Index: modules/upload.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/upload.module,v
retrieving revision 1.20
diff -u -r1.20 upload.module
--- modules/upload.module	24 Jan 2005 21:20:16 -0000	1.20
+++ modules/upload.module	28 Jan 2005 16:01:42 -0000
@@ -90,7 +90,7 @@
 function upload_file_download($file) {
   if (user_access('view uploaded files')) {
     $file = file_create_path($file);
-    $result = db_query(node_rewrite_sql("SELECT f.nid, * from {files} f WHERE filepath = '%s", 'f'), $file);
+    $result = db_query(node_rewrite_sql("SELECT f.* from {files} f WHERE filepath = '%s'", 'f'), $file);
     if ($file = db_fetch_object($result)) {
       $name = mime_header_encode($file->filename);
       // Serve images and text inline for the browser to display rather than download.
@@ -236,15 +236,16 @@
         // replacement from temporary to permanent URLs. That way, the author
         // can use the final URL in the body before having actually saved (to
         // place inline images for example).
-        if (!variable_get('clean_url', 0)) {
+        if (!variable_get('clean_url', 0) || variable_get('file_downloads', FILE_DOWNLOADS_PUBLIC) == FILE_DOWNLOADS_PRIVATE) {
           foreach ($previews as $file) {
-            $old = file_create_filename($file->filename, file_create_path());
-            $new = url($old);
+            $old = file_create_url(file_create_filename($file->filename, file_create_path()));
+            $old = str_replace('&', '&', $old);
+            $new = url(file_create_filename($file->filename, file_create_path()));
             $node->body = str_replace($old, $new, $node->body);
             $node->teaser = str_replace($old, $new, $node->teaser);
           }
         }
-
+        
         $teaser = $arg;
         // Add the attachments list
         if (count($rows) && !$teaser) {