1 files changed, 29 insertions, 88 deletions

diff --git a/lib/private/TempManager.php b/lib/private/TempManager.php
index 0df31dce3ff..4c0ffcf43d7 100644
--- a/lib/private/TempManager.php
+++ b/lib/private/TempManager.php
@@ -1,39 +1,17 @@
 <?php
+
 /**
- * @copyright Copyright (c) 2016, ownCloud, Inc.
- *
- * @author Christoph Wurst <christoph@winzerhof-wurst.at>
- * @author Joas Schilling <coding@schilljs.com>
- * @author Lars <winnetou+github@catolic.de>
- * @author Lukas Reschke <lukas@statuscode.ch>
- * @author Martin Mattel <martin.mattel@diemattels.at>
- * @author Morris Jobke <hey@morrisjobke.de>
- * @author Olivier Paroz <github@oparoz.com>
- * @author Robin Appelman <robin@icewind.nl>
- * @author Robin McCorkell <robin@mccorkell.me.uk>
- * @author Roeland Jago Douma <roeland@famdouma.nl>
- * @author Stefan Weil <sw@weilnetz.de>
- *
- * @license AGPL-3.0
- *
- * This code is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License, version 3,
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License, version 3,
- * along with this program. If not, see <http://www.gnu.org/licenses/>
- *
+ * SPDX-FileCopyrightText: 2016-2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-FileCopyrightText: 2016 ownCloud, Inc.
+ * SPDX-License-Identifier: AGPL-3.0-only
  */
 namespace OC;
 
 use bantu\IniGetWrapper\IniGetWrapper;
+use OCP\Files;
 use OCP\IConfig;
 use OCP\ITempManager;
+use OCP\Security\ISecureRandom;
 use Psr\Log\LoggerInterface;
 
 class TempManager implements ITempManager {
@@ -58,51 +36,25 @@ class TempManager implements ITempManager {
 		$this->tmpBaseDir = $this->getTempBaseDir();
 	}
 
-	/**
-	 * Builds the filename with suffix and removes potential dangerous characters
-	 * such as directory separators.
-	 *
-	 * @param string $absolutePath Absolute path to the file / folder
-	 * @param string $postFix Postfix appended to the temporary file name, may be user controlled
-	 * @return string
-	 */
-	private function buildFileNameWithSuffix($absolutePath, $postFix = '') {
+	private function generateTemporaryPath(string $postFix): string {
+		$secureRandom = \OCP\Server::get(ISecureRandom::class);
+		$absolutePath = $this->tmpBaseDir . '/' . self::TMP_PREFIX . $secureRandom->generate(32, ISecureRandom::CHAR_ALPHANUMERIC);
+
 		if ($postFix !== '') {
 			$postFix = '.' . ltrim($postFix, '.');
 			$postFix = str_replace(['\\', '/'], '', $postFix);
-			$absolutePath .= '-';
 		}
 
 		return $absolutePath . $postFix;
 	}
 
-	/**
-	 * Create a temporary file and return the path
-	 *
-	 * @param string $postFix Postfix appended to the temporary file name
-	 * @return string
-	 */
-	public function getTemporaryFile($postFix = '') {
-		if (is_writable($this->tmpBaseDir)) {
-			// To create an unique file and prevent the risk of race conditions
-			// or duplicated temporary files by other means such as collisions
-			// we need to create the file using `tempnam` and append a possible
-			// postfix to it later
-			$file = tempnam($this->tmpBaseDir, self::TMP_PREFIX);
-			$this->current[] = $file;
-
-			// If a postfix got specified sanitize it and create a postfixed
-			// temporary file
-			if ($postFix !== '') {
-				$fileNameWithPostfix = $this->buildFileNameWithSuffix($file, $postFix);
-				touch($fileNameWithPostfix);
-				chmod($fileNameWithPostfix, 0600);
-				$this->current[] = $fileNameWithPostfix;
-				return $fileNameWithPostfix;
-			}
+	public function getTemporaryFile($postFix = ''): string|false {
+		$path = $this->generateTemporaryPath($postFix);
 
-			return $file;
-		} else {
+		$old_umask = umask(0077);
+		$fp = fopen($path, 'x');
+		umask($old_umask);
+		if ($fp === false) {
 			$this->log->warning(
 				'Can not create a temporary file in directory {dir}. Check it exists and has correct permissions',
 				[
@@ -111,30 +63,16 @@ class TempManager implements ITempManager {
 			);
 			return false;
 		}
-	}
 
-	/**
-	 * Create a temporary folder and return the path
-	 *
-	 * @param string $postFix Postfix appended to the temporary folder name
-	 * @return string
-	 */
-	public function getTemporaryFolder($postFix = '') {
-		if (is_writable($this->tmpBaseDir)) {
-			// To create an unique directory and prevent the risk of race conditions
-			// or duplicated temporary files by other means such as collisions
-			// we need to create the file using `tempnam` and append a possible
-			// postfix to it later
-			$uniqueFileName = tempnam($this->tmpBaseDir, self::TMP_PREFIX);
-			$this->current[] = $uniqueFileName;
+		fclose($fp);
+		$this->current[] = $path;
+		return $path;
+	}
 
-			// Build a name without postfix
-			$path = $this->buildFileNameWithSuffix($uniqueFileName . '-folder', $postFix);
-			mkdir($path, 0700);
-			$this->current[] = $path;
+	public function getTemporaryFolder($postFix = ''): string|false {
+		$path = $this->generateTemporaryPath($postFix) . '/';
 
-			return $path . '/';
-		} else {
+		if (mkdir($path, 0700) === false) {
 			$this->log->warning(
 				'Can not create a temporary folder in directory {dir}. Check it exists and has correct permissions',
 				[
@@ -143,6 +81,9 @@ class TempManager implements ITempManager {
 			);
 			return false;
 		}
+
+		$this->current[] = $path;
+		return $path;
 	}
 
 	/**
@@ -159,10 +100,10 @@ class TempManager implements ITempManager {
 		foreach ($files as $file) {
 			if (file_exists($file)) {
 				try {
-					\OC_Helper::rmdirr($file);
+					Files::rmdirr($file);
 				} catch (\UnexpectedValueException $ex) {
 					$this->log->warning(
-						"Error deleting temporary file/folder: {file} - Reason: {error}",
+						'Error deleting temporary file/folder: {file} - Reason: {error}',
 						[
 							'file' => $file,
 							'error' => $ex->getMessage(),
@@ -240,7 +181,7 @@ class TempManager implements ITempManager {
 			}
 		}
 
-		$temp = tempnam(dirname(__FILE__), '');
+		$temp = tempnam(__DIR__, '');
 		if (file_exists($temp)) {
 			unlink($temp);
 			return dirname($temp);