SQL Injection in Drupal PostgreSQL Entity Query Condition

On PostgreSQL-backed Drupal sites, the case-insensitive entity query array condition concatenated the caller-supplied operator straight into a raw SQL fragment without validating it. Code that passes untrusted input as the operator argument (reachable via contrib modules) could inject arbitrary SQL. The fix restricts the operator to IN and NOT IN...