--- /sites/default/modules/lightbox2/lightbox2.insert.inc  2010-09-22 03:47:15.000000000 -0700
+++ /sites/default/modules/lightbox2/lightbox2.insert-new.inc  2010-10-07 09:45:48.000000000 -0700
@@ -54,15 +54,17 @@
   }
   else {
     $linkpath = $vars['item']['filepath'];
   }
   $vars['linkurl'] = insert_create_url($linkpath);
 
+  $linkpath_original = $vars['item']['filepath'];
 
   $vars['download_link'] = '';
   $download_link_text = check_plain(variable_get('lightbox2_download_link_text', 'Download Original'));
   if (!empty($download_link_text) && user_access('download original image')) {
-    $vars['download_link'] = '<br /><br />' . l($download_link_text, $vars['linkurl'], array('attributes' => array('target' => '_blank', 'id' => 'lightbox2-download-link-text')));
+    $vars['download_link'] = htmlentities('<br /><br />' . l($download_link_text, $linkpath_original,
+    array('attributes' => array('target' => '_blank', 'id' => 'lightbox2-download-link-text'))));
   }
 
   $vars['class'] = !empty($vars['widget']['insert_class']) ? $vars['widget']['insert_class'] : '';
 }