I've added a new function to the object itself -- can we use that instead to make the template cleaner?

    $attachment->getShortName(5, 5)

PS. It by default escapes the filename, so remove possible $this->escape() or use the 4th parameter not to do the escaping.

PPS. the original code has XSS because of you're not escaping filenames and there's a new protected attachments feature.