webfm deletes attachments if user cannot access webfm

Hi,
if a user has no "access webfm" permissions and edits a node that has webfm attachments, nodeapi('update') will call webfm_dbupdate_attach with an empty file list because $_POST['attachlist'] is always empty without the "access webfm" permissions. This will remove all attachments for that node from the database.
This is easy to fix with a check for that permissions in nodeapi. If a use has no access rights, he can't have changed anything, so we don't need to update the database.
cu,
Frank