Escape hash in attachment url, fix frappe/erpnext#1961