Attachment access fix

I did some local testing as host, and i believe this fixes attachments and user_file_upload access rights.