From 99ef48a58510da3a739d5b07a7292a5a82d49050 Mon Sep 17 00:00:00 2001
From: Andrew Ozz <azaozz@git.wordpress.org>
Date: Mon, 16 Dec 2019 23:42:34 +0000
Subject: [PATCH] Upload: Fix the final file name collision test in
 `wp_unique_filename()` when uploading a file with upper case extension. Add a
 unit test to catch that in the future.

Fixes #48975 for trunk.


git-svn-id: https://develop.svn.wordpress.org/trunk@46966 602fd350-edb4-49c9-b593-d223f7449a82
---
 src/wp-includes/functions.php     | 16 +++++++++++++---
 tests/phpunit/tests/functions.php |  2 ++
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/src/wp-includes/functions.php b/src/wp-includes/functions.php
index 4cc62be66d..6a7b16563d 100644
--- a/src/wp-includes/functions.php
+++ b/src/wp-includes/functions.php
@@ -2410,6 +2410,7 @@ function _wp_upload_dir( $time = null ) {
 function wp_unique_filename( $dir, $filename, $unique_filename_callback = null ) {
 	// Sanitize the file name before we begin processing.
 	$filename = sanitize_file_name( $filename );
+	$ext2     = null;
 
 	// Separate the filename into a name and extension.
 	$ext  = pathinfo( $filename, PATHINFO_EXTENSION );
@@ -2485,10 +2486,19 @@ function wp_unique_filename( $dir, $filename, $unique_filename_callback = null )
 			}
 
 			if ( ! empty( $files ) ) {
-				while ( _wp_check_existing_file_names( $filename, $files ) ) {
+				// The extension case may have changed above.
+				$new_ext = ! empty( $ext2 ) ? $ext2 : $ext;
+
+				// Ensure this never goes into infinite loop
+				// as it uses pathinfo() and regex in the check but string replacement for the changes.
+				$count = count( $files );
+				$i     = 1;
+
+				while ( $i <= $count && _wp_check_existing_file_names( $filename, $files ) ) {
 					$new_number = (int) $number + 1;
-					$filename   = str_replace( array( "-{$number}{$ext}", "{$number}{$ext}" ), "-{$new_number}{$ext}", $filename );
+					$filename   = str_replace( array( "-{$number}{$new_ext}", "{$number}{$new_ext}" ), "-{$new_number}{$new_ext}", $filename );
 					$number     = $new_number;
+					$i++;
 				}
 			}
 		}
@@ -2530,7 +2540,7 @@ function _wp_check_existing_file_names( $filename, $files ) {
 		$ext = ".$ext";
 	}
 
-	$regex = '/^' . preg_quote( $fname ) . '-(?:\d+x\d+|scaled|rotated)' . preg_quote( $ext ) . '$/';
+	$regex = '/^' . preg_quote( $fname ) . '-(?:\d+x\d+|scaled|rotated)' . preg_quote( $ext ) . '$/i';
 
 	foreach ( $files as $file ) {
 		if ( preg_match( $regex, $file ) ) {
diff --git a/tests/phpunit/tests/functions.php b/tests/phpunit/tests/functions.php
index 41d814b9d6..a47fd021fd 100644
--- a/tests/phpunit/tests/functions.php
+++ b/tests/phpunit/tests/functions.php
@@ -208,6 +208,8 @@ class Tests_Functions extends WP_UnitTestCase {
 		// Test collision with existing sub-size filename.
 		// Existing files: one-blue-pixel-100x100.png, one-blue-pixel-1-100x100.png.
 		$this->assertEquals( 'one-blue-pixel-2.png', wp_unique_filename( $testdir, 'one-blue-pixel.png' ) );
+		// Same as above with upper case extension.
+		$this->assertEquals( 'one-blue-pixel-2.png', wp_unique_filename( $testdir, 'one-blue-pixel.PNG' ) );
 
 		remove_filter( 'upload_dir', array( $this, 'upload_dir_patch_basedir' ) );
 	}