Make WordPress Core

Opened 4 years ago

Last modified 4 years ago

#49841 new defect (bug)

wp_get_attachment_url does not return a url

Reported by: hughiemolloy's profile hughie.molloy Owned by:
Milestone: Awaiting Review Priority: normal
Severity: normal Version: 5.4
Component: Media Keywords: reporter-feedback
Focuses: Cc:


wp_get_attachment_url returns the base url to the uploads directory suffix with the file path.

The file path is not always a valid url. 'fun image.png' is a valid file name. It's url path is 'fun%20image.png'

I suggest adding the below straight after line 5859 in wp-includes/post.php

		// Convert the file path into a valid URL path
		$file = implode('/', array_map('rawurlencode', explode(DIRECTORY_SEPARATOR, $file)));

Change History (4)

#1 @davidbaumwald
4 years ago

  • Component changed from General to Media
  • Focuses template coding-standards removed

This ticket was mentioned in Slack in #core-media by antpb. View the logs.

4 years ago

#3 @johnbillion
4 years ago

  • Keywords reporter-feedback added

Thanks for the report @hughiemolloy .

Can you provide some steps to reproduce this bug from the beginning?

For example, when I upload an image containing a space in its name it gets converted to a dash (fun image.png becomes fun-image.png at the point where it gets uploaded). How are you uploading an image and retaining the space in its name?

Regardless of this, it does look like rawurlencode should be applied to the file name for correctness.

#4 @hughie.molloy
4 years ago

Hi John,

Sorry for the delay. We are using code like the following

     * @return int|\WP_Error
    public static function attachImageToPost(int $post_id, string $local_filepath, string $title, bool $generate_metadata = true)
        $image_id = static::insertAttachment($title, $local_filepath, $post_id, $generate_metadata);
        if (!$image_id instanceof \WP_Error) {
            $image_url = wp_get_attachment_url($image_id);
            update_post_meta($image_id, 'guid', $image_url);

        return $image_id;

     * @return int|\WP_Error
    protected static function insertAttachment(string $title, string $path, int $post_id, bool $generate_metadata = false)
        if (!function_exists('wp_generate_attachment_metadata')) {
            require_once(ABSPATH . 'wp-admin/includes/media.php');
            require_once(ABSPATH . 'wp-admin/includes/file.php');
            require_once(ABSPATH . 'wp-admin/includes/image.php');

        $att_id = wp_insert_attachment([
            'post_content'      => '',
            'post_title'        => $title,
            'post_status'       => 'inherit',
            'post_mime_type'    => 'image/jpg'
        ], $path, $post_id);

        if ($generate_metadata && !$att_id instanceof \WP_Error) {
            $att_meta = wp_generate_attachment_metadata($att_id, $path);
            wp_update_attachment_metadata($att_id, $att_meta);

        return $att_id;

Basically is you have an image somewhere locally with an unescaped file name wp_insert_attachment does not correct the path/image name and when you call the file it is not escaped properly.

Last edited 4 years ago by hughie.molloy (previous) (diff)
Note: See TracTickets for help on using tickets.