search

tbar0970 / jethro-pmm

Jethro Pastoral Ministry Manager
GNU General Public License v3.0
36 stars 26 forks source link

Prevent zero-byte /tmp/jethrozipXXXX files being created. #1097

Closed jefft closed 2 weeks ago

jefft commented 2 weeks ago

Code like this which appends an extension to tempnam() is always bad:

$zipFilename = tempnam(sys_get_temp_dir(), 'jethrozip').'.zip';

because:

  1. tempnam() actually creates a file /tmp/jethrozipXXXX
  2. $zipFilename is set to /tmp/jethrozipXXXX.zip
  3. $zipFilename is used
  4. `$zipFilename is unlinked to delete it
  5. /tmp/jethrozipXXXX is still there
jefft commented 2 weeks ago

Actually, this bit of code looks unused. I can't see any way to get a zip of Documents files.