Make WordPress Core

Opened 22 months ago

Last modified 20 months ago

#49841 new defect (bug)

wp_get_attachment_url does not return a url

Reported by: hughie.molloy Owned by:
Milestone: Awaiting Review Priority: normal
Severity: normal Version: 5.4
Component: Media Keywords: reporter-feedback
Focuses: Cc:


wp_get_attachment_url returns the base url to the uploads directory suffix with the file path.

The file path is not always a valid url. 'fun image.png' is a valid file name. It's url path is 'fun%20image.png'

I suggest adding the below straight after line 5859 in wp-includes/post.php

		// Convert the file path into a valid URL path
		$file = implode('/', array_map('rawurlencode', explode(DIRECTORY_SEPARATOR, $file)));

Change History (4)

#1 @davidbaumwald
22 months ago

  • Component changed from General to Media
  • Focuses template coding-standards removed

This ticket was mentioned in Slack in #core-media by antpb. View the logs.

21 months ago

#3 @johnbillion
21 months ago

  • Keywords reporter-feedback added

Thanks for the report @hughiemolloy .

Can you provide some steps to reproduce this bug from the beginning?

For example, when I upload an image containing a space in its name it gets converted to a dash (fun image.png becomes fun-image.png at the point where it gets uploaded). How are you uploading an image and retaining the space in its name?

Regardless of this, it does look like rawurlencode should be applied to the file name for correctness.

#4 @hughie.molloy
20 months ago

Hi John,

Sorry for the delay. We are using code like the following

     * @return int|\WP_Error
    public static function attachImageToPost(int $post_id, string $local_filepath, string $title, bool $generate_metadata = true)
        $image_id = static::insertAttachment($title, $local_filepath, $post_id, $generate_metadata);
        if (!$image_id instanceof \WP_Error) {
            $image_url = wp_get_attachment_url($image_id);
            update_post_meta($image_id, 'guid', $image_url);

        return $image_id;

     * @return int|\WP_Error
    protected static function insertAttachment(string $title, string $path, int $post_id, bool $generate_metadata = false)
        if (!function_exists('wp_generate_attachment_metadata')) {
            require_once(ABSPATH . 'wp-admin/includes/media.php');
            require_once(ABSPATH . 'wp-admin/includes/file.php');
            require_once(ABSPATH . 'wp-admin/includes/image.php');

        $att_id = wp_insert_attachment([
            'post_content'      => '',
            'post_title'        => $title,
            'post_status'       => 'inherit',
            'post_mime_type'    => 'image/jpg'
        ], $path, $post_id);

        if ($generate_metadata && !$att_id instanceof \WP_Error) {
            $att_meta = wp_generate_attachment_metadata($att_id, $path);
            wp_update_attachment_metadata($att_id, $att_meta);

        return $att_id;

Basically is you have an image somewhere locally with an unescaped file name wp_insert_attachment does not correct the path/image name and when you call the file it is not escaped properly.

Last edited 20 months ago by hughie.molloy (previous) (diff)
Note: See TracTickets for help on using tickets.