diff --git a/src/Services/Attachments/AttachmentSubmitHandler.php b/src/Services/Attachments/AttachmentSubmitHandler.php index c7e69257..81a83f0c 100644 --- a/src/Services/Attachments/AttachmentSubmitHandler.php +++ b/src/Services/Attachments/AttachmentSubmitHandler.php @@ -137,7 +137,10 @@ class AttachmentSubmitHandler $attachment->getName() ); - return $safeName.'-'.uniqid('', false).'.'.$extension; + // Generate a 12-character URL-safe random string, which should avoid collisions and prevent from guessing file paths. + $random = str_replace(['+', '/', '='], ['0', '1', '2'], base64_encode(random_bytes(9))); + + return $safeName.'-'.$random.'.'.$extension; } /**