Fix security issue

I am currently fixing the security issue on D8 and D7 versions with the help of the Drupal security team.

Using this issue to get the git command and credit people.

The original SA was https://www.drupal.org/sa-contrib-2019-006 which is why this can happen in public.