Changeset 13444

Timestamp:

04/01/2023 08:19:01 AM (20 months ago)

Author:

imath

Message:

Add stricter argument format check to bp_core_time_diff()

bp_core_time_diff() calculates the time difference between 2 dates formatted as a MySql datetime string or a timestamp. To avoid PHP errors due to a plugin misusing this function, we're now making sure these 2 kinds of format are used before calculating the time difference.

Props lenasterg

Fixes #8860

File:

• trunk/src/bp-core/bp-core-functions.php (modified) (2 diffs)

trunk/src/bp-core/bp-core-functions.php

@@ -1291 +1291 @@
     foreach ( array( 'older_date', 'newer_date' ) as $date ) {
         if ( ! $r[ $date ] ) {
+            $r[ $date ] = 0;
             continue;
         }
 
-        if ( ! is_numeric( $r[ $date ] ) ) {
+        if ( preg_match( '/^\d{4}-\d{2}-\d{2}[ ]\d{2}:\d{2}:\d{2}$/', $r[ $date ] ) ) {
             $time_chunks = explode( ':', str_replace( ' ', ':', $r[ $date ] ) );
             $date_chunks = explode( '-', str_replace( ' ', '-', $r[ $date ] ) );
@@ -1305 +1306 @@
                 (int) $date_chunks[0]
             );
+        } elseif ( ! is_int( $r[ $date ] ) ) {
+            $r[ $date ] = 0;
         }
     }