Unquote the auth after splitting the url.

requests/utils.py

@@ -635,11 +635,14 @@ def get_auth_from_url(url):
     """Given a url with authentication components, extract them into a tuple of
     username,password."""
     if url:
-        url = unquote(url)
         parsed = urlparse(url)
-        return (parsed.username, parsed.password)
-    else:
-        return ('', '')
+
+        try:
+            return (unquote(parsed.username), unquote(parsed.password))
+        except AttributeError:
+            pass
+
+    return ('', '')
 
 
 def to_native_string(string, encoding='ascii'):

test_requests.py

@@ -194,7 +194,7 @@ class RequestsTestCase(unittest.TestCase):
         assert r.json()['cookies']['foo'] == 'bar'
         # Make sure the session cj is still the custom one
         assert s.cookies is cj
-    
+
     def test_param_cookiejar_works(self):
         cj = cookielib.CookieJar()
         cookiejar_from_dict({'foo' : 'bar'}, cj)
@@ -705,6 +705,10 @@ class RequestsTestCase(unittest.TestCase):
         url = 'http://user%user:pass@complex.url.com/path?query=yes'
         assert ('user%user', 'pass') == requests.utils.get_auth_from_url(url)
 
+    def test_get_auth_from_url_encoded_hashes(self):
+        url = 'http://user:pass%23pass@complex.url.com/path?query=yes'
+        assert ('user', 'pass#pass') == requests.utils.get_auth_from_url(url)
+
     def test_cannot_send_unprepared_requests(self):
         r = requests.Request(url=HTTPBIN)
         with pytest.raises(ValueError):