TYPO3 Core

If you have the following file structure (e.g. Mittwald has this) with PATH_site being /home/www/p123456/html/typo3/ ...

DIR     /html/typo3/
DIR     /html/typo3/typo3temp/
SYMLINK /home/www/p123456/ -> ../.. ("../.." refers to the server root /)
LINKED  /home/www/p123456/html/ -> /html/
LINKED  /home/www/p123456/html/typo3/ -> /html/typo3/ (this is what PATH_site contains)
LINKED  /home/www/p123456/html/typo3/typo3temp/ -> /html/typo3/typo3temp/

... then the following code will create a temporary file but will not delete it again!

$tmpFile = GeneralUtility::tempnam('test', '.txt'); //$tmpFile == '/html/typo3/typo3temp/testABCDE.txt'
GeneralUtility::unlink_tempfile($tmpFile);

This is because GeneralUtility::tempnam uses PHP's tempnam and PHP's tempnam seems to use something like realpath internally which resolves symlinks. So you end up with a $tmpFile-path that contains no unresolved symlinks. But GeneralUtility::unlink_tempfile expects the first parameter to start with exactly PATH_site (containing unresolved symlinks).

In the end either GeneralUtility::tempnam or GeneralUtility::unlink_tempfile needs to be adjusted. I personally think it would be much better to fix GeneralUtility::tempnam, because it should not return anything that does not begin with PATH_site in my opinion. Maybe something like this inside GeneralUtility::tempnam would fix it:

if(!self::isFirstPartOfStr($uploadedTempFileName, PATH_site . 'typo3temp/')) {
  $tempFileName = PATH_site . 'typo3temp' . substr(realpath($tempFileName), strlen(realpath(PATH_site . 'typo3temp')));
}