[wp-trac] [WordPress Trac] #64212: Stream-to-file may fail or overwrite existing temporary file

[WordPress Trac]

#64212: Stream-to-file may fail or overwrite existing temporary file
--------------------------+-----------------------------
 Reporter:  dd32          |      Owner:  (none)
     Type:  defect (bug)  |     Status:  new
 Priority:  normal        |  Milestone:  Awaiting Review
Component:  HTTP API      |    Version:
 Severity:  normal        |   Keywords:
  Focuses:                |
--------------------------+-----------------------------
 Consider this request:
 {{{
 wp_remote_request( 'https://example.org/style.css', [ 'stream' => true ]
 );
 }}}

 If `/tmp/style.css` exists and can't be overwritten, the request will fail
 with:
 {{{
 class WP_Error#5189 (3) {
   public $errors =>
   array(1) {
     'http_request_failed' =>
     array(1) {
       [0] =>
       string(63) "fopen(/tmp/style.css): Failed to open stream: Permission
 denied"
     }
   }
 }
 }}}

 Likewise, if multiple requests occur at the same time, there's a chance
 the file will be overwritten.

 WP_HTTP should ensure that either a) The filename is unique, or b) the
 path is unique.

 This can be worked around by passing the `filename` parameter like so:
 {{{
 wp_remote_request( 'https://example.org/style.css', [ 'stream' => true,
 'filename' => wp_tempnam( 'style.css' ) ] );
 }}}

 This does result in the filename of the streamed file being `/tmp/style-
 XXXXXX.tmp` but given the location of the file storage, this seems
 reasonable and unlikely to break back-compat significantly.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/64212>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform