wire up downloading attachments from todo partial

app/controllers/todos_controller.rb

@@ -701,7 +701,6 @@ class TodosController < ApplicationController
     @tag = Tag.where(:name => @tag_name).first_or_create
   end
 
-
   def tags
     # TODO: limit to current_user
     tags_beginning = Tag.where('name like ?', params[:term]+'%')
@@ -815,6 +814,23 @@ class TodosController < ApplicationController
     end
   end
 
+  def attachment
+    id = params[:id]
+    filename = params[:filename]
+    attachment = Attachment.where(id: id).first
+
+    if attachment 
+      if attachment.todo.user == current_user
+        send_file(attachment.file.path)
+      else
+        head :forbidden
+      end
+    else
+      head :not_found
+    end
+
+  end
+
   private
 
   def set_group_view_by