Not-so-unique filenames in $_FILES - Dev

9 Oct 2012


      Hi all,
I got reports from RC users claiming their recipients got the wrong
attachments, attachments belonging to other RC users.
So I added some logging to
plugins/filesystem_attachments/filesystem_attachments.php:
<>
        if (!$args['path']) {
            $rcmail = rcmail::get_instance();
            $temp_dir = $rcmail->config->get('temp_dir');
            $tmp_path = tempnam($temp_dir, 'rcmAttmnt');
            write_log('sendmail', sprintf('Saving attachtment for %s to
%s.',
                                          $RCMAIL->user->get_username(),
                                          $tmp_path));
...
<>
Here are some (anonymized) lines from logs/sendmail (notice the typo,
which accidentally makes for easier grep'ing):
<>
[09-Oct-2012 09:11:29 +0200]: Saving attachtment for <user1> to
<path>/temp/rcmAttmntP007sn.
[09-Oct-2012 09:18:10 +0200]: Saving attachtment for <user2> to
<path>/temp/rcmAttmntP007sn.
[09-Oct-2012 09:26:33 +0200]: Saving attachtment for <user3> to
<path>/temp/rcmAttmntP007sn.
<>
With an average of 30 attachments total for all users on this server,
those filenames don't look very random to me.
So I added some more logging to program/steps/mail/attachments.inc:
<>
    if (!$err) {
      $attachment = array(
        'path' => $filepath,
        'size' => $_FILES['_attachments']['size'][$i],
        'name' => $_FILES['_attachments']['name'][$i],
        'mimetype' => rc_mime_content_type($filepath,
$_FILES['_attachments']['name'][$i], $_FILES['_attachments']['type'][$i]),
        'group' => $COMPOSE_ID,
      );
      write_log('sendmail', sprintf('Uploaded attachtment for %s in %s.',
                                    $RCMAIL->user->get_username(),
                                    $filepath));
...
<>
Which gives me duplicate filenames as well:
<>
[09-Oct-2012 09:16:59 +0200]: Uploaded attachtment for <user1> in
<path>/tmp/phpH007sn.
[09-Oct-2012 09:23:52 +0200]: Uploaded attachtment for <user2> in
<path>/tmp/phpH007sn.
<>
So this is obviously not an RC bug, but a PHP bug.
My question is: Has anyone seen this before? I cannot find a related bug
on https://bugs.php.net/
Robin