diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 3ab894c69..0d9fe62a8 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -257,12 +257,12 @@ class ApplicationController < ActionController::Base
   def authorize_attachment_download(ctrl = params[:controller], action = params[:action], global = false)
     if @attachment.container_type == "Memo"
       allowed = User.current.allowed_to?(:memos_attachments_download,nil,:global => true)
-    elsif  @attachment.container_type == "Project"
-        return true
-    elsif @attachment.container_type == "course"
-        return true
+    elsif  @attachment.container_type == "Message" && !@project.nil?
+      allowed = User.current.allowed_to?(:projects_attachments_download,@project,:global => false)
+    elsif @attachment.container_type == "Message" && !@course.nil?
+      allowed = User.current.allowed_to?(:course_attachments_download, @course, :global => false)
     elsif @attachment.container_type == "contest"
-        return true
+      return true
     else
       return true
     end
diff --git a/app/controllers/attachments_controller.rb b/app/controllers/attachments_controller.rb
index c511b5ace..08469ac48 100644
--- a/app/controllers/attachments_controller.rb
+++ b/app/controllers/attachments_controller.rb
@@ -22,7 +22,7 @@ class AttachmentsController < ApplicationController
   before_filter :delete_authorize, :only => :destroy
   before_filter :authorize_global, :only => :upload
   before_filter :authorize_attachment_download, :only => :download
-  before_filter :login_without_softapplication, only: [:download]
+  #before_filter :login_without_softapplication, only: [:download]
   accept_api_auth :show, :download, :upload
   require 'iconv'
 
@@ -68,12 +68,20 @@ class AttachmentsController < ApplicationController
     elsif  @attachment.container.is_a?(Project)
       project = @attachment.container
       candown= User.current.member_of?(project) || (project.is_public && @attachment.is_public == 1)
+    elsif (@attachment.container.has_attribute?(:board) || @attachment.container.has_attribute?(:board_id)) && @attachment.container.board &&
+        @attachment.container.board.project
+      project = @attachment.container.board.project
+      candown = User.current.member_of?(project) || (project.is_public && @attachment.is_public == 1)
     elsif (@attachment.container.has_attribute?(:course) ||@attachment.container.has_attribute?(:course_id) ) && @attachment.container.course
       course = @attachment.container.course
       candown= User.current.member_of_course?(course) || (course.is_public==1 && @attachment.is_public == 1)
     elsif @attachment.container.is_a?(Course)
       course = @attachment.container
       candown= User.current.member_of_course?(course) || (course.is_public==1 && @attachment.is_public == 1)
+    elsif (@attachment.container.has_attribute?(:board) || @attachment.container.has_attribute?(:board_id)) && @attachment.container.board &&
+        @attachment.container.board.course
+      course = @attachment.container.board.course
+      candown= User.current.member_of_course?(course) || (course.is_public==1 && @attachment.is_public == 1)
     elsif @attachment.container.class.to_s=="HomeworkAttach" && @attachment.container.bid.reward_type == 3
       candown = true
     else
@@ -321,8 +329,11 @@ private
     raise ActiveRecord::RecordNotFound if params[:filename] && params[:filename] != @attachment.filename
     if @attachment.container_type == 'Course'
       @course = @attachment.course
-    elsif  !@attachment.container.nil? && (@attachment.container.has_attribute?(:course) || @attachment.container.has_attribute?(:course)) && @attachment.container.course
+    elsif  !@attachment.container.nil? && (@attachment.container.has_attribute?(:course) || @attachment.container.has_attribute?(:course_id)) && @attachment.container.course
       @course = @attachment.container.course
+    elsif !@attachment.container.nil? && ((@attachment.container.has_attribute?(:board) || @attachment.container.has_attribute?(:board_id)) && @attachment.container.board &&
+        @attachment.container.board.course)
+      @course = @attachment.container.board.course
     else
       unless @attachment.container_type == 'Bid' || @attachment.container_type == 'HomeworkAttach' || @attachment.container_type == 'Memo' || @attachment.container_type == 'Softapplication'
         @project = @attachment.project