Thanks to visit codestin.com
Credit goes to github.com

Skip to content

[13.x] Fix path separator encoding in temporaryUrl on local disk#60230

Merged
taylorotwell merged 1 commit into
laravel:13.xfrom
kayw-geek:fix/temporary-url-path-separator-encoding
May 22, 2026
Merged

[13.x] Fix path separator encoding in temporaryUrl on local disk#60230
taylorotwell merged 1 commit into
laravel:13.xfrom
kayw-geek:fix/temporary-url-path-separator-encoding

Conversation

@kayw-geek
Copy link
Copy Markdown
Contributor

@kayw-geek kayw-geek commented May 22, 2026

Follows up on #60194, which fixed the encoding in temporaryUploadUrl but missed the identical pattern in temporaryUrl introduced by #60137.

Background

#60137 added rawurlencode($path) to both temporaryUrl and temporaryUploadUrl so reserved URI characters (?, &, #) in storage keys couldn't escape the path segment of a signed URL.

rawurlencode also encodes / as %2F, so nested storage keys produced URLs that no longer matched the storage serve/upload routes. #60194 fixed this in temporaryUploadUrl with strtr(rawurlencode($path), ['%2F' => '/']), but the sibling call site two methods up in temporaryUrl was left with the bare rawurlencode($path).

Reproduction

$url = Storage::temporaryUrl('nested/folder/photo.jpg', now()->addMinute());
// http://localhost/storage/.../nested%2Ffolder%2Fphoto.jpg?expires=...&signature=...

A GET against that URL hits the storage serve route with an encoded key the route can't resolve, so users see a 404 / 403 instead of the file.

PHPUnit output before the fix:

Failed asserting that 'http://localhost/storage/nested%2Ffolder%2Fserve-file-test.txt?expires=...&signature=...'
contains "nested/folder/serve-file-test.txt".

Fix

Mirror #60194 — apply the same strtr decode step in temporaryUrl so ?, &, # stay escaped while / is preserved.

After

$url = Storage::temporaryUrl('nested/folder/photo.jpg', now()->addMinute());
// http://localhost/storage/.../nested/folder/photo.jpg?expires=...&signature=...

@jackbayliss
Copy link
Copy Markdown
Contributor

Verified this locally, nice one.

Yeah, I missed it, am only human after all. 😃

@taylorotwell taylorotwell merged commit e974ce6 into laravel:13.x May 22, 2026
54 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants