Use short circuit logic to prevent potential NPE in CorsFilter.

The same logic is used a few lines below, so it was most probably
intended that way anyways. 


git-svn-id: https://svn.apache.org/repos/asf/tomcat/trunk@1837786 13f79535-47bb-0310-9956-ffa450edef68

java/org/apache/catalina/filters/CorsFilter.java

@@ -453,7 +453,7 @@ private void addStandardHeaders(final HttpServletRequest request,
                         String.valueOf(preflightMaxAge));
             }
 
-            if  ((allowedHttpMethods != null & !allowedHttpMethods.isEmpty())) {
+            if  ((allowedHttpMethods != null) && (!allowedHttpMethods.isEmpty())) {
                 response.addHeader(
                         CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_METHODS,
                         join(allowedHttpMethods, ","));

webapps/docs/changelog.xml

@@ -103,6 +103,9 @@
         <bug>62607</bug>: Return a non-zero exit code from
         <code>catalina.[bat|sh] run</code> if Tomcat fails to start. (markt)
       </add>
+      <fix>
+        Use short circuit logic to prevent potential NPE in CorsFilter. (fschumacher)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Coyote">