I've created a test version of a DNN 3.0.13 site that I'm upgrading to DNN 3.3.7.  Everything is up and running fine, with the exception of links that include a SkinSrc argument.  These uniformly fail.

A typical bit of code looks like this:

aMembership.Attributes["onclick"] = " window.open('"+EditUrl("P_UID", Request.QueryString["P_UID"].ToString(), "membership")+"?SkinSrc=%5bG%5dSkins%7c_default%7cNo+Skin&ContainerSrc=%5bG%5dContainers%7c_default%7cNo+Container&dnnprintmode=true', 'new_Wind', 'toolbar=no,width=220,height=250'); ";

In \default.vb this ends up calling QueryStringDecode().  In 3.0.x that method does about what you would expect: it calls UrlDecode() and then transforms pipes to slashes and exclamation points to periods, and returns the value.  In 3.3.7 however, after decoding the URL it calls MapPath(), QueryStringDecode() checks for cross-site and parent references, and things you would generally do to a path rather than to a querystring fragment.  Predictably, this doesn't work -- although I'm not 100% sure what the failure mode actually is because it dies on the MapPath() call and brings the new window up with the URL below, and it does this without throwing any exception and my debugger loses track of the code at that point:

http://localhost/mysite/Default.aspx?tabid=591&error=Illegal+characters+in+path.

That "illegal characters" error isn't coming from the DNN core, as the word "illegal" doesn't show up anywhere in the DNN distro other than the legal notice documents ;-)

One of my fellow devs here has a vague recollection of having a problem like this back in the DNN2 days (before my time) and it ended up being a config file fixup of some sort, but I don't find anything likely in the old or new config files ...

If (just for the heck of it) I replace the call to QueryStringDecode() with something equivalent to the old DNN version this error is bypassed and the skin loads successfully, but the called page always dies with a "module failed to load, try refreshing" stock message.

Ideas, anyone?

--Bob