Enforced config dependencies override normal dependencies instead of adding to them

Created on 24 August 2018, over 6 years ago

Updated 6 June 2023, over 1 year ago

Problem/Motivation

Marking this as major because any wrongly missing config dependencies can put the system into a broken state.

\Drupal\Core\Config\ConfigInstaller::getMissingDependencies() adds the enforced dependencies to the normal dependencies with the following code (line 571):

$all_dependencies = array_merge($all_dependencies, $data['dependencies']['enforced']);

(Let's ignore the fact that it weirdly uses $data['dependencies']['enforced'] instead of $all_dependencies['enforced'] for the time being.)

But both data structures are nested arrays, of the form:

[
  'module' => [ ... ],
  'theme' => [ ... ],
  'config' => [ ... ],
];

Because array_merge() is used, and not array_merge_recursive(), if, for example, $data['dependencies']['enforced'] contains a 'module' key, the list of enforced modules will replace the list of modules that are in $all_dependencies['module'] (if any), instead of adding to it.

Proposed resolution

Write a failing test that proves the bug.
Replace array_merge() with array_merge_recursive() in the offending line to fix the test and the bug.

Note that all of the lists of dependencies are integer-keyed, so that we can safely use array_merge_recursive()
and do not need NestedArray::mergeDeep().

🐛 Bug report

Status

Closed: duplicate

Version

9.5

Component

Configuration entity →

Last updated 2 days ago