Per project protection

app/controllers/files_controller.rb

 class FilesController < ApplicationController
   def download
-    uploader = Note.find(params[:id]).attachment
+    note = Note.find(params[:id])
+
+    if can?(current_user, :read_project, note.project)
+      uploader = note.attachment
       send_file uploader.file.path, disposition: 'attachment'
+    else
+      not_found!
+    end
   end
 end