@cpitchford wrote:
My only concern is that some other user of io_open may double encode a url with options in order to work around the original bug
I thought about that myself. The only place that would have input that gets passed to io_open that could be double-encoded would be from the admin interface, and that should only get decoded once, so it will fail trying to open the (single encoded) filename.
That is, if the path/options part is split first, and path and options are urldecoded seperately. Which is how it should be done, I believe.
— Ron