diff --git a/app/controllers/attachments_controller.rb b/app/controllers/attachments_controller.rb index fd43977ee..514f68d49 100644 --- a/app/controllers/attachments_controller.rb +++ b/app/controllers/attachments_controller.rb @@ -600,7 +600,7 @@ private def has_login unless @attachment && @attachment.container_type == "PhoneAppVersion" - render_403 unless User.current.logged? + render_403 if !User.current.logged? && @attachment.container_type != 'OrgSubfield' && @attachment.container_type != 'OrgDocumentComment' end end end diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb index 07f7a0ed8..9f08a63ed 100644 --- a/app/helpers/application_helper.rb +++ b/app/helpers/application_helper.rb @@ -1996,6 +1996,8 @@ module ApplicationHelper candown= User.current.member_of_course?(course) || (course.is_public==1 && attachment.is_public == 1) elsif attachment.container.is_a?(OrgSubfield) candown = true + elsif attachment.container.is_a?(OrgDocumentComment) + candown = true elsif (attachment.container.has_attribute?(:board) || attachment.container.has_attribute?(:board_id)) && attachment.container.board && attachment.container.board.course course = attachment.container.board.course