[RobinHood]

Okay, here is the fix!

First,

Open attachment.php:

Find:

PHP Code:

if (!$attachmentinfo = $DB_site->query_first("
    SELECT filename, attachment.postid, attachment.userid, attachmentid,
        " . iif($thumb, 'thumbnail AS filedata, thumbnail_dateline AS dateline, thumbnail_filesize AS filesize,', 'attachment.dateline, filedata, filesize,') . "
        attachment.visible, mimetype, NOT ISNULL(deletionlog.primaryid) AS isdeleted,
        thread.forumid, forum.password, thread.threadid
    FROM " . TABLE_PREFIX . "attachment AS attachment
    LEFT JOIN " . TABLE_PREFIX . "attachmenttype AS attachmenttype ON(attachmenttype.extension = SUBSTRING_INDEX(attachment.filename, '.', -1))
    LEFT JOIN " . TABLE_PREFIX . "deletionlog AS deletionlog ON(attachment.postid = deletionlog.primaryid AND type = 'post')
    LEFT JOIN " . TABLE_PREFIX . "post AS post ON (post.postid = attachment.postid)
    LEFT JOIN " . TABLE_PREFIX . "thread AS thread ON (post.threadid = thread.threadid)
    LEFT JOIN " . TABLE_PREFIX . "forum AS forum ON (forum.forumid = thread.forumid)
    " . iif($postid, "WHERE attachment.postid = $postid", "WHERE attachmentid = $attachmentid") . "
")) 


Replace with:

PHP Code:

if (!$attachmentinfo = $DB_site->query_first("
    SELECT filename, attachment.postid, attachment.userid, attachmentid,
        " . iif($thumb, 'thumbnail AS filedata, thumbnail_dateline AS dateline, thumbnail_filesize AS filesize,', 'attachment.dateline, filedata, filesize,') . "
        attachment.visible, mimetype, NOT ISNULL(deletionlog.primaryid) AS isdeleted, private, 
        thread.forumid, forum.password, thread.threadid
    FROM " . TABLE_PREFIX . "attachment AS attachment
    LEFT JOIN " . TABLE_PREFIX . "attachmenttype AS attachmenttype ON(attachmenttype.extension = SUBSTRING_INDEX(attachment.filename, '.', -1))
    LEFT JOIN " . TABLE_PREFIX . "deletionlog AS deletionlog ON(attachment.postid = deletionlog.primaryid AND type = 'post')
    LEFT JOIN " . TABLE_PREFIX . "post AS post ON (post.postid = attachment.postid)
    LEFT JOIN " . TABLE_PREFIX . "thread AS thread ON (post.threadid = thread.threadid)
    LEFT JOIN " . TABLE_PREFIX . "forum AS forum ON (forum.forumid = thread.forumid)
    " . iif($postid, "WHERE attachment.postid = $postid", "WHERE attachmentid = $attachmentid") . "
")) 


Next, find:

PHP Code:

if ($attachment['postid'] == 0 AND $bbuserinfo['userid'] == $attachmentinfo['userid']) 


On top of that, add the following:

PHP Code:

if (!$attachmentinfo['private']) {
    $postid = verify_id('post', $attachmentinfo['postid']);
} 


Next, find:

PHP Code:

if (!($forumperms & CANVIEW) OR !($forumperms & CANGETATTACHMENT))
    {
        print_no_permission();
    }

    // check if there is a forum password and if so, ensure the user has it set
    verify_forum_password($attachmentinfo['forumid'], $attachmentinfo['password']); 


Replace it with the following:

PHP Code:

if (!($forumperms & CANGETATTACHMENT))
{
    $vboptions['viewattachedimages'] = 0;
    $vboptions['attachthumbs'] = 0;
}

// check if there is a forum password and if so, ensure the user has it set
    verify_forum_password($attachmentinfo['forumid'], $attachmentinfo['password']);

$pmUsers = $DB_site->query_first("SELECT toUserArray FROM ".TABLE_PREFIX."pmtext WHERE pmtextid='".$attachmentinfo['private']."'");
    $toUserArray = unserialize($pmUsers['toUserArray']);         
    if ($toUserArray[$bbuserinfo['userid']] != $bbuserinfo['username'] && $attachmentinfo['userid'] != $bbuserinfo['userid']) {
            print_no_permission();        
           } 


THAT'S IT! YOU'RE DONE!

It should be working now. If not, let me know because it is working for me.