kohana / core

Core system classes from Kohana
http://kohanaframework.org
635 stars 327 forks source link

Function Valid::date for timestamp #705

Open mati1986 opened 7 years ago

mati1986 commented 7 years ago

I noticed recently that the function Valid::date has stopped working for timestamp.

    /**
     * Tests if a string is a valid date string.
     *
     * @param   string  $str    date to check
     * @return  boolean
     */
    public static function date($str)
    {
        return (strtotime($str) !== FALSE);
    }

Example:

$str = 1499385600; // 07/07/2017
var_dump(strtotime($str) !== FALSE); // false
$str = 1500422400; // 07/19/2017
var_dump(strtotime($str) !== FALSE); // true
acoulton commented 7 years ago

Thanks for reporting this. There's not really any active Kohana development any longer, though if you want to PR a fix we'd take a look.

Personally, I don't think Valid::date should ever have been accepting timestamp arguments : strtotime's parsing of them is not what you'd expect:

php > $str = 1500422400;
php > print date('Y-m-d H:i:s', $str)."\n";
2017-07-19 01:00:00
php > print strtotime($str)."\n";
13586799642
php > print date('Y-m-d H:i:s', strtotime($str))."\n";
2400-07-19 15:00:42
php > print_r(new \DateTime($str));
DateTime Object
(
    [date] => 2400-07-19 15:00:42
    [timezone_type] => 3
    [timezone] => Europe/London
)

It's not recognising it as a timestamp, but as a time followed by a partial date. The 1499385600 fails because 14:99 isn't a valid time.

So, even if Valid::date accepted timestamps reliably, it wouldn't be safe to handle them in your application unless you knew that's what they were and treated them differently to a date string.

If you actually want to accept only timestamps then I'd suggest validating as an integer within a suitable range, and explicitly treating as a timestamp in your application code.

If you want to accept date strings, then potentially it's better to use a custom date validator that's more restrictive about the formats it accepts.