file_save_upload() should not alter the file URI string before validation

#1: file_save_upload_actual_uri_1815504_1.patch queued for re-testing.

Needs to be fixed in 8.x first

Note that I think this change is indeed harmless since later in file_save_upload we assign the uri based on the (munged) filename:

 $file->uri = $file->destination;

At the point when the removed line is changing it it still has the value:

$file->uri      = $_FILES['files']['tmp_name'][$source];

So it does seem pointless to munge this temporary uri

Here's a D8 patch

+++ b/core/modules/file/file.module
@@ -939,7 +939,7 @@ function file_save_upload($form_field_name, array &$form_state, $validators = ar
     // directory. This overcomes open_basedir restrictions for future file
     // operations.
-    $file->uri = $file->destination;
+    $file->setFileUri($file->destination);
     if (!drupal_move_uploaded_file($file_info->getRealPath(), $file->getFileUri())) {

This fix seems unrelated. I've moved it to #2155245: Use proper methods instead of directly calling $file->filename and $file->uri which includes other fixes.

ok, here's just the minimal fix.

I tested this patch on my localhost, and on my system at least, the tmp file URI is something like /tmp/phpIf1VLU so there is no need to add a .txt extension to it at this point.

Like others have said, the URI is construct later based on the filename which has the .txt extension, so there is no need to worry about adding the extension to the URI explicitly:

    ...
    $file->destination = file_destination($destination . $file->getFilename(), $replace);
    ...
    $file->uri = $file->destination;

Note that the D7 version of this patch has been running on more than 40K sites hosted on drupalgardens.com for the last 12 months without causing any issue.

8: 1815504-8-D8.patch queued for re-testing.

Committed c28e514 and pushed to 8.x. Thanks!

re-posting Kervin's patch from #1

Maybe with the nice comment you wrote in #5?
// The destination filename will also later be used to create the URI.

Comment added per suggestion.

Looks right to me. Time to get this in!

Committed to 7.x - thanks!