Theme files cannot be edited when theme's directory has certain characters in it

As a note, I found out where the problem lies.

Some code in wp-includes/pluggable-functions.php is the culprit.

Starting on line 264 of the file, this code is what trips up the problem I'm having:

$location = preg_replace('|[^a-z0-9-~+_.?#=&;,/:%]|i', '', $location);

$strip = array('%0d', '%0a');
$location = str_replace($strip, '', $location);

If the code from 2.0.3 is substituted, the code works as expected. Basically, replace those three lines of code with this one:

$location = str_replace( array("\n", "\r"), '', $location);

However, I think the code added to 2.0.4 was put there for a reason, so I doubt just putting back in the 2.0.3 code is a desired remedy.

As another update, this issue not only affects brackets. It also affects characters like parenthesis, spaces, and braces, for instance. This can easily be seen by looking at the preg_replace line.

I'm not sure how modifying that line would affect things with the IIS issue it is meant to solve though, since I'm not at all familiar with it.

Perhaps someone more familiar with this part of the code can provide some insight.

Since this affects more directory names than just ones with brackets in them, I am moving up the priority of this ticket to High.

(Also, it's not really important, but in my original post, I meant $file (not $files) as the variable I was talking about.)

Added a few extra characters to the regex and made a patch for this.

I left out spaces as mentioned by the ticket reporter, because I think spaces shouldn't be allowed in path and file names on the web.

Spaces and other characters are perfectly legal in filenames both on and off the web. I don't see why we should leave them out.

Nominating for 2.0.5. Keep in mind that this preg_replace is meant to prevent CRLF injection and other baddies, so we need to make sure we don't compromise security. Hmm, perhaps we should switch to POST.

(In [4268]) Do only the minimum sanitization on the URL redirect. fixes #2994

(In [4269]) Do only the minimum sanitization on the URL redirect. fixes #2994

Instead of modifying wp_redirect(), let's go the more conservative route for 2.0.5 and modify theme-editor.php. I changed it to strip CRLF and nulls pass everything else through. Any other badness should be caught with the allowed_files check. We can reconsider what to do with wp_redirect() in 2.1.

Milestone 2.0.5 deleted

Please, please help! I am VERY new to Word Press or php. I keep getting the "THAT FILE CAN NOT BE EDITED" every time I try to access the theme editor. I am trying to build this site for a non-profit that NEED to have this going as soon as possible, we're trying to pay off a building and are under pressure to make this happen. PLEASE help! I read some help files, and this seems to be a common problem, but I can not for the life of me understand what to do about fixing it. PLEASE HELP!