[2011-09-03 11:34 UTC] cjk at wwwtech dot de

Description:
------------
There is a race condition in the move_uploaded_file() function: if you don't want 
to overwrite a file, the standard mechanism is:

$fd = fopen($file,"x");
fclose($fd);
move_uploaded_file($uploaded_file,$file);

But since move_uploaded_file() unlink()s a file first, there may be a race 
condition: file gets created exclusively via fopen(…,"x"), move_uploaded_file() 
removes the same file and the process gets suspended. Another process creates the 
file via fopen(…,"x"), voila, race condition.

Expected result:
----------------
We need a concurrency save implementation of move_uploaded_file(). This can be 
achieved by implementing a third parameter, boolean $dont_overwrite. When set to 
true, move_uploaded_file() will ensure that the file does not exist by using 
open(…,O_RDWR|O_CREAT|O_EXCL) and returning false in error case. The patch I 
attached does exactly this.


Actual result:
--------------
When two concurrent processes, they may overwrite the same file twice w/o the 
possibility to prevent it.