Ticket #42437: 42437.diff

src/wp-admin/includes/file.php

@@ -824 +824 @@
                 return call_user_func_array( $upload_error_handler, array( &$file, $uploads['error'] ) );
         }
 
+        $name = wp_basename( $file['name'], ".$ext" );
+        if ( preg_match( "/-\d+x\d+(?=\.{$ext}\$)/", $file['name'] ) ) {
+                // Always append `-\d+` to file names that can potentially match other subsize file names.
+                $i = 1;
+                while ( is_file( "{$uploads['path']}/$name-$i.$ext" ) ) {
+                        $i++;
+                }
+                $file['name'] = "$name-$i.$ext";
+        }
+        else {
+                // prevent filename collisions with original filenames that contained dimension-like strings
+                // uploaded prior to patch #xxx
+                $collisions = glob( "{$uploads['path']}/$name-[0123456789]x[0123456789].$ext" );
+                $i = 1;
+                while ( ! empty( $collisions ) ) {
+                        $collisions = glob( "{$uploads['path']}/$name-$i-[0123456789]x[0123456789].$ext" );
+                        $i++;
+                }
+                $file['name'] = "$name-$i.$ext";
+        }
+
         $filename = wp_unique_filename( $uploads['path'], $file['name'], $unique_filename_callback );
 
         // Move the file to the uploads dir.