Improve handling of invalid input in time zone abbreviation to TZID route

+++ b/core/modules/system/src/Controller/TimezoneController.php
@@ -5,33 +5,48 @@
    */
   public function getTimezone($abbreviation = '', $offset = -1, $is_daylight_saving_time = NULL) {
+    $offset = intval($offset);
+    // Out of bounds check for offset. Offset +/- UTC is typically no
+    // smaller/larger than -12/+14.
+    if ($offset < -60000 || $offset > 60000) {
+      return new JsonResponse(FALSE);

I was going to ask about adding type hints in the future and deprecating bool parameters now etc. then I realised this is an AJAX route and... no we don't need to do all that patch is fine as-is.

Looks good to me.

Committed to 10.1.x and backported to 10.0.x and 9.5.x

Thanks everyone.

dpi → closed merge request !3089

Drupal 9.5.7
PHP 8.1
When accessing /system/timezone/CET/1 (where isdst is set to null by default), got Waring:

Deprecated function: timezone_name_from_abbr(): Passing null to parameter #3 ($isDST) of type int is deprecated in Drupal\system\Controller\TimezoneController->getTimezone() (line 34 of /var/www/web/core/modules/system/src/Controller/TimezoneController.php)

In MR I don't see this be changed.

Automatically closed - issue fixed for 2 weeks with no activity.