Fixed attachment permission check