Possibility of manipulated condition when unfiltered input is passed to `yii\elasticsearch\ActiveRecord::findOne()` and `::findAll()`

CVE-2018-8074

Affected version: <2.0.5

Reported by:
FriendsOfPHP/security-advisories