[bug 923447] HTML escape uploaded image filename.

r?