From 00df4141f0d246a4c7e8f69055b27d2561577b06 Mon Sep 17 00:00:00 2001
From: =?utf8?q?Tim=20D=C3=BCsterhus?= <duesterhus@woltlab.com>
Date: Fri, 20 May 2022 11:30:12 +0200
Subject: [PATCH] Clean all directories that match the tmp naming pattern at
 the end of WCFSetup

Since e41dfd007b12baed65ab7679fb679e53bcd2adf5 the temporary directory for
WCFSetup resides in the webroot instead of some system internal temporary
directory. As such temporary files might remain in the webroot and likely will
never be cleaned if the install.php is accessed multiple times before the setup
is completed.

Fix this by deleting all directories that match the pattern for the name of the
temporary directory once the setup is completed successfully.
---
 wcfsetup/install.php                          |  2 +-
 .../files/lib/system/WCFSetup.class.php       | 38 ++++++++++++-------
 2 files changed, 26 insertions(+), 14 deletions(-)

diff --git a/wcfsetup/install.php b/wcfsetup/install.php
index cefb88a047..9cdd3802ae 100644
--- a/wcfsetup/install.php
+++ b/wcfsetup/install.php
@@ -619,7 +619,7 @@ class BasicFileUtil {
 	 * Returns the temp folder for the installation.
 	 */
 	public static function getInstallTempFolder(): string {
-		$dir = __DIR__ . '/WCFSetup-' . TMP_FILE_PREFIX . '/';
+		$dir = INSTALL_SCRIPT_DIR . '/WCFSetup-' . TMP_FILE_PREFIX . '/';
 		@mkdir($dir);
 		self::makeWritable($dir);
 		
diff --git a/wcfsetup/install/files/lib/system/WCFSetup.class.php b/wcfsetup/install/files/lib/system/WCFSetup.class.php
index 40819562af..28915e0f92 100644
--- a/wcfsetup/install/files/lib/system/WCFSetup.class.php
+++ b/wcfsetup/install/files/lib/system/WCFSetup.class.php
@@ -1317,21 +1317,33 @@ final class WCFSetup extends WCF
         SessionHandler::getInstance()->update();
 
         // Delete tmp files
-        $iterator = new \RecursiveIteratorIterator(
-            new \RecursiveDirectoryIterator(
-                TMP_DIR . '/',
-                \RecursiveDirectoryIterator::CURRENT_AS_FILEINFO | \RecursiveDirectoryIterator::SKIP_DOTS
-            ),
-            \RecursiveIteratorIterator::CHILD_FIRST
-        );
-        foreach ($iterator as $path) {
-            if ($path->isDir()) {
-                \rmdir($path);
-            } else {
-                \unlink($path);
+        foreach (new \DirectoryIterator(\INSTALL_SCRIPT_DIR) as $fileInfo) {
+            if (!$fileInfo->isDir()) {
+                continue;
+            }
+
+            if (!\preg_match('/^WCFSetup-[0-9a-f]{16}$/', $fileInfo->getBasename())) {
+                continue;
+            }
+
+            $tmpDirectory = $fileInfo->getPathname();
+
+            $tmpDirectoryIterator = new \RecursiveIteratorIterator(
+                new \RecursiveDirectoryIterator(
+                    $tmpDirectory,
+                    \RecursiveDirectoryIterator::CURRENT_AS_FILEINFO | \RecursiveDirectoryIterator::SKIP_DOTS
+                ),
+                \RecursiveIteratorIterator::CHILD_FIRST
+            );
+            foreach ($tmpDirectoryIterator as $tmpFile) {
+                if ($tmpFile->isDir()) {
+                    \rmdir($tmpFile);
+                } else {
+                    \unlink($tmpFile);
+                }
             }
+            \rmdir($tmpDirectory);
         }
-        \rmdir(TMP_DIR . '/');
 
         return $output;
     }
-- 
2.20.1