Ticket #26798: 26798.3.diff

src/wp-includes/post.php

@@ -4912 +4912 @@
                 }
         }
 
-        // Validate the date.
-        $month = substr( $post_date, 5, 2 );
-        $day   = substr( $post_date, 8, 2 );
-        $year  = substr( $post_date, 0, 4 );
+        // Ensure we have a valid mysql date-formatted string (YYYY-MM-DD H:i:s).
+        preg_match( "/^([0-9]{4})-(0[1-9]|1[0-2])-(0[1-9]|[1-2][0-9]|3[0-1])[\s](?:[0-1][0-9]|2[1-3]):[0-5][0-9]:[0-5][0-9]$/", $post_date, $matches );
+        if ( empty( $matches ) || ! is_array( $matches ) || count( $matches ) < 4 ) {
+                return false;
+        }
 
-        $valid_date = wp_checkdate( $month, $day, $year, $post_date );
+        $valid_date = wp_checkdate( $matches[2], $matches[3], $matches[1], $post_date );
 
         if ( ! $valid_date ) {
                 return false;
         }
+
         return $post_date;
 }
 

tests/phpunit/tests/post.php

@@ -1220 +1220 @@
                 $this->assertSame( $post['post_date_gmt'], $out->post_date_gmt );
         }
 
+        /**
+         * @ticket 26798
+         *
+         * On a deeper level, this is handled by test_wp_resolve_post_date.
+         */
+        public function test_wp_insert_post_reject_malformed_post_date() {
+                $post = array(
+                        'post_author'   => self::$editor_id,
+                        'post_status'   => 'publish',
+                        'post_content'  => 'content',
+                        'post_title'    => 'title',
+                        'post_date'     => '2012-01-8 12:00:00',
+                );
+
+                // Inserting the post should fail gracefully.
+                $id = wp_insert_post( $post );
+                $this->assertSame( 0, $id );
+        }
+
         public function test_wp_delete_post_reassign_hierarchical_post_type() {
                 $grandparent_page_id = self::factory()->post->create( array( 'post_type' => 'page' ) );
                 $parent_page_id      = self::factory()->post->create(
@@ -1639 +1658 @@
                 $this->assertFalse( $resolved_post_date );
         }
 
+        /**
+         * @ticket 26798
+         *
+         * Tests the regex inside of wp_resolve_post_date().
+         */
+        public function test_wp_resolve_post_date_regex() {
+                $invalid_dates = array(
+                        '2012-01-08',
+                        '201-01-08 00:00:00',
+                        '201a-01-08 00:00:00',
+                        '2012-1-08 00:00:00',
+                        '2012-31-08 00:00:00',
+                        '2012-01-8 00:00:00',
+                        '2012-01-48 00:00:00',
+                        '2012-01-08 0:00:00',
+                        '2012-01-08 24:00:00',
+                        '2012-01-08 00:0:00',
+                        '2012-01-08 00:60:00',
+                        '2012-01-08 00:00:0',
+                        '2012-01-08 00:00:60',
+                );
+                foreach( $invalid_dates as $date ) {
+                        $out = wp_resolve_post_date( $date );
+                        $this->assertFalse( $out );
+                }
+        }
+
         /**
          * Ensure sticking a post updates the `sticky_posts` option.
          *