Stream-to-file may fail or overwrite existing temporary file

[dd32]

Consider this request:

wp_remote_request( 'https://example.org/style.css', [ 'stream' => true ] );

If /tmp/style.css exists and can't be overwritten, the request will fail with:

class WP_Error#5189 (3) {
  public $errors =>
  array(1) {
    'http_request_failed' =>
    array(1) {
      [0] =>
      string(63) "fopen(/tmp/style.css): Failed to open stream: Permission denied"
    }
  }
}

Likewise, if multiple requests occur at the same time, there's a chance the file will be overwritten.

WP_HTTP should ensure that either a) The filename is unique, or b) the path is unique.

This can be worked around by passing the filename parameter like so:

wp_remote_request( 'https://example.org/style.css', [ 'stream' => true, 'filename' => wp_tempnam( 'style.css' ) ] );

This does result in the filename of the streamed file being /tmp/style-XXXXXX.tmp but given the location of the file storage, this seems reasonable and unlikely to break back-compat significantly.

This only is for the case of stream => true without a specified filename to stream to, in that case, it's expected that a temporary file path would be returned.

Trac ticket: https://core.trac.wordpress.org/ticket/64212