Description

Update how we store/retrieve serialized values (the text_datetime_timestamp_timezone field).

Also… bumps our min. php support to 7.4 🥳

Motivation and Context

security.

Risk Level

Testing procedure

Before this PR

1. Create fields (preferably in every core object type) with the text_datetime_timestamp_timezone field type

   • example:

   $cmb->add_field( array(
      'name' => __( 'Test Date/Time Picker/Time zone Combo (serialized DateTime object)', 'cmb2' ),
      'desc' => __( 'field description (optional)', 'cmb2' ),
      'id'   => '_yourprefix_demo_datetime_timestamp_timezone',
      'type' => 'text_datetime_timestamp_timezone',
      'time_format' => 'H:i',
      'date_format' => 'Y-m-d',
      // 'repeatable' => true,
      'before_field' => function ( $args, $field ) {
         // echo '<xmp>'. __LINE__ .') $field: '. print_r( $field, true ) .'</xmp>';
         $value = get_post_meta( $field->object_id, $field->id(), 1 );
         echo '<xmp>$value: '. print_r( $value, true ) .'</xmp>';
         $_utc_value = get_post_meta( $field->object_id, $field->id(). '_utc', 1 );
         echo '<xmp>$_utc_value: '. print_r( $_utc_value, true ) .'</xmp>';
      },
      'column' => true,
   ) );

   And you can test the options-page type with the following setup: https://gist.github.com/jtsternberg/d6ab21ca3a7de1a77d1adfefa0b9445f

2. In each object type, udpate the value, save, see that it all works as expected.

3. Check the DB values -- you should see a double-serialized DateTime object

4. Try using get_post_meta to retrieve the value and see that it's a serialized DateTime object. (if you used the example above, you can see the value in the before_field callback).

Next

1. Pull down this PR
2. Review every field in each object type (refresh the page) and make sure field looks/acts correctly.
3. See that the get_post_meta value still gives you a serialized DateTime object.
4. Try storing a bad actor value to the DB: wp post meta update 1 _yourprefix_demo_datetime_timestamp_timezone 'O:4:"Evil":2:{s:4:"hack";N;s:2:"me";R:2;}'
5. Reload the various pages and see that the field still looks/acts correctly, except the value is blank.