From 2d1a5f12c25a4a7211daf19afef81dd6a190c077 Mon Sep 17 00:00:00 2001 From: xjm Date: Wed, 20 Jul 2022 10:11:42 -0500 Subject: [PATCH] SA-CORE-2022-013 by prudloff, tim.plunkett, Heine, effulgentsia, xjm, lauriii, longwave, larowlan --- lib/Drupal/Core/Form/FormBuilder.php | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/lib/Drupal/Core/Form/FormBuilder.php b/lib/Drupal/Core/Form/FormBuilder.php index 4ed0faed77b..98eb3263429 100644 --- a/lib/Drupal/Core/Form/FormBuilder.php +++ b/lib/Drupal/Core/Form/FormBuilder.php @@ -1217,7 +1217,12 @@ protected function handleInputElement($form_id, &$element, FormStateInterface &$ // #access=FALSE on an element usually allow access for some users, so forms // submitted with self::submitForm() may bypass access restriction and be // treated as high-privilege users instead. - $process_input = empty($element['#disabled']) && !in_array($element['#type'], ['item', 'value'], TRUE) && (($form_state->isProgrammed() && $form_state->isBypassingProgrammedAccessChecks()) || ($form_state->isProcessingInput() && (!isset($element['#access']) || $element['#access']))); + $process_input = empty($element['#disabled']) && + !in_array($element['#type'], ['item', 'value'], TRUE) && + ( + ($form_state->isProgrammed() && $form_state->isBypassingProgrammedAccessChecks()) || + ($form_state->isProcessingInput() && (!isset($element['#access']) || (($element['#access'] instanceof AccessResultInterface && $element['#access']->isAllowed()) || ($element['#access'] === TRUE)))) + ); // Set the element's #value property. if (!isset($element['#value']) && !array_key_exists('#value', $element)) {