trial and error in attachments.php around line 37, replacing the following:

                        $type = ($row['filetype']) ? $row['filetype'] : 'application/octet-stream';
                        header("Content-type: ".$type);
                        header('Content-Length: '.$row['filesize']);
                        header("Content-Disposition: inline");
                        echo file_get_contents(company_path(). "/attachments/".$row['unique_name']);
                exit();

with

                      header( "location: " . $_SERVER['PHP_SELF'] . "/../" . company_path(). "/attachments/".$row['unique_name'] );
                exit();

works.  I don't see any security issue by passing a URL instead of a stream?