Fixed task attachment rights check

pkg/models/task_attachment_rights.go

@@ -20,18 +20,27 @@ import "code.vikunja.io/web"
 
 // CanRead checks if the user can see an attachment
 func (ta *TaskAttachment) CanRead(a web.Auth) (bool, error) {
-	t := Task{ID: ta.TaskID}
+	t, err := GetTaskByIDSimple(ta.TaskID)
+	if err != nil {
+		return false, err
+	}
 	return t.CanRead(a)
 }
 
 // CanDelete checks if the user can delete an attachment
 func (ta *TaskAttachment) CanDelete(a web.Auth) (bool, error) {
-	t := Task{ID: ta.TaskID}
+	t, err := GetTaskByIDSimple(ta.TaskID)
+	if err != nil {
+		return false, err
+	}
 	return t.CanWrite(a)
 }
 
 // CanCreate checks if the user can create an attachment
 func (ta *TaskAttachment) CanCreate(a web.Auth) (bool, error) {
-	t := Task{ID: ta.TaskID}
+	t, err := GetTaskByIDSimple(ta.TaskID)
+	if err != nil {
+		return false, err
+	}
 	return t.CanCreate(a)
 }

pkg/routes/api/v1/task_attachment.go

@@ -99,8 +99,12 @@ func GetTaskAttachment(c echo.Context) error {
 		return handler.HandleHTTPError(err, c)
 	}
 
-	// Send the file to the client
-	taskAttachment.File.LoadFileByID()
+	// Open an send the file to the client
+	err = taskAttachment.File.LoadFileByID()
+	if err != nil {
+		return handler.HandleHTTPError(err, c)
+	}
 
+	http.ServeContent(c.Response(), c.Request(), taskAttachment.File.Name, taskAttachment.File.Created, taskAttachment.File.File)
 	return nil
 }