From 1c7954fc51d8569f5a2cd2c5505df884236054f4 Mon Sep 17 00:00:00 2001
From: Andrew Ruthven <andrew@etc.gen.nz>
Date: Fri, 1 Mar 2024 23:42:21 +1300
Subject: [PATCH] Enforce dates to be send as string (fixes #233)

Prevents AWL/PG from converting them magically.
---
 inc/caldav-PUT-functions.php | 27 ++++++++++++++++++++-------
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/inc/caldav-PUT-functions.php b/inc/caldav-PUT-functions.php
index e1e47c32..dbf21dca 100644
--- a/inc/caldav-PUT-functions.php
+++ b/inc/caldav-PUT-functions.php
@@ -181,6 +181,19 @@ function GetTZID( vComponent $comp ) {
   return $p->GetParameterValue('TZID');
 }
 
+/**
+ * Quotes a DateTime parameter (e.g. DTSTART) for the database
+ *
+ * @var string|null $dt
+ * @return string|null
+ */
+function quote_dt_param($dt) {
+    if (null === $dt || '' === $dt) {
+        return null;
+    }
+
+    return "'" . $dt . "'";
+}
 
 /**
 * Deliver scheduling requests to attendees
@@ -1086,8 +1099,8 @@ EOSQL;
     $dav_data_params[':session_user'] = $session->user_no;
 
     $dtstart = $first->GetPValue('DTSTART');
-    $calitem_params[':dtstart_orig'] = $dtstart;
-    $calitem_params[':dtstart'] = $dtstart;
+    $calitem_params[':dtstart_orig'] = quote_dt_param($dtstart);
+    $calitem_params[':dtstart'] = quote_dt_param($dtstart);
 
     if ( (!isset($dtstart) || $dtstart == '') && $first->GetPValue('DUE') != '' ) {
       $dtstart = $first->GetPValue('DUE');
@@ -1129,11 +1142,11 @@ EOSQL;
     }
 
     $dtend = $first->GetPValue('DTEND');
-    $calitem_params[':dtend_orig'] = $dtend;
+    $calitem_params[':dtend_orig'] = quote_dt_param($dtend);
 
     if ( isset($dtend) && $dtend != '' ) {
       dbg_error_log( 'PUT', ' DTEND: "%s", DTSTART: "%s", DURATION: "%s"', $dtend, $dtstart, $first->GetPValue('DURATION') );
-      $calitem_params[':dtend'] = $dtend;
+      $calitem_params[':dtend'] = quote_dt_param($dtend);
       $dtend = ':dtend';
     }
     else {
@@ -1486,10 +1499,10 @@ function write_resource( DAVResource $resource, $caldav_data, DAVResource $colle
      $dtstart = $dtstart . "T000000Z";
      $calitem_params[':dtstart_orig'] = $dtstart;
   }
-  $calitem_params[':dtstart'] = $dtstart;
+  $calitem_params[':dtstart'] = quote_dt_param($dtstart);
 
   $dtend = $first->GetPValue('DTEND');
-  $calitem_params[':dtend_orig'] = $dtend;
+  $calitem_params[':dtend_orig'] = quote_dt_param($dtend);
 
   if ( isset($dtend) && $dtend != '' ) {
     dbg_error_log( 'PUT', ' DTEND: "%s", DTSTART: "%s", DURATION: "%s"', $dtend, $dtstart, $first->GetPValue('DURATION') );
@@ -1497,7 +1510,7 @@ function write_resource( DAVResource $resource, $caldav_data, DAVResource $colle
        $dtend = $dtend . "T000000Z";
        $calitem_params[':dtend_orig'] = $dtend;
     }
-    $calitem_params[':dtend'] = $dtend;
+    $calitem_params[':dtend'] = quote_dt_param($dtend);
     $dtend = ':dtend';
   }
   else {