TYPO3 Core

I confirm this, but this is Windows only.

happens with
- file upload
- creating shortcut (critical, the shortcut is created and error appears on every next page, no chance to delete shortcut other than in DB)

Looking into template.php I see that REQUEST_URI is being parsed. But in your post I see that the query argument id (obviously the path) is not URL encoded. Why?

Ok, tracking it down to t3lib_div::getIndpEnv it is seen that REQUEST_URI is in some conditions derived.

If you use eg ISAPI_Rewriter for IIS it may be configure in $TYPO3_CONF_VARS[SYS][requestURIvar] to come from HTTP_X_REWRITE_URL (you need this for Real URL). Or if you use IIS and PHP as CGI. Then it is derived from SCRIPT_NAME and QUERY_STRING.

I wonder why - in the latter case - the URL is not encoded.

Hi Masi,

may be a misunderstood: This happens with xampp on Windows, not IIS.
The Url isn't encoded, but i get the error (is a warning):

Warning: parse_url(/t3/trunk/typo3/file_list.php?id=C:/web/x-htdocs/t3/trunk/fileadmin/_temp_) [function.parse-url]: Unable to parse URL in C:\web\x-htdocs\t3\trunk\typo3\template.php on line 439

using
$pathInfo = parse_url(urlencode(t3lib_div::getIndpEnv('REQUEST_URI')));
works. The question is why REQUEST_URI' isn't encoded.

patch with urlencode is attached

Steffen, there is no misunderstanding concerning IIS. Nobody bothered to tell anything about the setup besides "Windows". I can only hope that the "PHP 5.2" flag of this bug report is true and not a fake setting.

Anyway, your patch is - sorry - only a hack. urlencoding the complete (!) url may solve the local issue, but we both know that the query of the url should be encoded from the start.

"PHP 5.2" is for sure true!

Complete PHP version: "PHP Version 5.2.3"

@Martin Kutschker

sure - i would be glad to know what really happens.
Calling file-module first time, REQUEST_URI is urlencoded. After file upload or creating a shortcut it isn't.
I tried in 4.1 as well, there is the url encoded all the time. As this is a Server-Var i don't know what happens and i would be glad if you have an idea.

Sure the patch is a hack which works on my local, but it's not the solution.
I also will debug this days to get an idea what really happens here.

ps: php 5.2.2 on my local system.

i thing this bug is related to an other one reported by me: ID 0007801

I found one error. In t3lib/class.t3lib_clipboard.php (but also in TYPO3 4.1) in function linkItemText() the "id" parameter of the URL (set with "dirname($rec)") is not escaped with rawurlencode.

it seems that this is one reason
in tce_file.php, in finish
Header('Location: '.t3lib_div::locationHeaderUrl($this->redirect));
where id is not rawurlencoded

What i don't understand that looking to log file there is no change since 4.1, only ingmars change of EOL and Ingo's copyrights.

i really stumble ...

It's the returnurl. In file_list it's rawurlencoded
$this->script.'?id='.rawurlencode($this->path).'&imagemode='.$this->thumbs;

but in file_upload it's no more.
The only difference to 4.1 is that in 4.1 it was POST and now it is GET (see code of upload-button)