Redmine

I personally don't mind if files are stored as hex or similar in disk as long as there is a rake task to obtain the name from the hex code and viceversa.

I think that the common use case is to handle files through the web interface and the uncommon case is to handle them directly in the filesystem. So a helper for the uncommon case would be enough.

From rails guide http://guides.rubyonrails.org/security.html there is a suggestion:

_# Finally, replace all non alphanumeric, underscore  # or periods with underscore  name.gsub! /[^\w\.\-]/, '_' 
This is what is generating this bug._

This is recommended as best practice but really it isn't.
I worked PHP for a while and the 2 best security books on PHP do not mention character replacement on upload.

Unfortunately this replacement is generating unwanted/unexpected user behavior in my opinion it's indeed a bug.

The better solution is to validate the file name.
We should decide what characters should be allowed in the file name( space, alfa-numerics, underscore etc. ) and validate the file name accordingly.
The validation message should specify which are the allowed characters.

+1 from me - I agree with Vinko in that I do not care how files are stored in the filesystem, while I too believe that the original file name should be used in the UI.

Please fix this soon! In our company, we use lots of brackets, ampersands etc... and more often than not our attachment filenames end up looking completely unintelligible on Redmine.

Is this going to be fixed in Redmine at all or has this been abandoned?

after my redmine upgrade 1.3.1
it fixed that changing my file names.

but. at that time i display my attached image to wiki page.
it doesn't work if file name include blank space..

is it normal?