From ca4c72edba7792646ceaaf5122089c5847831bce Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc=20V=C3=A9ron?= <veron@veron.ch>
Date: Thu, 1 Oct 2015 22:00:20 +0200
Subject: [PATCH] [SIGNED-OFF]Bug 14924 - (follow-up) Add date validation
 using eval

This patch adds a date validation (see comment #3).

To test:

- Apply patch
- Create a new user or edit an existing user
- Try valid dates for date of birth
- Try invalid dates as 0000-00-00 or 32/01/1970. You can can
  copy/paste such strings to the date field, ignore the warning
  message and submit. Verify that after submit you get a message
  "Date of birth is invalid"
- Try the same with enrollement /expiry dates

Signed-off-by: Hector Castro <hector.hecaxmmx@gmail.com>
Works as advertised. Tested with invalid dates.
---
 members/memberentry.pl |   12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/members/memberentry.pl b/members/memberentry.pl
index 63e8401..ba705a5 100755
--- a/members/memberentry.pl
+++ b/members/memberentry.pl
@@ -169,8 +169,14 @@ if ( $op eq 'insert' || $op eq 'modify' || $op eq 'save' || $op eq 'duplicate' )
     foreach (qw(dateenrolled dateexpiry dateofbirth)) {
         next unless exists $newdata{$_};
         my $userdate = $newdata{$_} or next;
-        if ( $userdate ) {
-            $newdata{$_} = output_pref({ dt => dt_from_string( $userdate ), dateformat => 'iso', dateonly => 1 });
+
+        my $formatteddate = eval { output_pref({ dt => dt_from_string( $userdate ), dateformat => 'iso', dateonly => 1 } ); };
+        if ( $formatteddate ) {
+            $newdata{$_} = $formatteddate;
+        } else {
+            ($userdate eq '0000-00-00') and warn "Data error: $_ is '0000-00-00'";
+            $template->param( "ERROR_$_" => 1 );
+            push(@errors,"ERROR_$_");
         }
     }
   # check permission to modify login info.
@@ -646,7 +652,7 @@ if (C4::Context->preference('uppercasesurnames')) {
 
 foreach (qw(dateenrolled dateexpiry dateofbirth)) {
     if ( $data{$_} ) {
-        $data{$_} = output_pref({ dt => dt_from_string( $data{$_} ), dateonly => 1 }); # back to syspref for display
+       $data{$_} = eval { output_pref({ dt => dt_from_string( $data{$_} ), dateonly => 1 } ); };  # back to syspref for display
     }
     $template->param( $_ => $data{$_});
 }
-- 
1.7.10.4