[1.1_STABLE] HTML escape icon paths so the ampersands are converted properly.

(cherry picked from commit 617a44964a09d4e6f946d3cb1058e6145b8b9c80)

htdocs/artefact/file/blocktype/filedownload/lib.php

@@ -76,7 +76,7 @@ class PluginBlocktypeFiledownload extends PluginBlocktype {
 
                 $result .= '<div title="' . hsc($artefact->get('title')) . '">';
                 $result .= '<div class="fl"><a href="' . hsc($downloadurl) . '">';
-                $result .= '<img src="' . call_static_method(generate_artefact_class_name($artefact->get('artefacttype')), 'get_icon', $icondata)
+                $result .= '<img src="' . hsc(call_static_method(generate_artefact_class_name($artefact->get('artefacttype')), 'get_icon', $icondata))
                     . '" alt=""></a></div>';
                 $result .= '<div style="margin-left: 30px;">';