Bug: PostsController unvalidated datetime in scheduled_at #95

New Issue

2026-05-29T05:30:29Z

jmiller commented

2026-05-29 05:30:29 +00:00

Audit Finding H-5

Severity: Medium

Issue:
The exportCsv() method applies filters correctly, but when saving posts via the post edit form, the scheduled_at datetime from user input is stored without validation. A malformed datetime could cause MySQL errors.

Fix: Validate datetime format in PostModel::prepareTable() or sanitize via Factory::getDate().

Files: PostModel.php

Label: priority: medium, type: bug

## Audit Finding H-5 **Severity:** Medium **Issue:** The `exportCsv()` method applies filters correctly, but when saving posts via the post edit form, the `scheduled_at` datetime from user input is stored without validation. A malformed datetime could cause MySQL errors. **Fix:** Validate datetime format in `PostModel::prepareTable()` or sanitize via `Factory::getDate()`. **Files:** `PostModel.php` **Label:** `priority: medium`, `type: bug`

jmiller commented

2026-05-29 05:30:31 +00:00

Branch created: feature/95-bug-postscontroller-unvalidated-datetime

git fetch origin
git checkout feature/95-bug-postscontroller-unvalidated-datetime

Branch created: [`feature/95-bug-postscontroller-unvalidated-datetime`](https://git.mokoconsulting.tech/MokoConsulting/MokoJoomCross/src/branch/feature/95-bug-postscontroller-unvalidated-datetime) ```bash git fetch origin git checkout feature/95-bug-postscontroller-unvalidated-datetime ```

Sign in to join this conversation.

Type Bug

Status —

Priority —

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoJoomCross#95