SA-CORE-2022-003 by ciss, xjm, larowlan, benjy, mcdruid, jenlampton, …

…quicksketch, Fabianx, effulgentsia (cherry picked from commit 8fabbc611e0987aab2c2247aee0885e79e21ab1f)
drupal · Feb 15, 2022 · d156ce7 · d156ce7
1 parent 8af4b84
commit d156ce7
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/Drupal/Core/Form/FormBuilder.php b/lib/Drupal/Core/Form/FormBuilder.php
@@ -1217,7 +1217,7 @@ protected function handleInputElement($form_id, &$element, FormStateInterface &$
     // #access=FALSE on an element usually allow access for some users, so forms
     // submitted with self::submitForm() may bypass access restriction and be
     // treated as high-privilege users instead.
-    $process_input = empty($element['#disabled']) && (($form_state->isProgrammed() && $form_state->isBypassingProgrammedAccessChecks()) || ($form_state->isProcessingInput() && (!isset($element['#access']) || $element['#access'])));
+    $process_input = empty($element['#disabled']) && ($element['#type'] !== 'value') && (($form_state->isProgrammed() && $form_state->isBypassingProgrammedAccessChecks()) || ($form_state->isProcessingInput() && (!isset($element['#access']) || $element['#access'])));
 
     // Set the element's #value property.
     if (!isset($element['#value']) && !array_key_exists('#value', $element)) {