Automattic / Automattic/custom-metadata
Multi-value date fields pass an array to strtotime()
- Dominant language
- PHP
- Stars
- 190
- Forks
- 46
- Avg merge
- 46m
- Merged PRs (30d)
- 15
Description
## Bug
In `_sanitize_field_value()`, the date field types (`datepicker`, `datetimepicker`, `timepicker`) run `strtotime( $value )`, which assumes `$value` is a scalar.
Date types are not listed in `_cloneable_field_types` or `_field_types_that_support_multifield`, but a field can still be made repeatable by passing `'multiple' => true` (the render path keys "cloneable" off `$field->multiple` directly). In that case `$value` is an array, `strtotime()` receives an array, and it returns `false` / warns — corrupting the stored value.
## Fix options
Either map `strtotime()` over each element when `$value` is an array, or explicitly disallow `multiple` on date field types. This is an edge case and low priority, but it is a latent data-loss bug worth closing off.
## History
Originally raised in #113 by @tmtrademark (2014). That PR also reordered the `sanitize_callback` so it runs before date conversion — a separate behaviour change to weigh on its own merits. The PR no longer applies cleanly, so it is being closed in favour of this issue, which captures the array-handling fix.
Contributor guide
Research direction
Start in _sanitize_field_value() and trace how the date field types datepicker, datetimepicker, and timepicker handle values when multiple is true. Reproduce the array passed to strtotime(), then verify that repeatable date values are handled without warnings or data loss; choose between per-element conversion and explicitly disallowing multiple date fields.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100