TYPO3 Core

It may happen that someone creates an export of all fe_users into a t3d file. He takes the file, moves to his next site, and imports it again.

While importing the file using impexp, the file is actually being uploaded to fileadmin/_temp_/ first. When importing the t3d file, impexp will use this copy. After the import, the file is not deleted.

This could apply to many other use cases, it's just an example to explain why fileadmin/_temp_/ should be secured in some way.

The easiest way to solve this is to add a .htaccess in fileadmin/_temp_ and deny access to anybody.

Furthermore, the impexp extension should remove t3d files after they have been successfully imported.
(issue imported from #M1604)