Hi,
Here is a possible fix. There is a file name conversion in Attachement.sanitize_filename
The only problem I see is that on disk the file name will stored in HEX I think.
The file on disk had another name anyway but now it's unreadable.

On the interface it's fine now and the download it's fine.
Suggest another a better solution. I would like to provide a better fix if this is wrong.
--------------------------------------------------------------------------------
I personally don't mind if files are stored as hex or similar in disk as long as there is a rake task to obtain the name from the hex code and viceversa.

I think that the common use case is to handle files through the web interface and the uncommon case is to handle them directly in the filesystem. So a helper for the uncommon case would be enough.
--------------------------------------------------------------------------------
From rails guide http://guides.rubyonrails.org/security.html there is a suggestion:

<pre>
_# Finally, replace all non alphanumeric, underscore # or periods with underscore name.gsub! /[^\w\.\-]/, '_'
This is what is generating this bug._
</pre>

This is recommended as best practice but really it isn't.
I worked PHP for a while and the 2 best security books on PHP do not mention character replacement on upload.

Unfortunately this replacement is generating unwanted/unexpected user behavior in my opinion it's indeed a bug.

The better solution is to validate the file name.
We should decide what characters should be allowed in the file name( space, alfa-numerics, underscore etc. ) and validate the file name accordingly.
The validation message should specify which are the allowed characters.

--------------------------------------------------------------------------------
+1 from me - I agree with Vinko in that I do not care how files are stored in the filesystem, while I too believe that the original file name should be used in the UI.
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
Please fix this soon! In our company, we use lots of brackets, ampersands etc... and more often than not our attachment filenames end up looking completely unintelligible on Redmine.
--------------------------------------------------------------------------------
Is this going to be fixed in Redmine at all or has this been abandoned?
--------------------------------------------------------------------------------
Fixed in r7917. Now, only a few characters are removed from the filename stored in the database:

<pre>
? % * : | " ' < >
</pre>
--------------------------------------------------------------------------------
after my redmine upgrade 1.3.1
it fixed that changing my file names.

but. at that time i display my attached image to wiki page.
it doesn't work if file name include blank space..

is it normal?
--------------------------------------------------------------------------------