I can reproduce this with some help from the attachment module. As the problem does not appear to be directly related to the attachment module (it has done the right thing in uploading the file and the path it has generated is correct) I am filing this under system.module, as that is where the hook for /system/files is.

Steps:

  1. Create a file which contains a plus sign on your local computer (I used "test+file.txt")
  2. Attach this file to some post and save the post.
  3. Attempt to click on the link.

Results:

  1. Attaching the file is successful and the file is put into the directory as test+file.txt
  2. The URL generated for the file is /system/files/test%2Bfile.txt -- encoding a + is not necessary in this situation, however I believe that this should still work anyway, and would have worked if I had clean URLs disabled whereas + would not.
  3. After the call to implode() in file_download(), the value of $file_path is "test file.txt", suggesting double-unescaping of the escaped character.

Configuration:

  • Clean URLs are enabled
  • Private file paths (/system/files) is enabled

I tried attaching such a file to this record, and drupal.org is generating/files/test+file.txt as the path, suggesting that this issue does not occur when private files is disabled.

Comments

Trejkaz’s picture

Trejkaz commented

I was missing Results point 4, which is that the end result is a 404 as it cannot find a file with the space in the name (it doesn't exist .. obviously.)

Trejkaz’s picture

Trejkaz commented

I just did the test on a file test#file.txt -- in this situation Drupal generates: /system/files/test%2523file.txt

It should only need to be /system/files/test%23file.txt - but this double-escaping turns out to work because of the double-unescaping when it receives the request from the user. For whatever reason the + sign is not *double*-escaped, which is why it isn't working.

Trejkaz’s picture

Trejkaz commented
Issue summary: View changes

We're on Drupal 7 now and using directory listing for file downloads now. One of these two things has fixed the issue for us but I'm not sure which.

Status: Active » Closed (outdated)

Automatically closed because Drupal 6 is no longer supported. If the issue verifiably applies to later versions, please reopen with details and update the version.