Check _temp_tarname before deleting temp file in destructor.

[mcdruid]

This is a security hardening which I believe is safe to discuss in public.

The __destruct() method can be abused via deserialization / object injection to delete arbitrary files.

As it looks like _temp_tarname is only ever set in one place:

    public function _openRead()
    {
        if (strtolower(substr($this->_tarname, 0, 7)) == 'http://') {

            // ----- Look if a local copy need to be done
            if ($this->_temp_tarname == '') {
                $this->_temp_tarname = uniqid('tar') . '.tmp';

...it seems like we should be able to check the filename before actually deleting a "temp file".

Additional checking could be done to ensure that _tarname matches the above etc..., but just checking _temp_tarname should be sufficient to avoid abuse.

[mrook]

LGTM, thanks!