r133: If the user has the CANEDITATTACH flag set, then he or she can download attachm...

diff --git a/viewattachment.php b/viewattachment.php
index ffac1df9ca2724605a8a08f7d21c6345e77d18df..0a6d1d6cb28f0c97af924157c35bb6e4bb8b79ed 100755 (executable)
--- a/viewattachment.php
+++ b/viewattachment.php
@@ -21,7 +21,7 @@ if (!$attachment)
        exit;
 }
 
-if (!can_perform('cangetattach'))
+if (!can_perform('cangetattach') OR !can_perform('caneditattach'))
 {
        echo 'alert: no permission';
        exit;