TYPO3 Core

In TYPO3\CMS\Core\Database\Query\Restriction\FrontendRestrictionContainer the call of buildExpression on registered restrictions uses tableName as array key and tableAlias as array value.

In all registerable restrictions these are used the other way round. The array key is used als tableAlias and the value as tableName.

This causes in wrong behaviour when tableName and tableAlias differ.

Calling DeletedRestriction::buildExpression with ['tt_content' => 't'] for example uses the 't' as tableName and 'tt_content' is taken as tableAlias. This leads to the wrong check on $GLOBALS['TCA'][$tableName]['ctrl']['delete'] where 't' is not available.

Due to a weak method call in typo3/sysext/core/Tests/Unit/Database/Query/Restriction/FrontendRestrictionContainerTest.php line 176 this behaviour was not discovered because

$expression = $subject->buildExpression([$tableName => $tableName], $this->expressionBuilder);

does not test with an alias that differ from the tablename.

This is happening in master and 8.7