Skip to content

Commit c46c178

Browse files
committedJul 23, 2024
stop using uniqid() to create temporary files
1 parent bea731a commit c46c178

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed
 

‎Filesystem.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -611,7 +611,7 @@ public function tempnam(string $dir, string $prefix, string $suffix = ''): strin
611611
// Loop until we create a valid temp file or have reached 10 attempts
612612
for ($i = 0; $i < 10; ++$i) {
613613
// Create a unique filename
614-
$tmpFile = $dir.'/'.$prefix.uniqid(mt_rand(), true).$suffix;
614+
$tmpFile = $dir.'/'.$prefix.bin2hex(random_bytes(4)).$suffix;
615615

616616
// Use fopen instead of file_exists as some streams do not support stat
617617
// Use mode 'x+' to atomically check existence and create to avoid a TOCTOU vulnerability

0 commit comments

Comments
 (0)
Please sign in to comment.