From 03aa84f78412d350f3e8721257251baf948bc7b6 Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Sun, 17 May 2015 14:52:24 +0200
Subject: [PATCH] Fix bug where some files could have "executable" extension
 when stored in temp folder (#1490377)

---
 CHANGELOG                  | 1 +
 program/include/rcmail.php | 5 ++---
 program/steps/mail/get.inc | 5 ++---
 3 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index e6775b932..2c09bb368 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -28,6 +28,7 @@ CHANGELOG Roundcube Webmail
 - Fix security issue in contact photo handling (#1490379)
 - Fix possible memcache/apc cache data consistency issues (#1490390)
 - Fix bug where imap_conn_options were ignored in IMAP connection test (#1490392)
+- Fix bug where some files could have "executable" extension when stored in temp folder (#1490377)
 
 RELEASE 1.1.1
 -------------
diff --git a/program/include/rcmail.php b/program/include/rcmail.php
index 2a154d9de..e3e45e235 100644
--- a/program/include/rcmail.php
+++ b/program/include/rcmail.php
@@ -2073,16 +2073,15 @@ class rcmail extends rcube
             if (!empty($_GET['_thumbnail'])) {
                 $temp_dir       = $this->config->get('temp_dir');
                 $thumbnail_size = 80;
-                list(,$ext)     = explode('/', $file['mimetype']);
                 $mimetype       = $file['mimetype'];
                 $file_ident     = $file['id'] . ':' . $file['mimetype'] . ':' . $file['size'];
                 $cache_basename = $temp_dir . '/' . md5($file_ident . ':' . $this->user->ID . ':' . $thumbnail_size);
-                $cache_file     = $cache_basename . '.' . $ext;
+                $cache_file     = $cache_basename . '.thumb';
 
                 // render thumbnail image if not done yet
                 if (!is_file($cache_file)) {
                     if (!$file['path']) {
-                        $orig_name = $filename = $cache_basename . '.orig.' . $ext;
+                        $orig_name = $filename = $cache_basename . '.tmp';
                         file_put_contents($orig_name, $file['data']);
                     }
                     else {
diff --git a/program/steps/mail/get.inc b/program/steps/mail/get.inc
index 831026eb7..bef46cf6f 100644
--- a/program/steps/mail/get.inc
+++ b/program/steps/mail/get.inc
@@ -78,15 +78,14 @@ else if ($_GET['_thumb']) {
     if ($part = $MESSAGE->mime_parts[$pid]) {
         $thumbnail_size = $RCMAIL->config->get('image_thumbnail_size', 240);
         $temp_dir       = $RCMAIL->config->get('temp_dir');
-        list(,$ext)     = explode('/', $part->mimetype);
         $mimetype       = $part->mimetype;
         $file_ident     = $MESSAGE->headers->messageID . ':' . $part->mime_id . ':' . $part->size . ':' . $part->mimetype;
         $cache_basename = $temp_dir . '/' . md5($file_ident . ':' . $RCMAIL->user->ID . ':' . $thumbnail_size);
-        $cache_file     = $cache_basename . '.' . $ext;
+        $cache_file     = $cache_basename . '.thumb';
 
         // render thumbnail image if not done yet
         if (!is_file($cache_file)) {
-            if ($fp = fopen(($orig_name = $cache_basename . '.orig.' . $ext), 'w')) {
+            if ($fp = fopen(($orig_name = $cache_basename . '.tmp'), 'w')) {
                 $MESSAGE->get_part_body($part->mime_id, false, 0, $fp);
                 fclose($fp);