I've found that with this module, if filenames have an ampersand in them, e.g. 'FileA&B.pdf', then when following a link, the file won't download, even though the URI is escaped correctly.

I'm assuming that when the user is redirected from the /system/files/private/ location to the actual file location, then the esacaping is being lost. In the watchdog, I see errors like the following:

page not found: system/files/private/FileA

Comments

johnhanley’s picture

johnhanley CreditAttribution: johnhanley commented
Status: Active » Closed (won't fix)

The solution is to use the Transliteration, which according to the project page "Provides one-way string transliteration (romanization) and cleans file names during upload by replacing unwanted characters." Also note: "Once installed the module won't fix any images that have already been uploaded, but any images uplaoded after this should be ok."