From 435e955e45538feefc3b3caba213d355c1d463e6 Mon Sep 17 00:00:00 2001
From: xjm <xjm@65776.no-reply.drupal.org>
Date: Wed, 20 Apr 2022 09:26:39 -0500
Subject: [PATCH 1/2] SA-CORE-2022-008 by mxr576, xjm, effulgentsia, mxr576,
 larowlan

---
 core/lib/Drupal/Core/Form/FormBuilder.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/lib/Drupal/Core/Form/FormBuilder.php b/core/lib/Drupal/Core/Form/FormBuilder.php
index 7459814f890..d68ac4baf2e 100644
--- a/core/lib/Drupal/Core/Form/FormBuilder.php
+++ b/core/lib/Drupal/Core/Form/FormBuilder.php
@@ -1218,7 +1218,7 @@ class FormBuilder implements FormBuilderInterface, FormValidatorInterface, FormS
     // #access=FALSE on an element usually allow access for some users, so forms
     // submitted with self::submitForm() may bypass access restriction and be
     // treated as high-privilege users instead.
-    $process_input = empty($element['#disabled']) && ($element['#type'] !== 'value') && (($form_state->isProgrammed() && $form_state->isBypassingProgrammedAccessChecks()) || ($form_state->isProcessingInput() && (!isset($element['#access']) || $element['#access'])));
+    $process_input = empty($element['#disabled']) && !in_array($element['#type'], ['item', 'value'], TRUE) && (($form_state->isProgrammed() && $form_state->isBypassingProgrammedAccessChecks()) || ($form_state->isProcessingInput() && (!isset($element['#access']) || $element['#access'])));
 
     // Set the element's #value property.
     if (!isset($element['#value']) && !array_key_exists('#value', $element)) {

From 416eae2698e7c8b5588a7b7ebc88df842d9324cc Mon Sep 17 00:00:00 2001
From: xjm <xjm@65776.no-reply.drupal.org>
Date: Wed, 20 Apr 2022 09:26:44 -0500
Subject: [PATCH 2/2] Drupal 9.2.18

---
 composer.lock                                            | 6 +++---
 composer/Metapackage/CoreRecommended/composer.json       | 2 +-
 composer/Metapackage/PinnedDevDependencies/composer.json | 2 +-
 core/lib/Drupal.php                                      | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/composer.lock b/composer.lock
index e6ec7a6d960..533edd5080b 100644
--- a/composer.lock
+++ b/composer.lock
@@ -530,7 +530,7 @@
         },
         {
             "name": "drupal/core",
-            "version": "9.2.17",
+            "version": "9.2.18",
             "dist": {
                 "type": "path",
                 "url": "core",
@@ -784,7 +784,7 @@
         },
         {
             "name": "drupal/core-project-message",
-            "version": "9.2.17",
+            "version": "9.2.18",
             "dist": {
                 "type": "path",
                 "url": "composer/Plugin/ProjectMessage",
@@ -817,7 +817,7 @@
         },
         {
             "name": "drupal/core-vendor-hardening",
-            "version": "9.2.17",
+            "version": "9.2.18",
             "dist": {
                 "type": "path",
                 "url": "composer/Plugin/VendorHardening",
diff --git a/composer/Metapackage/CoreRecommended/composer.json b/composer/Metapackage/CoreRecommended/composer.json
index f28a64252c3..9142a73a3d9 100644
--- a/composer/Metapackage/CoreRecommended/composer.json
+++ b/composer/Metapackage/CoreRecommended/composer.json
@@ -7,7 +7,7 @@
         "webflo/drupal-core-strict": "*"
     },
     "require": {
-        "drupal/core": "9.2.17",
+        "drupal/core": "9.2.18",
         "asm89/stack-cors": "1.3.0",
         "composer/semver": "3.2.5",
         "doctrine/annotations": "1.13.1",
diff --git a/composer/Metapackage/PinnedDevDependencies/composer.json b/composer/Metapackage/PinnedDevDependencies/composer.json
index 6527b002342..c82f45597b2 100644
--- a/composer/Metapackage/PinnedDevDependencies/composer.json
+++ b/composer/Metapackage/PinnedDevDependencies/composer.json
@@ -7,7 +7,7 @@
         "webflo/drupal-core-require-dev": "*"
     },
     "require": {
-        "drupal/core": "9.2.17",
+        "drupal/core": "9.2.18",
         "behat/mink": "v1.8.1",
         "behat/mink-goutte-driver": "v1.2.1",
         "behat/mink-selenium2-driver": "v1.4.0",
diff --git a/core/lib/Drupal.php b/core/lib/Drupal.php
index d450dd19348..e4ee4866fbe 100644
--- a/core/lib/Drupal.php
+++ b/core/lib/Drupal.php
@@ -75,7 +75,7 @@ class Drupal {
   /**
    * The current system version.
    */
-  const VERSION = '9.2.17';
+  const VERSION = '9.2.18';
 
   /**
    * Core API compatibility.