[FIX] security: externals should be able to read attachements

without having the rights to read ir.config_parameter