Inside functions_upload.php, a temporary file is generated for the download of an avatar from an external site:
$tmp_path = (!@ini_get('safe_mode') || strtolower(@ini_get('safe_mode')) == 'off') ? false : $phpbb_root_path . 'cache';
This is then passed to tempnam to create a temporary file:
$filename = tempnam($tmp_path, unique_id() . '-');
When not in safe mode, $tmp_path is set to false, which should cause tempnam to generate the file in the system temp directory, according to PHP documentation. However, under my Windows installation, when false is passed as a directory to tempnam, tempnam returns an empty string and does not create a temporary file.
The temp file in my php.ini is set to:
sys_temp_dir = "C:\Temp\"
Changing the $tmp_path assignment code to the following fixes the problem and makes it work correctly:
$tmp_path = (!@ini_get('safe_mode') || strtolower(@ini_get('safe_mode')) == 'off') ? sys_get_temp_dir() : $phpbb_root_path . 'cache';