Ticket #18412: 18412.2.diff

wp-includes/post.php

@@ -4196 +4196 @@
         if ( empty($url) ) //If any of the above options failed, Fallback on the GUID as used pre-2.7, not recommended to rely upon this.
                 $url = get_the_guid( $post->ID );
 
-        $url = apply_filters( 'wp_get_attachment_url', $url, $post->ID );
+        $url = apply_filters( 'wp_get_attachment_url', wp_double_encode_url( $url ), $post->ID );
 
         if ( empty( $url ) )
                 return false;
@@ -4205 +4205 @@
 }
 
 /**
+ * Double encode any accidental %xx combinations in the filename (e.g. My%20Picture.jpg)
+ *
+ * @since 3.7
+ * @param string $url
+ *
+ * @return string
+ */
+function wp_double_encode_url( $url ) {
+        return preg_replace( '/%\d\d/e', "rawurlencode(rawurlencode(urldecode('$0')))", $url );
+}
+/**
  * Retrieve thumbnail for an attachment.
  *
  * @since 2.1.0

wp-includes/media.php

@@ -174 +174 @@
                 // we have the actual image size, but might need to further constrain it if content_width is narrower
                 list( $width, $height ) = image_constrain_size_for_editor( $width, $height, $size );
 
-                return array( $img_url, $width, $height, $is_intermediate );
+                return array( wp_double_encode_url( $img_url ), $width, $height, $is_intermediate );
         }
         return false;