Check user.number against hdr.from_ext before parsing attachments.

web/root/msgs/attachments.ssjs

@@ -30,6 +30,9 @@ hdr=msgbase.get_msg_header(false,id);
 if(hdr==undefined) {
 	error("No such message!");
 }
+if(sub=='mail' && hdr.from_ext!=user.number)
+    error("You can only read e-mail attachments addressed to yourself!");
+
 body=msgbase.get_msg_body(false,id);
 if(body==undefined) {
 	error("Can not read message body!");