Do not store passwords on disk - use proc_open instead of popen (#5531)

plugins/password/password.php

@@ -598,22 +598,16 @@ class password extends rcube_plugin
                 $method = 'CRAM-MD5';
             }
 
-            // use common temp dir
-            $tmp_dir = $rcmail->config->get('temp_dir');
-            $tmpfile = tempnam($tmp_dir, 'roundcube-');
+            $pipe = proc_open("$dovecotpw -s '$method'", array(0 => array('pipe', 'r'), 1 => array('pipe', 'w'), 2 => array('file', '/dev/null', 'a')), $pipes);
+            if (!is_resource($pipe)) return false;
 
-            $pipe = popen("$dovecotpw -s '$method' > '$tmpfile'", "w");
-            if (!$pipe) {
-                unlink($tmpfile);
-                return false;
-            }
-            else {
-                fwrite($pipe, $password . "\n", 1+strlen($password)); usleep(1000);
-                fwrite($pipe, $password . "\n", 1+strlen($password));
-                pclose($pipe);
-
-                $crypted = trim(file_get_contents($tmpfile), "\n");
-                unlink($tmpfile);
+            fwrite($pipes[0], $password . "\n", 1+strlen($password));
+            usleep(1000);
+            fwrite($pipes[0], $password . "\n", 1+strlen($password));
+            fclose($pipes[0]);
+            $crypted = trim(stream_get_contents($pipes[1]), "\n");
+            fclose($pipes[1]);
+            proc_close($pipe);
 
             if (!preg_match('/^\{' . $method . '\}/', $crypted)) {
                 return false;
@@ -628,7 +622,6 @@ class password extends rcube_plugin
             }
 
             $prefixed = false;
-            }
 
             break;