WP_Query's "m" parameter is cast to an int which is a problem due to 32-bit signed intergers

[Viper007Bond]

WP_Query's m parameter accepts MySQL datetimes basically. These values can be up to 14 characters long (YYYYMMDDHHMMSS). For the long values, you end up with ​2147483647 when the passed value is run through absint(). While in the process of being used to create a query, it is further validated by being run through preg_replace( '|[^0-9]|', '', $q['m'] ) which makes the integer casting redundant.

Attached is a patch that fixes this issue by just using regex to validate the value.

I discovered this while writing unit tests for #18694 and with the patch on this ticket applied, the unit tests now work as expected. This is another case of unit tests saving the day! :)

[wonderboymusic]

Yep.

[Viper007Bond]

Unit tests for this are included as a part of #18694.

[nacin]

In 25138:

Don't cast the 'm' query variable to an integer as the value can exceed the range of a 32-bit signed integer.

props Viper007Bond.
fixes #24884.

[nacin]

Tests added in [25139].

[boonebgorges]

In 37324:

Query: Discard non-scalar 'm' instead of attempting to sanitize.

WP_Query discards most non-array date values ('year', 'monthnum', etc) by
casting to integer. Since [25138], the 'm' parameter has been handled
as a string; see #24884. However, the string-handling introduced in [25138]
blindly attempted to handle arrays and other non-scalar types as strings,
resulting in PHP notices and invalid MySQL syntax.

Props vortfu.
Fixes #36718.