Improve handling of invalid input in time zone abbreviation to TZID route

Drupal 8.1.0-beta1 → was released on March 2, 2016, which means new developments and disruptive changes should now be targeted against the 8.2.x-dev branch. For more information see the Drupal 8 minor version schedule → and the Allowed changes during the Drupal 8 release cycle → .

We're at NOLA right now working on this ticket.

This patch uses intval around $is_daylight_saving_time so we always get a valid JSON object and also prevent the PHP Warning about the parameter type.

I talked to the group working on this issue. They are going to try and reproduce the error, and evaluate the category and priority. :)

Per the documentation below, changing to a Normal Bug instead of a Minor Task.
https://www.drupal.org/core/issue-priority#normal-bug →

Adding tests for invalid values.

Drupal 8.7.0-alpha1 will be released the week of March 11, 2019, which means new developments and disruptive changes should now be targeted against the 8.8.x-dev branch. For more information see the Drupal 8 minor version schedule → and the Allowed changes during the Drupal 8 release cycle → .

Drupal 8.6.0-alpha1 will be released the week of July 16, 2018, which means new developments and disruptive changes should now be targeted against the 8.7.x-dev branch. For more information see the Drupal 8 minor version schedule → and the Allowed changes during the Drupal 8 release cycle → .

Drupal 8.5.0-alpha1 will be released the week of January 17, 2018, which means new developments and disruptive changes should now be targeted against the 8.6.x-dev branch. For more information see the Drupal 8 minor version schedule → and the Allowed changes during the Drupal 8 release cycle → .

Drupal 8.4.0-alpha1 will be released the week of July 31, 2017, which means new developments and disruptive changes should now be targeted against the 8.5.x-dev branch. For more information see the Drupal 8 minor version schedule → and the Allowed changes during the Drupal 8 release cycle → .

Drupal 8.3.0-alpha1 will be released the week of January 30, 2017, which means new developments and disruptive changes should now be targeted against the 8.4.x-dev branch. For more information see the Drupal 8 minor version schedule → and the Allowed changes during the Drupal 8 release cycle → .

Drupal 8.2.0-beta1 → was released on August 3, 2016, which means new developments and disruptive changes should now be targeted against the 8.3.x-dev branch. For more information see the Drupal 8 minor version schedule → and the Allowed changes during the Drupal 8 release cycle → .

The last submitted patch, 6: cleanup_timezone-2505579-6-test-only.patch, failed testing.

General cleanup of this controller, adding safety, improving documentation, improving test coverage.

I've added safety for offset integers less than or greater than a reasonable offset. Added safety on the route level by adding simple regex checks.

Added extra tests, there is not much coverage for this route at all. Moved \Drupal\Tests\system\Functional\Datetime\DrupalDateTimeTest::testSystemTimezone to dedicated test file, as DrupalDateTimeTest should be for testing the DrupalDateTime class.

Moved tests from previous patch to a different file, as the test was actually covering DrupalDateTime object, not this route.

Some documentation changes:

• @return improvement: JSON object can also contain just a 'false' string, JS already correctly handles it.
• Update use of 'time zone name' / 'timezone name' phrases to 'time zone identifier' aka (TZID) as agreed in #3016064: Improve documentation for Datetime and Datelist #date_timezone property →
• Fixes typo "isdst"
• Fixed multiline method shortdoc to single line.
• Fixed inconsistent usage of "abbr" to "abbreviation".
• Fixed inconsistent usage of "timezone" to "time zone" (see also #3016064: Improve documentation for Datetime and Datelist #date_timezone property → )
• Fixed $is_daylight_saving_time@param type from bool to int.

The last submitted patch, 16: 2505579-timezone-controller-16-tests-only.patch, failed testing. View results →

Improved title and summary.

Drupal 9.4.0-alpha1 → was released on May 6, 2022, which means new developments and disruptive changes should now be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule → and the Allowed changes during the Drupal core release cycle → .

Drupal 9.3.0-rc1 → was released on November 26, 2021, which means new developments and disruptive changes should now be targeted for the 9.4.x-dev branch. For more information see the Drupal core minor version schedule → and the Allowed changes during the Drupal core release cycle → .

Drupal 9.2.0-alpha1 → will be released the week of May 3, 2021, which means new developments and disruptive changes should now be targeted for the 9.3.x-dev branch. For more information see the Drupal core minor version schedule → and the Allowed changes during the Drupal core release cycle → .

Drupal 9.1.0-alpha1 → will be released the week of October 19, 2020, which means new developments and disruptive changes should now be targeted for the 9.2.x-dev branch. For more information see the Drupal 9 minor version schedule → and the Allowed changes during the Drupal 9 release cycle → .

Drupal 8.9.0-beta1 → was released on March 20, 2020. 8.9.x is the final, long-term support (LTS) minor release of Drupal 8, which means new developments and disruptive changes should now be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule → and the Allowed changes during the Drupal 8 and 9 release cycles → .

Drupal 8.8.0-alpha1 will be released the week of October 14th, 2019, which means new developments and disruptive changes should now be targeted against the 8.9.x-dev branch. (Any changes to 8.9.x will also be committed to 9.0.x in preparation for Drupal 9’s release, but some changes like significant feature additions will be deferred to 9.1.x.). For more information see the Drupal 8 and 9 minor version schedule → and the Allowed changes during the Drupal 8 and 9 release cycles → .

Drupal 9.5.0-beta2 → and Drupal 10.0.0-beta2 → were released on September 29, 2022, which means new developments and disruptive changes should now be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule → and the Allowed changes during the Drupal core release cycle → .

Is this a PHP5 only issue? If so then this can be closed because Drupal recommends 7.4 or higher.

Since this moved to PNMI over 3 months ago, which is the threshold going to close as outdated.

If still a valid issue please reopen with an updated issue summary

Thanks

If so then this can be closed because Drupal recommends 7.4 or higher.

Not sure why PHP version was thought to be the issue here.

The testing steps are still applicable for Drupal 10.1 + PHP 8.1 and result in a fatal error:

In a browser, visit the path /system/timezone/CET/1/x

TypeError: timezone_name_from_abbr(): Argument #3 ($isDST) must be of type int, string given in timezone_name_from_abbr() (line 34 of core/modules/system/src/Controller/TimezoneController.php).

Thank for you for the followup

Patch or MR doesn't apply anymore
The last patch or MR doesn't apply to the target branch, please reroll the code so that it can be reviewed by the automated testbot.

rerolling the patch and verified it.

@NivethaSubramaniyan

Why is your patch missing so much from the previous patch?

@dpi, It seems like in the patch new file have not been added. I have updated that . I have taken this one as base [2505579-timezone-controller-16.patch] to provide patch for 10.1 and attached the same. Pls check and let me know if I am missing

Fixing CCF in #33

Rerolled the patch #34 in Drupal 10.1.x and Fixing CCF

#35 @Medha Kumar is yet again missing patch contents from previous patches.

Rerolled #16

The last submitted patch, 37: 2505579-37.patch, failed testing. View results →

Fixed up the tests.

+++ b/core/modules/system/src/Controller/TimezoneController.php
@@ -5,33 +5,48 @@
    */
   public function getTimezone($abbreviation = '', $offset = -1, $is_daylight_saving_time = NULL) {
+    $offset = intval($offset);
+    // Out of bounds check for offset. Offset +/- UTC is typically no
+    // smaller/larger than -12/+14.
+    if ($offset < -60000 || $offset > 60000) {
+      return new JsonResponse(FALSE);

I was going to ask about adding type hints in the future and deprecating bool parameters now etc. then I realised this is an AJAX route and... no we don't need to do all that patch is fine as-is.

Looks good to me.

Committed to 10.1.x and backported to 10.0.x and 9.5.x

Thanks everyone.

dpi → closed merge request !3089

Drupal 9.5.7
PHP 8.1
When accessing /system/timezone/CET/1 (where isdst is set to null by default), got Waring:

Deprecated function: timezone_name_from_abbr(): Passing null to parameter #3 ($isDST) of type int is deprecated in Drupal\system\Controller\TimezoneController->getTimezone() (line 34 of /var/www/web/core/modules/system/src/Controller/TimezoneController.php)

In MR I don't see this be changed.

Automatically closed - issue fixed for 2 weeks with no activity.

    // Set default if $is_daylight_saving_time is NULL.
    $is_daylight_saving_time = isset($is_daylight_saving_time) ? min(1, max(-1, intval($is_daylight_saving_time))) : -1;