SpecialUpload.php has a bug.
If upload_by_url rights are allowed then a person can upload images directly from another site by specifying the URL. However, private function curlCopy( $url, $dest ) is breaks URLs because it performs a strtolower operation, which as you might guess isn't proper since URLs at some sites are case sensitive.
So this:
# Maybe remove some pasting blanks :-) $url = strtolower( trim( $url ) );
Should be changed to this:
# Maybe remove some pasting blanks :-) $url = trim ($url);
Mike O