[korganizer] [Bug 409912] New: Quietly "saves" invalid event (incidence) start or end times as midnight (particularly affects fr_CA sub-locale)

[Filipus Klutiero]

https://bugs.kde.org/show_bug.cgi?id=409912

            Bug ID: 409912
           Summary: Quietly "saves" invalid event (incidence) start or end
                    times as midnight (particularly affects fr_CA
                    sub-locale)
           Product: korganizer
           Version: 5.10.3
          Platform: Other
                OS: Linux
            Status: REPORTED
          Severity: major
          Priority: NOR
         Component: incidence editors
          Assignee: kdepim-bugs at kde.org
          Reporter: chealer at gmail.com
  Target Milestone: ---

incidenceeditor does not properly validate incidence start and end times. This
occurs when either loading or saving:
1. IncidenceDateTime::setDateTimes(), which is called by load(), starts with a
validation of time. But when the time is invalid, the time is simply quietly
set to the current time:
https://sources.debian.org/src/libkf5incidenceeditor/18.08.3-3/src/incidencedatetime.cpp/#L797
2. IncidenceDateTime::save() does not validate:
https://cgit.kde.org/incidenceeditor.git/tree/src/incidencedatetime.cpp#n724
  No matter whether the times are valid, setDtStart() and setDtEnd() proceed to
update():
https://api.kde.org/kdepim/kcalcore/html/incidence_8cpp_source.html#l00411
https://api.kde.org/kdepim/kcalcore/html/classKCalCore_1_1Event.html#a0d6840be8adf1a8fd37617ecf3da535b
  IncidenceBase::setDtStart() comes close, but just logs a warning:
https://api.kde.org/kdepim/kcalcore/html/incidencebase_8cpp_source.html#l00314
  In the end, both call update(), which proceeds to incidenceUpdate() without
ever throwing an exception:
https://api.kde.org/kdepim/kcalcore/html/incidencebase_8cpp_source.html#l00600


The saving defect is particularly problematic, as:
1. KTimeComboBox is used without WarnOnInvalid.
2. The KTimeComboBox input mask does not necessarily guarantee that the input
string is valid, even if the mask is respected. Here are 2 examples:
   1. With the en_US locale, with KDE Frameworks 5.60.0, the mask makes the
AM/PM specifier entirely optional. If the user enters "23:45", for example, the
entry is considered invalid and "saved" as midnight. If the user enters "10:00
P", the entry is invalid again and "saved" as midnight.
   2. Some locales have simply broken masks. For example, with the fr_CA
sub-locale, due to issue #409867, with Qt Core 5.13, when the users wants to
enter, say, 23:45, incidenceeditor will get back an invalid time string which -
if I understand correctly - would be in this example "2345". It is obviously
impossible for incidenceeditor to do the right thing in this case, but instead
of reporting an issue, incidenceeditor quietly "saves" a midnight value.


Given that the saving defect can result in quiet data corruption/loss, which -
when combined with issues like KDE #409867 and Qt Core's usage of "23 h 59" as
format for fr_CA - can be unavoidable, this issue can make KOrganizer largely
unusable.

-- 
You are receiving this mail because:
You are the assignee for the bug.