Skip to content

No validation for $post_date_gmt parameter #9705

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: trunk
Choose a base branch
from
Open

No validation for $post_date_gmt parameter #9705

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
39cc208
Validation for parameter (trac ticket 36738)
paulbonneau Sep 2, 2025
deb445d
Fix coding standards problems
paulbonneau Sep 2, 2025
d20fbf1
Merge branch 'WordPress:trunk' into wp-insert-post-post-date-gmt-vali…
paulbonneau Sep 2, 2025
9620a0e
Merge branch 'WordPress:trunk' into wp-insert-post-post-date-gmt-vali…
paulbonneau Oct 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 34 additions & 26 deletions src/wp-includes/post.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4648,21 +4648,20 @@ function wp_insert_post( $postarr, $wp_error = false, $fire_after_hooks = true )
$post_date = wp_resolve_post_date( $postarr['post_date'], $postarr['post_date_gmt'] );

if ( ! $post_date ) {
if ( $wp_error ) {
return new WP_Error( 'invalid_date', __( 'Invalid date.' ) );
} else {
return 0;
}
return $wp_error ? new WP_Error( 'invalid_date', __( 'Invalid date.' ) ) : 0;
}

if ( empty( $postarr['post_date_gmt'] ) || '0000-00-00 00:00:00' === $postarr['post_date_gmt'] ) {
$post_date_gmt = '0000-00-00 00:00:00';

if ( ! empty( $postarr['post_date_gmt'] ) && '0000-00-00 00:00:00' !== $postarr['post_date_gmt'] ) {
if ( ! wp_validate_post_date( $postarr['post_date_gmt'] ) ) {
return $wp_error ? new WP_Error( 'invalid_date', __( 'Invalid date.' ) ) : 0;
}
$post_date_gmt = $postarr['post_date_gmt'];
} else {
if ( ! in_array( $post_status, get_post_stati( array( 'date_floating' => true ) ), true ) ) {
$post_date_gmt = get_gmt_from_date( $post_date );
} else {
$post_date_gmt = '0000-00-00 00:00:00';
}
} else {
$post_date_gmt = $postarr['post_date_gmt'];
}

if ( $update || '0000-00-00 00:00:00' === $post_date ) {
Expand Down Expand Up @@ -5379,7 +5378,7 @@ function check_and_publish_future_post( $post ) {

/**
* Uses wp_checkdate to return a valid Gregorian-calendar value for post_date.
* If post_date is not provided, this first checks post_date_gmt if provided,
* If post_date is not provided, this checks post_date_gmt if provided,
* then falls back to use the current time.
*
* For back-compat purposes in wp_insert_post, an empty post_date and an invalid
Expand All @@ -5393,27 +5392,36 @@ function check_and_publish_future_post( $post ) {
*/
function wp_resolve_post_date( $post_date = '', $post_date_gmt = '' ) {
// If the date is empty, set the date to now.
if ( empty( $post_date ) || '0000-00-00 00:00:00' === $post_date ) {
if ( empty( $post_date_gmt ) || '0000-00-00 00:00:00' === $post_date_gmt ) {
$post_date = current_time( 'mysql' );
} else {
$post_date = get_date_from_gmt( $post_date_gmt );
}

if ( ! empty( $post_date ) && '0000-00-00 00:00:00' !== $post_date ) {
return wp_validate_post_date( $post_date );
}

// Validate the date.
$month = (int) substr( $post_date, 5, 2 );
$day = (int) substr( $post_date, 8, 2 );
$year = (int) substr( $post_date, 0, 4 );
if ( ! empty( $post_date_gmt ) && '0000-00-00 00:00:00' !== $post_date_gmt ) {
return get_date_from_gmt( $post_date_gmt );
}

$valid_date = wp_checkdate( $month, $day, $year, $post_date );
return current_time( 'mysql' );
}

if ( ! $valid_date ) {
return false;
}
return $post_date;
/**
* Check if a post_date or post_date_gmt is a valid mysql datetime formatted string
*
* @since 6.9.0
*
* @param string $mysql_formatted_post_date The date in mysql format (`Y-m-d H:i:s`).
* @return string|false A valid Gregorian-calendar date string, or false on failure.
*/
function wp_validate_post_date( $mysql_formatted_post_date ) {
// Validate the date.
$month = (int) substr( $mysql_formatted_post_date, 5, 2 );
$day = (int) substr( $mysql_formatted_post_date, 8, 2 );
$year = (int) substr( $mysql_formatted_post_date, 0, 4 );

return wp_checkdate( $month, $day, $year, $mysql_formatted_post_date ) ? $mysql_formatted_post_date : false;
}


/**
* Computes a unique slug for the post, when given the desired slug and some post details.
*
Expand Down
16 changes: 8 additions & 8 deletions tests/phpunit/tests/post/wpInsertPost.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1090,14 +1090,13 @@ public function test_insert_empty_post_date() {
$this->assertSame( $post_date_gmt, $post->post_date_gmt );

// Invalid post_date_gmt
$post_id = self::factory()->post->create(
$error = self::factory()->post->create_and_get(
array(
'post_date_gmt' => $invalid_date,
)
);
$post = get_post( $post_id );
$this->assertSame( '1970-01-01 00:00:00', $post->post_date );
$this->assertSame( '0000-00-00 00:00:00', $post->post_date_gmt );

$this->assertWPError( $error );
}

/**
Expand Down Expand Up @@ -1163,16 +1162,17 @@ public function test_insert_valid_post_date() {
$this->assertSame( $post_date, $post->post_date );
$this->assertSame( $post_date_gmt, $post->post_date_gmt );

/**
* @ticket 36738
*/
// Invalid post_date_gmt
$post_id = self::factory()->post->create(
$post = self::factory()->post->create_and_get(
array(
'post_date' => $post_date,
'post_date_gmt' => $invalid_date,
)
);
$post = get_post( $post_id );
$this->assertSame( $post_date, $post->post_date );
$this->assertSame( '0000-00-00 00:00:00', $post->post_date_gmt );
$this->assertWPError( $post );
}

/**
Expand Down
Loading