I think I can sum this up, not sure the solution for the long run.
Do we all have in common that we have secured .htaccess in wp-admin/ to require a user and a pass?
If that is the common thread, I bet this has to do with flash, or at least, I think the file uploader is working with flash. I have user/pass set up in WP for the admin area.
If I remove that feature from wp-admin/.htacess, uploads work as advertised.
I first thought this was a simple fix of just adding my servers IP to be allowed and not need authentication, however, the file called is called by the client/browser, so that will not work. I have a semi-static IP, so it works for a short time, but I know the second I travel, it will break.
I think the solution is to exclude the upload php file from the security, but then people know about this, and could try to exploit that one file does not get locked down.
Here is my .htaccess in wp-admin
AuthName “Restricted Area”
AuthType Basic
AuthUserFile /somewhere/over./the/rainbow/.htpasswd
AuthGroupFile /dev/null
require valid-user
If I rename .htaccess to a.htaccess, in order to disable it, works just fine all over again.
Can others confirm?
My server logs show an http 401 error on:
/wp-admin/page-new.php Safari
/wp-admin/async-upload.php Flash
So, seems to me, user/pass credentials are not getting past Flash, and it is breaking. Makes sense, there should be no way apache is allowed to just suck the http auth out of the browser and shove it into flash. I suppose they could read it in with php, store it in a cookie, then have flash ask for it, but that seems downright dirty to me.