cakephp/cakephp — pull request #2709 by MelvinRoss (2014-01-25 01:55:12+00:00)
Title: Fix double url decoding bug

Today I encountered an interesting bug where certain URLS of a production site were not working and reporting that the requested address couldn't be found. Upon further investigation I learned that this was because the URL was being double urldecoded. The result was that anything inside of a url that was "%[0-9]+' AFTER urldecoding got decoded again and turned into a random character, or discarded. This resulted in the CakeRequest object having incorrect values in at least the "here" property and inside of the params array, which lead to the error being thrown.

Concrete example taken from live code:
URL: http://local/outboundMessages/index/page:5/filters:%7B%22conditions%22%3A%5B%22billing_account_num%20LIKE%20%27%2555%25%27%22%5D%7D

Before change:
'named' => array(
'page' => '5',
'filters' => '{"conditions":["billing_account_num LIKE 'U%'"]}'
),
After change:
'named' => array(
'page' => '5',
'filters' => '{"conditions":["billing_account_num LIKE '%55%'"]}'
),
As you can see, the URL is correctly decoded to:
http://local/outboundMessages/index/page:5/filters:{"conditions":["billing_account_num LIKE '%55%'"]}
then decoded again, resulting in the 'U'.

This double decoding is not needed nor correct, and looks like it was largely put in because the original author forgot that they had already decoded it.