PDOException because of incorrect validation of number fields

Moving to d8 and marking for backport.

Setting needs review for the bot.

Test fails because of:

Previously, the regexp didn't test for more than one decimal point, and that check was done later. Now that the regexp detects it earlier, the error message is not the expected one.

It's not a pretty patch, not 100% happy with it, but I think it works with minimal changes on code.

I wouldn't mind dropping this specific error message at all, provided the tests are done for the same cases. But I lack powers to mess with it. =)

I created #1845546: Implement validation for the TypedData API to try to solve this on all levels, since there are only 10 days left, we need to figure out what needs to be done before feature freeze and what can be done later.

corrected a typo

When browser does not support html5 validation or validation disabled http://stackoverflow.com/a/3094185
Core now stores empty value silently without validation.

So better to add validation to widget or maybe "number" element additionally to browser provided

Looks now is_numberic check is enough in \Drupal\Core\Render\Element\Number::validateNumber

Here's a test to make sure that "20-40" is now checked fine

Here's a test that proves that decimal item by-passes validation

Removing sprint weekend tag!!
As suggested by @YesCT

Isn't decimal fine because the datatype is a string ?

Oh woops, didn't look at the schema, ignore my comment

And the fix - added a new constraint based on Symfony's Regex validator.

+++ b/core/lib/Drupal/Core/Field/Plugin/Field/FieldType/DecimalItem.php
@@ -95,6 +95,25 @@ public function storageSettingsForm(array &$form, FormStateInterface $form_state
+          'pattern' => '/^[0-9]+(\.[0-9]{1,2})?$/i',

this should care about decimal and thousand separators

regex fix. Don't think we should account for comma's as the storage won't allow that IIRC - that's more for formatters at output imo.

Patch applied and works as needed; Could't find any code issues so marking as rtbc.

Adding a validator is low risk and this fixes a bug so is permitted during beta. Committed 1c3bfd3 and pushed to 8.0.x. Thanks!

This bug seems to be no longer present in D7 as it was fixed by #1068016: number field validation fails to block some invalid input causing later SQL fatal error. There is also a test (NumberFieldTestCase::testNumberDecimalField()) checking inputs like "3-3", "-10-10". I think this can be set as Fixed.