From c959b63539ce95f1ccc98269958102a013af99de Mon Sep 17 00:00:00 2001 From: Dion Hulse Date: Tue, 31 May 2016 02:21:29 +0000 Subject: [PATCH] Updates: Only use the filename component of URLs to form part of the temporary filename. Previously we were passing the entire URL to `wp_tempnam()` (incorrectly) which caused the query string to be used as part of the temporary filename. We now only use the file component of a url such as `https://example.com/filename.zip?arg1=1&arg2=2....&arg100=100` to prevent a long filename. Fixes #34938 Built from https://develop.svn.wordpress.org/trunk@37598 git-svn-id: http://core.svn.wordpress.org/trunk@37566 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-admin/includes/file.php | 4 +++- wp-includes/version.php | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/wp-admin/includes/file.php b/wp-admin/includes/file.php index 6b48978e0d..3b754dfd6f 100644 --- a/wp-admin/includes/file.php +++ b/wp-admin/includes/file.php @@ -493,7 +493,9 @@ function download_url( $url, $timeout = 300 ) { if ( ! $url ) return new WP_Error('http_no_url', __('Invalid URL Provided.')); - $tmpfname = wp_tempnam($url); + $url_filename = basename( parse_url( $url, PHP_URL_PATH ) ); + + $tmpfname = wp_tempnam( $url_filename ); if ( ! $tmpfname ) return new WP_Error('http_no_file', __('Could not create Temporary file.')); diff --git a/wp-includes/version.php b/wp-includes/version.php index 8765e075b8..6f701dd116 100644 --- a/wp-includes/version.php +++ b/wp-includes/version.php @@ -4,7 +4,7 @@ * * @global string $wp_version */ -$wp_version = '4.6-alpha-37597'; +$wp_version = '4.6-alpha-37598'; /** * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.