From 8480fed9338af422cfeb693e560b5796140f8d19 Mon Sep 17 00:00:00 2001
From: Joe Ferguson <svpernova09@php.net>
Date: Tue, 14 Jul 2026 11:25:29 -0500
Subject: [PATCH] Move string field defaults into EventInput

  Review feedback: with EventInput in place, the remaining $_POST
  defaulting block belongs there too, leaving a single write to $_POST.

  Add STRING_FIELDS to EventInput and rename normalizeNumericFields() to
  normalize(), since it now covers both field groups. The string defaults
  use ??=, which matches the previous !isset() check -- an explicit null
  is treated as missing either way.

  Add tests for the string defaults, including that a falsy '0' is
  preserved, and retarget the untouched-fields test at an unmanaged field
  now that type/email are normalized.
---
 src/Events/EventInput.php            | 52 ++++++++++++++++
 submit-event.php                     | 24 ++------
 tests/Unit/Events/EventInputTest.php | 89 ++++++++++++++++++++++++++++
 3 files changed, 147 insertions(+), 18 deletions(-)
 create mode 100644 src/Events/EventInput.php
 create mode 100644 tests/Unit/Events/EventInputTest.php

diff --git a/src/Events/EventInput.php b/src/Events/EventInput.php
new file mode 100644
index 0000000000..e5b2747395
--- /dev/null
+++ b/src/Events/EventInput.php
@@ -0,0 +1,52 @@
+<?php
+
+declare(strict_types=1);
+
+namespace phpweb\Events;
+
+final class EventInput
+{
+    /**
+     * The numeric event fields (start/end date parts and recurrence) that must be
+     * integers before being passed to checkdate() or mktime().
+     */
+    private const NUMERIC_FIELDS = [
+        'sday', 'smonth', 'syear', 'eday',
+        'emonth', 'eyear', 'recur', 'recur_day',
+    ];
+
+    /**
+     * The free-text event fields, which default to an empty string so the form can
+     * be rendered and validated without E_WARNING on undefined array keys.
+     */
+    private const STRING_FIELDS = [
+        'type', 'country', 'category', 'email', 'url', 'ldesc', 'sdesc',
+    ];
+
+    /**
+     * Normalize a raw event submission so every known field is present and of the
+     * expected type.
+     *
+     * Untrusted numeric input (non-numeric strings, arrays, missing values) would
+     * otherwise reach checkdate()/mktime() and throw a TypeError under PHP 8.
+     * Anything that is not a numeric value becomes 0, i.e. an invalid date that the
+     * normal form validation already rejects. Missing text fields become an empty
+     * string. Unknown fields are left untouched.
+     *
+     * @param array<string, mixed> $post
+     * @return array<string, mixed>
+     */
+    public static function normalize(array $post): array
+    {
+        foreach (self::NUMERIC_FIELDS as $field) {
+            $value = $post[$field] ?? null;
+            $post[$field] = is_numeric($value) ? (int) $value : 0;
+        }
+
+        foreach (self::STRING_FIELDS as $field) {
+            $post[$field] ??= '';
+        }
+
+        return $post;
+    }
+}
diff --git a/submit-event.php b/submit-event.php
index 2d2ac20044..ab09f89d1c 100644
--- a/submit-event.php
+++ b/submit-event.php
@@ -1,4 +1,6 @@
 <?php
+use phpweb\Events\EventInput;
+
 $_SERVER['BASE_PAGE'] = 'submit-event.php';
 include_once __DIR__ . '/include/prepend.inc';
 include_once __DIR__ . '/include/posttohost.inc';
@@ -9,24 +11,10 @@
 $errors = [];
 $process = [] !== $_POST;
 
-// Avoid E_NOTICE errors on incoming vars if not set
-$vars = [
-    'sday', 'smonth', 'syear', 'eday',
-    'emonth', 'eyear', 'recur', 'recur_day',
-];
-foreach ($vars as $varname) {
-    if (empty($_POST[$varname])) {
-        $_POST[$varname] = 0;
-    }
-}
-$vars = [
-    'type', 'country', 'category', 'email', 'url', 'ldesc', 'sdesc',
-];
-foreach ($vars as $varname) {
-    if (!isset($_POST[$varname])) {
-        $_POST[$varname] = "";
-    }
-}
+// Default the missing fields and coerce the numeric date/recurrence fields to
+// integers, so untrusted input can be passed safely to checkdate()/mktime() below
+// instead of throwing a TypeError.
+$_POST = EventInput::normalize($_POST);
 
 // We need to process some form data
 if ($process) {
diff --git a/tests/Unit/Events/EventInputTest.php b/tests/Unit/Events/EventInputTest.php
new file mode 100644
index 0000000000..951427a916
--- /dev/null
+++ b/tests/Unit/Events/EventInputTest.php
@@ -0,0 +1,89 @@
+<?php
+
+declare(strict_types=1);
+
+namespace phpweb\Test\Unit\Events;
+
+use phpweb\Events\EventInput;
+use PHPUnit\Framework;
+
+#[Framework\Attributes\CoversClass(EventInput::class)]
+final class EventInputTest extends Framework\TestCase
+{
+    public function testCoercesNumericStringsToIntegers(): void
+    {
+        $result = EventInput::normalize(['smonth' => '12', 'sday' => '25', 'syear' => '2026']);
+
+        self::assertSame(12, $result['smonth']);
+        self::assertSame(25, $result['sday']);
+        self::assertSame(2026, $result['syear']);
+    }
+
+    public function testCoercesNonNumericStringsToZero(): void
+    {
+        $result = EventInput::normalize(['smonth' => 'January', 'sday' => 'abc', 'syear' => '12abc']);
+
+        self::assertSame(0, $result['smonth']);
+        self::assertSame(0, $result['sday']);
+        self::assertSame(0, $result['syear']);
+    }
+
+    public function testCoercesArrayValuesToZero(): void
+    {
+        $result = EventInput::normalize(['smonth' => ['x'], 'sday' => [], 'syear' => ['1', '2']]);
+
+        self::assertSame(0, $result['smonth']);
+        self::assertSame(0, $result['sday']);
+        self::assertSame(0, $result['syear']);
+    }
+
+    public function testDefaultsMissingNumericFieldsToZero(): void
+    {
+        $result = EventInput::normalize([]);
+
+        foreach (['sday', 'smonth', 'syear', 'eday', 'emonth', 'eyear', 'recur', 'recur_day'] as $field) {
+            self::assertSame(0, $result[$field], $field);
+        }
+    }
+
+    public function testDefaultsMissingStringFieldsToEmptyString(): void
+    {
+        $result = EventInput::normalize([]);
+
+        foreach (['type', 'country', 'category', 'email', 'url', 'ldesc', 'sdesc'] as $field) {
+            self::assertSame('', $result[$field], $field);
+        }
+    }
+
+    public function testKeepsSuppliedStringFields(): void
+    {
+        $result = EventInput::normalize(['email' => 'a@b.com', 'type' => 'multi', 'sdesc' => '0']);
+
+        self::assertSame('a@b.com', $result['email']);
+        self::assertSame('multi', $result['type']);
+        self::assertSame('0', $result['sdesc']);
+    }
+
+    public function testLeavesUnknownFieldsUntouched(): void
+    {
+        $result = EventInput::normalize(['sname' => 'PHP UK', 'smonth' => '5']);
+
+        self::assertSame('PHP UK', $result['sname']);
+        self::assertSame(5, $result['smonth']);
+    }
+
+    /**
+     * Regression test for the production fatal:
+     *   Uncaught TypeError: checkdate(): Argument #1 ($month) must be of type int, string given
+     *
+     * After normalization the date parts are always integers, so passing them to
+     * checkdate() (and mktime()) can no longer throw a TypeError; garbage input
+     * simply becomes an invalid (0) date that the normal validation rejects.
+     */
+    public function testNormalizedValuesAreSafeForCheckdate(): void
+    {
+        $result = EventInput::normalize(['smonth' => 'notamonth', 'sday' => '1', 'syear' => '2026']);
+
+        self::assertFalse(checkdate($result['smonth'], $result['sday'], $result['syear']));
+    }
+}