From fda24a53edae8253943cedb66a6381b46e92c41a Mon Sep 17 00:00:00 2001
From: westi <westi@1a063a9b-81f0-0310-95a4-ce76da25c4cd>
Date: Mon, 20 Jun 2011 14:58:50 +0000
Subject: [PATCH] Ensure we have a valid timezone identifier before trying to
 use it. Validate the new timezone identifier during option update. Fixes
 #17840.

git-svn-id: http://svn.automattic.com/wordpress/trunk@18323 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-admin/options-general.php | 6 ++++--
 wp-includes/formatting.php   | 9 +++++++++
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/wp-admin/options-general.php b/wp-admin/options-general.php
index 192c7cd995..4b16a5a85e 100644
--- a/wp-admin/options-general.php
+++ b/wp-admin/options-general.php
@@ -162,7 +162,7 @@ if ( empty($tzstring) ) { // Create a UTC+- zone if no timezone string exists
 <?php echo wp_timezone_choice($tzstring); ?>
 </select>
 
-    <span id="utc-time"><?php printf(__('<abbr title="Coordinated Universal Time">UTC</abbr> time is <code>%s</code>'), date_i18n($timezone_format, false, 'gmt')); ?></span>
+	<span id="utc-time"><?php printf(__('<abbr title="Coordinated Universal Time">UTC</abbr> time is <code>%s</code>'), date_i18n($timezone_format, false, 'gmt')); ?></span>
 <?php if ( get_option('timezone_string') || !empty($current_offset) ) : ?>
 	<span id="local-time"><?php printf(__('Local time is <code>%1$s</code>'), date_i18n($timezone_format)); ?></span>
 <?php endif; ?>
@@ -182,7 +182,9 @@ if ( empty($tzstring) ) { // Create a UTC+- zone if no timezone string exists
 	?>
 	<br />
 	<?php
-	if ( function_exists('timezone_transitions_get') ) {
+	$allowed_zones = timezone_identifiers_list();
+	
+	if ( in_array( $tzstring, $allowed_zones) ) {
 		$found = false;
 		$date_time_zone_selected = new DateTimeZone($tzstring);
 		$tz_offset = timezone_offset_get($date_time_zone_selected, date_create());
diff --git a/wp-includes/formatting.php b/wp-includes/formatting.php
index 8c9505d521..e7cb21c1ce 100644
--- a/wp-includes/formatting.php
+++ b/wp-includes/formatting.php
@@ -2521,6 +2521,15 @@ function sanitize_option($option, $value) {
 			}
 			break;
 
+		case 'timezone_string':
+			$allowed_zones = timezone_identifiers_list();
+			if ( ! in_array( $value, $allowed_zones ) && ! empty( $value ) ) {
+				$value = get_option( $option ); // Resets option to stored value in the case of failed sanitization
+				if ( function_exists('add_settings_error') )
+					add_settings_error('timezone_string', 'invalid_timezone_string', __('The timezone you have entered is not valid. Please select a valid timezone.') );
+			}
+			break;
+
 		default :
 			$value = apply_filters("sanitize_option_{$option}", $value, $option);
 			break;