Incorrect filenames in load-scripts.php parameters

Question

I'm attempting to load the media upload js file in a widget. The code works on my development machine and on the staging site but not on the live server. The error I get is that wp.media is undefined.

I enqueue the scripts & styles I need with:

public function enqueue_admin_scripts($hook) {

    if( $hook != 'widgets.php' )
        return;

    wp_enqueue_style('thickbox');
    wp_enqueue_script('media-upload');
    wp_enqueue_script('thickbox');
    wp_enqueue_script('shw', get_template_directory_uri().'/js/custom-media.js');

}

However when viewing the link that is created, I see the following: http://xxx.com/wp-admin/load-scripts.php?c=1&load%5B%5D=hoverIntent,common,admin-bar,jquery-ui-core,jquery-ui-widget,jquery-ui-mouse,jquery-ui-sortable,jquery-ui-draggable,jquery-ui-dr&load%5B%5D=oppable,admin-widgets,svg-painter,heartbeat,wp-auth-check,jquery-ui-position,wp-pointer,thickbox,underscore,shortcode,media-uplo&load%5B%5D=ad&ver=3.8.1

As you can see media-upload has been displayed as media-uplo&load so the media functions are never included.

Has anybody come across anything like this before or can give me some advice on where to start debugging?

Answer 1

Do you have the "all-in-one-wp-security-and-firewall" plugin?

More info: https://wordpress.org/support/topic/load-scriptphp-fails-to-load?replies=3

Short answer, if so, disable the "Deny Bad Query Strings" option. If not, check for any other "security" plugins you have that might be doing dumb things.