[1.10.x] Fixed #26644 -- Allowed wrapping NamedTemporaryFile with File.

914c72be2a introduced a regression that
causes saving a NamedTemporaryFile in a FileField to raise a
SuspiciousFileOperation. To remedy this, if a File has an absolute
path as a filename, use only the basename as the filename.

Backport of 1b407050dd from master

django/core/files/base.py

@@ -18,6 +18,10 @@ class File(FileProxyMixin):
         self.file = file
         if name is None:
             name = getattr(file, 'name', None)
+        # Use only the basename from a file's name if it's an absolute path,
+        # e.g. from NamedTemporaryFile.
+        if isinstance(name, six.string_types) and os.path.isabs(name):
+            name = os.path.basename(name)
         self.name = name
         if hasattr(file, 'mode'):
             self.mode = file.mode

tests/file_storage/tests.py

@@ -10,6 +10,7 @@ import threading
 import time
 import unittest
 from datetime import datetime, timedelta
+from tempfile import NamedTemporaryFile
 
 from django.core.cache import cache
 from django.core.exceptions import SuspiciousFileOperation, SuspiciousOperation
@@ -871,6 +872,13 @@ class FileFieldStorageTests(TestCase):
         with temp_storage.open('tests/stringio') as f:
             self.assertEqual(f.read(), b'content')
 
+    def test_save_temporary_file(self):
+        storage = Storage()
+        with NamedTemporaryFile() as f:
+            f.write(b'content')
+            storage.normal = File(f)
+            storage.save()  # no crash
+
 
 # Tests for a race condition on file saving (#4948).
 # This is written in such a way that it'll always pass on platforms

tests/files/tests.py

@@ -26,6 +26,12 @@ else:
 
 
 class FileTests(unittest.TestCase):
+
+    def test_file_truncates_namedtemporaryfile_name(self):
+        named_file = NamedTemporaryFile()
+        f = File(named_file)
+        self.assertEqual(f.name, os.path.basename(named_file.name))
+
     def test_unicode_uploadedfile_name(self):
         uf = UploadedFile(name='¿Cómo?', content_type='text')
         self.assertIs(type(repr(uf)), str)