core security update 8.5.3

2018-04-25 20:08:51 +02:00
parent 4e1a5c59b5
commit 551ff35344
4 changed files with 107 additions and 44 deletions
@@ -8,6 +8,7 @@ use Drupal\Component\Utility\NestedArray;
 use Drupal\Core\Ajax\AjaxResponse;
 use Drupal\Core\Ajax\ReplaceCommand;
 use Drupal\Core\Form\FormStateInterface;
+use Drupal\Core\Render\Element;
 use Drupal\Core\Render\Element\FormElement;
 use Drupal\Core\Site\Settings;
 use Drupal\Core\Url;
@@ -175,6 +176,9 @@ class ManagedFile extends FormElement {

    $form_parents = explode('/', $request->query->get('element_parents'));

+    // Sanitize form parents before using them.
+    $form_parents = array_filter($form_parents, [Element::class, 'child']);
+
    // Retrieve the element to be rendered.
    $form = NestedArray::getValue($form, $form_parents);