Silverstripe-framework: DateField form field min/max date logic shouldn’t use strtotime()

[kinglozzer]

Affected Version

4.x

Description

DateField has options for setMinDate() and setMaxDate(). Whether a date is valid or not is tested by comparing dates using strtotime(). However, almost all the other date logic in the class uses IntlDateFormatter to parse dates which results in inconsistent behaviour.

https://github.com/silverstripe/silverstripe-framework/blob/97209bc919e5ce6f991f224fc9deadbbd58332f7/src/Forms/DateField.php#L388-L391

Steps to Reproduce

Create an input:

DateField::create('DateOfBirth', 'Date of birth')
    ->setHTML5(false)
    ->setDateFormat('dd/MM/yyyy')
    ->setMinDate('01-01-1900')

Enter a date like 01-01-70. DateField::validate() doesn’t think this is an invalid date, as PHP’s strtotime() (incorrectly) treats 70 as 1970.

[robbieaverill]

Enter a date like 01-01-70. DateField::validate() doesn’t think this is an invalid date, as PHP’s strtotime() (incorrectly) treats 70 as 1970.

Am I missing something? That seems legitimate to me

[kinglozzer]

I can see an argument for assuming that 2-digit years are 19xx, but it’s fairly ambiguous behaviour: https://3v4l.org/CbW8Z.

Running with the example of 01-01-70, the logic in frontendToInternal() which normalises the submitted value is all based around IntlDateFormatter, which treats it as the year 70. It then passes it to strtotime() to check min/max date which treats it as 1970 instead.