XML-RPC: Fatal error when a date field is not a dateTime.iso8601

[josephscott]

Six XML-RPC methods accept date values from the client and call getIso() or getTimestamp() on them, assuming they are IXR_Date objects. That is only true when the client sends a dateTime.iso8601 value. A client sending the date as an array for example, causes a fatal error in PHP.

This can happen with:

• wp.editPost ( post_date, post_date_gmt, if_not_modified_since )
• wp.newPost ( post_date, post_date_gmt )
• wp.editComment ( date_created_gmt )
• metaWeblog.newPost ( dateCreated, date_created_gmt )
• metaWeblog.editPost ( dateCreated, date_created_gmt )

wp.newPost is the only one of these that accepts a string. The other four fatal on a string as well.

#28601 fixed this for strings in wp.newPost back in 4.0, but that fix only covered wp.newPost, and it still fatals there when the value is an array because it passes the value straight into date_create(). #42995 is the same fatal in wp.editComment and is still open.

It is very easy to reproduce -

curl -s http://localhost:8889/xmlrpc.php -H 'Content-Type: text/xml' --data '<?xml version="1.0"?>
<methodCall>
  <methodName>wp.editPost</methodName>
  <params>
    <param><value><int>1</int></value></param>
    <param><value><string>admin</string></value></param>
    <param><value><string>password</string></value></param>
    <param><value><int>1</int></value></param>
    <param><value><struct>
      <member><name>post_date</name><value><array><data>
        <value><string>2026-01-01 00:00:00</string></value>
      </data></array></value></member>
    </struct></value></param>
  </params>
</methodCall>'

I've got a PR that adds a single wp_xmlrpc_server::_convert_client_date() helper and uses it at each of these call sites. An IXR_Date passes through untouched, a string is converted the same way wp.newPost already does, and anything else returns a 400 IXR_Error to the client instead of a fatal error. It also fixes #42995.

https://core.trac.wordpress.org/ticket/66107

AI assistance: Yes
Tool(s): Claude Code
Model(s): Fable 5.1
Used for: Research and experimentation. Guided directions on writing the code changes. It wrote the tests.

I haven't looked at what would be involved in re-using the REST API functions to validate and sanitize the incoming data. Not it scope for this ticket, but it could be an interesting idea to explore.

I think fixing mysql2date() should be a separate PR.