WordPress.org

Make WordPress Core

Opened 2 years ago

Closed 14 months ago

Last modified 7 months ago

#44491 closed enhancement (fixed)

Date/time calculations should not depend on default UTC time zone

Reported by: Rarst Owned by:
Milestone: 5.3 Priority: normal
Severity: normal Version:
Component: Date/Time Keywords:
Focuses: Cc:

Description

At the moment WP explicitly sets default PHP time zone to UTC during core load. A lot of calculations in core depend on that being the case when they execute.

Unfortunately as a runtime setting this can be easily changed by extensions, and there are plenty out there that mess it up.

While we cannot stop setting time zone to UTC (which would be giant backwards compatibility break) we can and should make all calculations in core independent of this context.

Specific things that should be fixed or audited:

  • no date() calls, only gmdate();
  • no strtotime() calls on input with ambiguous time zone;
  • no DateTime instancing without explicit time zone.

Will work on a patch.

Change History (9)

#1 @pento
19 months ago

  • Version trunk deleted

#4 @nielsdeblaauw
17 months ago

Looking at the current trunk version I see some uses of getdate() which also uses the local time (same as date()). See https://secure.php.net/manual/en/function.getdate.php

We should probably add this to the list and investigate it's usage and alternatives.

The only occurances of getdate() is two instances in wp-admin/includes/class-pclzip.php as far as I can see.

Last edited 17 months ago by nielsdeblaauw (previous) (diff)

#5 @Rarst
17 months ago

I looked at getdate() and the only use is indeed in third-party-ish code, so I think we can leave it alone for now.

#6 @SergeyBiryukov
15 months ago

In 45424:

Date/Time: Replace all instances of date() with gmdate().

Use of date() in core depends on PHP timezone set to UTC and not changed by third party code (which cannot be guaranteed).

gmdate() is functionally equivalent, but is not affected by PHP timezone setting: it's always UTC, which is the exact behavior the core needs.

Props nielsdeblaauw, Rarst.
Fixes #46438. See #44491.

#7 @Rarst
14 months ago

  • Resolution set to fixed
  • Status changed from new to closed

It seems the rest of it isn't friendly to a bulk change, since it's hard to scan if input format has a time zone or not.

Obviously I am writing new API functions as immune to the problem, and rest stuff will have to be just ongoing work.

#8 @desrosj
14 months ago

  • Milestone changed from Awaiting Review to 5.3

Moving this to the 5.3 milestone.

#9 @SergeyBiryukov
7 months ago

In 47080:

Tests: Replace date() with gmdate() in WP_Test_REST_Posts_Controller tests.

Follow-up to [45424], [46252].

See #46438, #44491, #39953.

Note: See TracTickets for help on using tickets.