[Zzed]

avatar.php is not using global.php. So you may want to add the same logic as in global.php. Except that you have to use $REMOTE_ADDR instead of $url.

In attachment php:
Look for:

$permissions=getpermissions($getforuminfo[forumid]);

And add this directly below it:

if($vb_org == 1) {
  $permissions['canview'] = 1;
  $permissions['cangetattachment'] = 1;
}