FIx temp_filename() regressions, update changelog, add note in UPGRADING

CHANGELOG

@@ -5,6 +5,7 @@ CHANGELOG Roundcube Webmail
 - SMTP GSSAPI support via krb_authentication plugin (#6417)
 - Avoid Referer leaking by using Referrer-Policy:same-origin header (#6385)
 - Removed referer_check option (#6440)
+- Use constant prefix for temp file names, don't remove temp files from other apps (#6511)
 - Update to TinyMCE 4.8.2
 - Plugin API: Added 'raise_error' hook (#6199)
 - Plugin API: Added 'common_headers' hook (#6385)

UPGRADING

@@ -71,11 +71,14 @@ it on a unix system, you need to do the following operations by hand:
 
 Post-Upgrade Activities
 -----------------------
-1. If you're using build-in addressbook, run indexing script /bin/indexcontacts.sh.
-2. When upgrading from version older than 0.6-beta you should make sure
+1. Check system requirements in INSTALL file.
+2. If you're using build-in addressbook, run indexing script /bin/indexcontacts.sh.
+3. When upgrading from version older than 0.6-beta you should make sure
    your folder settings contain namespace prefix. For example Courier users
    should add INBOX. prefix to folder names in main configuration file.
-3. Check system requirements in INSTALL file.
+4. When upgrading from version older than 1.4.0 make sure old files
+   in configured temp_dir are removed. Since this version we use constant filename
+   prefix and do not remove files not starting with "RCMTEMP".
 
 SQLite database upgrade
 -----------------------

program/include/rcmail.php

@@ -2239,13 +2239,12 @@ class rcmail extends rcube
                 $mimetype       = $file['mimetype'];
                 $file_ident     = $file['id'] . ':' . $file['mimetype'] . ':' . $file['size'];
                 $thumb_name     = md5($file_ident . ':' . $this->user->ID . ':' . $thumbnail_size) . '.thumb';
-                $cache_basename = rcube_utils::temp_filename($thumb_name, false, false);
-                $cache_file     = $cache_basename . '.thumb';
+                $cache_file     = rcube_utils::temp_filename($thumb_name, false, false);
 
                 // render thumbnail image if not done yet
                 if (!is_file($cache_file)) {
                     if (!$file['path']) {
-                        $orig_name = $filename = $cache_basename . '.tmp';
+                        $orig_name = $filename = $cache_file . '.tmp';
                         file_put_contents($orig_name, $file['data']);
                     }
                     else {

program/lib/Roundcube/rcube_utils.php

@@ -1414,7 +1414,7 @@ class rcube_utils
 
         // Sanity check for unique file name
         if ($unique && file_exists($temp_path)) {
-            return self::temp_filename($file_name);
+            return self::temp_filename($file_name, $unique, $create);
         }
 
         // Create the file to prevent possible race condition like tempnam() does

program/steps/mail/get.inc

@@ -78,11 +78,10 @@ if (!empty($_GET['_thumb']) && $attachment->is_valid()) {
     $thumbnail_size = $RCMAIL->config->get('image_thumbnail_size', 240);
     $file_ident     = $attachment->ident;
     $thumb_name     = md5($file_ident . ':' . $RCMAIL->user->ID . ':' . $thumbnail_size) . '.thumb';
-    $cache_basename = rcube_utils::temp_filename($thumb_name, false, false);
-    $cache_file     = $cache_basename . '.thumb';
+    $cache_file     = rcube_utils::temp_filename($thumb_name, false, false);
 
     // render thumbnail image if not done yet
-    if (!is_file($cache_file) && $attachment->body_to_file($orig_name = $cache_basename . '.tmp')) {
+    if (!is_file($cache_file) && $attachment->body_to_file($orig_name = $cache_file . '.tmp')) {
         $image = new rcube_image($orig_name);
 
         if ($imgtype = $image->resize($thumbnail_size, $cache_file, true)) {