--- attachment.module.old	Fri Jan 13 16:56:08 2006
+++ attachment.module	Fri Jan 13 16:55:28 2006
@@ -331,7 +331,15 @@
 
 function attachment_filemanager_download($file) {
   if ($file->area == 'attachments') {
-    return TRUE;
+    // check if current user has right to view the node this file is attached to.
+    $nid = db_result( db_query( "select nid from {attachment} where {attachment}.fid = %d", $file->fid ) );
+    $node = node_load( Array('nid'=>$nid) );
+    if( node_access( 'view', $node ) ) {
+      return TRUE;
+    }
+    else {
+      return FALSE;
+    }
   }
 }