php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #78139 timezone_open accepts invalid timezone string argument
Submitted: 2019-06-11 06:30 UTC Modified: 2022-05-20 15:24 UTC
From: baby-luck at earthling dot net Assigned: derick (profile)
Status: Closed Package: Date/time related
PHP Version: 7.2.19 OS: Linux
Private report: No CVE-ID: None
 [2019-06-11 06:30 UTC] baby-luck at earthling dot net
Description:
------------
timezone_open() accepts undocumented/nonsense/partial timezones.
The docs say "One of the supported timezone names or an offset value" but accepts seemingly nonsense timezones without failure, and timezones found in the first non-whitespace block in the argument string.

Test script:
---------------
$tz = timezone_open("x UTC");
echo '"x UTC" = '; var_dump($tz);

$tz = timezone_open("c");
echo '"c" = '; var_dump($tz);

$tz = timezone_open("xx UTC");
echo '"xx UTC" = '; var_dump($tz);

$tz = timezone_open("xUTC");
echo '"xUTC" = '; var_dump($tz);

$tz = timezone_open("UTCx");
echo '"UTCx" = '; var_dump($tz);

$tz = timezone_open("UTC xx");
echo '"UTC xx" = '; var_dump($tz);


Expected result:
----------------
"x UTC" = bool(false)
"c" = bool(false)
"xx UTC" = bool(false)
"xUTC" = bool(false)
"UTCx" = bool(false)
"UTC xx" = bool(false)


Actual result:
--------------
"x UTC" = object(DateTimeZone)#127 (2) {
  ["timezone_type"]=>
  int(2)
  ["timezone"]=>
  string(1) "X"
}
"c" = object(DateTimeZone)#128 (2) {
  ["timezone_type"]=>
  int(2)
  ["timezone"]=>
  string(1) "C"
}
"xx UTC" = bool(false)
"xUTC" = bool(false)
"UTCx" = bool(false)
"UTC xx" = object(DateTimeZone)#128 (2) {
  ["timezone_type"]=>
  int(3)
  ["timezone"]=>
  string(3) "UTC"
}

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2019-06-11 06:41 UTC] requinix@php.net
"C" and "X" are valid timezones: military notation representing each hourly division from UTC+12 to UTC-12.

Either
a) this is a doc bug that it takes the first "word" in the string, or
b) this is a code bug and timezone_open should use the whole string
 [2019-06-12 17:31 UTC] baby-luck at earthling dot net
Did not know C,X were military offsets, thanks. 

However, perhaps these qualify as a doc bug in themselves. The docs say "...an offset value (+0200)" with no suggestion at all that a set of military offsets are also supported (probably doesn't matter that they are case insensitive).

Regarding a) or b)... I would agree with those options; for the record my preference would be heavily towards b).
 [2020-01-20 17:18 UTC] girgias@php.net
-Assigned To: +Assigned To: derick
 [2022-05-27 13:44 UTC] git@php.net
Automatic comment on behalf of derickr
Revision: https://github.com/php/php-src/commit/d5e57268a9f516449f5253d825b728244a97f424
Log: Fixed bug #78139 (timezone_open accepts invalid timezone string argument).
 [2022-05-27 13:44 UTC] git@php.net
-Status: Assigned +Status: Closed
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Nov 21 11:01:29 2024 UTC