Language: PHP
Label: vulnerable
CWE: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Code:
function UploadAssignmentTeacherFile( $assignment_id, $teacher_id, $file_input_id )
{
	global $error;

	$assignment = GetAssignment( $assignment_id );

	if ( ! $assignment )
	{
		return '';
	}

	$microseconds = new \DateTime();

	// @since 9.0 Add microseconds to filename format to make it harder to predict.
	$microseconds = $microseconds->format( 'u' );

	// Filename = [course_title]_[assignment_ID].ext.
	$file_name_no_ext = no_accents( $assignment['COURSE_TITLE'] . '_' . $assignment_id . '.' . $microseconds );

	if ( ! empty( $assignment['FILE'] )
		&& file_exists( $assignment['FILE'] ) )
	{
		// Delete existing Assignment File.
		unlink( $assignment['FILE'] );
	}

	$assignments_path = GetAssignmentsFilesPath( User( 'STAFF_ID' ) );

	// Upload file to AssignmentsFiles/[School_Year]/Teacher[teacher_ID]/Quarter[1,2,3,4...]/.
	$file = FileUpload(
		$file_input_id,
		$assignments_path,
		FileExtensionWhiteList(),
		0,
		$error,
		'',
		$file_name_no_ext
	);

	return $file;
}