Uploading media file with same sanitized filename as existing file will overwrite existing file.

[markjaquith]

1. Upload "test.png" with dimensions X1xY1
2. Upload a different file that is also named "test.png" with dimensions X2xY2

The second test.png will overwrite the first, although the first will keep its dimensions of X1xY1, so it will be squished or stretched out.

Blocker, because someone your original file is GONE without any warning.

Desired outcome: test-N.jpg where N is an integer that increments as high as it needs to go to avoid overwriting an existing file.

[neodude]

I think I narrowed it down. I'm writing the test cases now, will put that and patch up asap.

[neodude]

unit tests for wp-includes/functions.php's wp_unique_filename()

[neodude]

patch for wp_unique_functions, fixed issues described in comment 2

[neodude]

functions.php-r7414.diff fixes:

• edge case: failed to handle a file named '.ext'
• sanitize_title_with_dashes called too late, which is, AFAIK, the cause of this bug
• with s_t_w_d moved up, the # and \ checks are redundant, since s_t_w_d does s/[%a-z0-9 _-] anyway

I tested two different files named test%test.png and test%%test.png, which correctly gives testtest.png and testtest1.png respectively.

The unit tests cover pretty much all of wp_unique_filename, but only vaguely common bits of sanitize_title_with_dashes. The latter function is very complex to write test cases completely for, so I thought I'd save my time.

[markjaquith]

(In [7440]) Prevent uploads from overwriting each other. props neodude. fixes #6294