Changeset 14016 for trunk/wp-admin/includes/class-wp-filesystem-ftpext.php

Timestamp:

04/06/2010 11:20:51 AM (16 years ago)

Author:

dd32

Message:

Replace use of tmpfile() with a safe get_temp_dir(). tmpfile() may use a temporary directly which is not writable. Add static caching to get_temp_dir() & better protect against bad server configs. Fixes #12866

File:

• trunk/wp-admin/includes/class-wp-filesystem-ftpext.php (modified) (4 diffs)

trunk/wp-admin/includes/class-wp-filesystem-ftpext.php

@@ -93 +93 @@
                         $type = FTP_BINARY;
 
-                $temp = tmpfile();
+                $tempfile = wp_tempnam($file);
+                $temp = fopen($tempfile, 'w+');
+
                 if ( ! $temp )
                         return false;
@@ -107 +109 @@
 
                 fclose($temp);
+                unlink($tempfile);
                 return $contents;
         }
@@ -114 +117 @@
 
         function put_contents($file, $contents, $mode = false ) {
-                $temp = tmpfile();
+                $tempfile = wp_tempnam($file);
+                $temp = fopen($tempfile, 'w+');
                 if ( ! $temp )
                         return false;
@@ -125 +129 @@
 
                 fclose($temp);
+                unlink($tempfile);
 
                 $this->chmod($file, $mode);