Date/time calculations should not depend on default UTC time zone

[Rarst]

At the moment WP explicitly sets default PHP time zone to UTC during core load. A lot of calculations in core depend on that being the case when they execute.

Unfortunately as a runtime setting this can be easily changed by extensions, and there are plenty out there that mess it up.

While we cannot stop setting time zone to UTC (which would be giant backwards compatibility break) we can and should make all calculations in core independent of this context.

Specific things that should be fixed or audited:

• no date() calls, only gmdate();
• no strtotime() calls on input with ambiguous time zone;
• no DateTime instancing without explicit time zone.

Will work on a patch.

[SergeyBiryukov]

Previously: #37440

[SergeyBiryukov]

Related: #46438

[nielsdeblaauw]

Looking at the current trunk version I see some uses of getdate() which also uses the local time (same as date()). See ​https://secure.php.net/manual/en/function.getdate.php

We should probably add this to the list and investigate it's usage and alternatives.

The only occurances of getdate() is two instances in wp-admin/includes/class-pclzip.php as far as I can see.

[Rarst]

I looked at getdate() and the only use is indeed in third-party-ish code, so I think we can leave it alone for now.

[SergeyBiryukov]

In 45424:

Date/Time: Replace all instances of date() with gmdate().

Use of date() in core depends on PHP timezone set to UTC and not changed by third party code (which cannot be guaranteed).

gmdate() is functionally equivalent, but is not affected by PHP timezone setting: it's always UTC, which is the exact behavior the core needs.

Props nielsdeblaauw, Rarst.
Fixes #46438. See #44491.

[Rarst]

It seems the rest of it isn't friendly to a bulk change, since it's hard to scan if input format has a time zone or not.

Obviously I am writing new API functions as immune to the problem, and rest stuff will have to be just ongoing work.

[desrosj]

Moving this to the 5.3 milestone.

[SergeyBiryukov]

In 47080:

Tests: Replace date() with gmdate() in WP_Test_REST_Posts_Controller tests.

Follow-up to [45424], [46252].

See #46438, #44491, #39953.