[wp-trac] [WordPress Trac] #56311: Week query variable is not being sanitized correctly

[WordPress Trac]

#56311: Week query variable is not being sanitized correctly
-------------------------------------+-----------------------
 Reporter:  domainsupport            |       Owner:  audrasjb
     Type:  defect (bug)             |      Status:  assigned
 Priority:  normal                   |   Milestone:  6.2
Component:  Query                    |     Version:
 Severity:  normal                   |  Resolution:
 Keywords:  has-patch needs-testing  |     Focuses:
-------------------------------------+-----------------------

Comment (by peterwilsoncc):

 I'd rather validate this in `src/wp-includes/class-wp.php` than in the
 date query.

 The `WP` class is intended to validate the user input via the URL whereas
 `WP_Date_Query` is intended as a developer API. Adding checks for `$_GET`
 values in the latter seems a little sub-optimal.

 I think a method similar to `WP_Date_Query::validate_date_values()` could
 be created in the `WP` class to validate the query strings parameters.
 This can silently discard (or throw a 404 for) invalid values.

 Unfortunately `WP_Date_Query` doesn't know if it's being called for the
 main query so it doesn't appear possible to mute the warnings for the main
 query only.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/56311#comment:17>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform