Ticket #33053: 33053.diff

src/wp-admin/includes/file.php

@@ -139 +139 @@
  *
  * @param string $filename Optional. Filename to base the Unique file off. Default empty.
  * @param string $dir      Optional. Directory to store the file in. Default empty.
  * @return string a writable filename
  */
 function wp_tempnam( $filename = '', $dir = '' ) {
         if ( empty( $dir ) ) {
                 $dir = get_temp_dir();
         }
 
         if ( empty( $filename ) || '.' == $filename || '/' == $filename ) {
                 $filename = time();
         }
 
         // Use the basename of the given file without the extension as the name for the temporary directory
-        $temp_filename = basename( $filename );
-        $temp_filename = preg_replace( '|\.[^.]*$|', '', $temp_filename );
+        list( $temp_filename ) = explode( '.', basename( $filename ), 2 );
 
         // If the folder is falsey, use it's parent directory name instead
         if ( ! $temp_filename ) {
                 return wp_tempnam( dirname( $filename ), $dir );
         }
 
         $temp_filename .= '.tmp';
         $temp_filename = $dir . wp_unique_filename( $dir, $temp_filename );
         touch( $temp_filename );
 
         return $temp_filename;
 }
 
 /**
  * Make sure that the file that was requested to edit, is allowed to be edited
@@ -442 +441 @@
 /**
  * Downloads a url to a local temporary file using the WordPress HTTP Class.
  * Please note, That the calling function must unlink() the file.
  *
  * @since 2.5.0
  *
  * @param string $url the URL of the file to download
  * @param int $timeout The timeout for the request to download the file default 300 seconds
  * @return mixed WP_Error on failure, string Filename on success.
  */
 function download_url( $url, $timeout = 300 ) {
         //WARNING: The file is not automatically deleted, The script must unlink() the file.
         if ( ! $url )
                 return new WP_Error('http_no_url', __('Invalid URL Provided.'));
 
-        $tmpfname = wp_tempnam($url);
+        $tmpfname = wp_tempnam( parse_url( $url, PHP_URL_PATH ) );
         if ( ! $tmpfname )
                 return new WP_Error('http_no_file', __('Could not create Temporary file.'));
 
         $response = wp_safe_remote_get( $url, array( 'timeout' => $timeout, 'stream' => true, 'filename' => $tmpfname ) );
 
         if ( is_wp_error( $response ) ) {
                 unlink( $tmpfname );
                 return $response;
         }
 
         if ( 200 != wp_remote_retrieve_response_code( $response ) ){
                 unlink( $tmpfname );
                 return new WP_Error( 'http_404', trim( wp_remote_retrieve_response_message( $response ) ) );
         }