->where(str_replace('anonymous_name', ':anonymous_name', (string) $value_part), $value_part->arguments() + [':anonymous_name' => \Drupal::config('user.settings')->get('anonymous')])
+            ->where(str_replace($query->escapeField('anonymous_name'), ':anonymous_name', (string) $value_part), $value_part->arguments() + [':anonymous_name' => \Drupal::config('user.settings')->get('anonymous')])
             ->condition('base_table.uid', 0)
           );
           $query->condition($or);