Clean internal ids in ml(), that it matches with fetch.php

The resize token was broken because fetch.php cleans the id before the token calculation, while ml() uses the raw id

1 files changed, 6 insertions, 1 deletions

diff --git a/inc/common.php b/inc/common.php
index 4d939ac77..03236f7d4 100644
--- a/inc/common.php
+++ b/inc/common.php
@@ -435,6 +435,11 @@ function exportlink($id = '', $format = 'raw', $more = '', $abs = false, $sep =
  */
 function ml($id = '', $more = '', $direct = true, $sep = '&', $abs = false) {
     global $conf;
+    $isexternalimage = preg_match('#^(https?|ftp)://#i', $id);
+    if(!$isexternalimage) {
+        $id = cleanID($id);
+    }
+
     if(is_array($more)) {
         // add token for resized images
         if($more['w'] || $more['h']){
@@ -467,7 +472,7 @@ function ml($id = '', $more = '', $direct = true, $sep = '&', $abs = false)
     }
 
     // external URLs are always direct without rewriting
-    if(preg_match('#^(https?|ftp)://#i', $id)) {
+    if($isexternalimage) {
         $xlink .= 'lib/exe/fetch.php';
         // add hash:
         $xlink .= '?hash='.substr(md5(auth_cookiesalt().$id), 0, 6);