The URL for attachments returned by the XML API contains & amp; tokens. For example:
default.asp?pg=pgDownload&pgType=pgFile&ixBugEvent=168&ixAttachment=18&sFileName=HtmlTable1.html&sTicket=
Since the URL is contained in a CDATA element, I believe the ampersands should not have been escaped. Also, there is an inconsistency in that the final ampersand just before the "sTicket" parameter is not escaped.
I assume this is a bug?
