Safe attachment access, fixing #140

[Blackoverflow]

Hi Nanu-c,

this is a fix for #140, denying access to resources outside the attachment directory.
It still uses the full file path as parameter.

Regards

Blackoverflow

[Flaburgan]

I'm not sure that really solve #140. Indeed, /etc will not be accessible anymore, but that's only part of the problem. In my opinion, the point is that other applications can access files in the filesystem by requesting the /attachment route (that's already a problem) and that even without the user noticing it. IMO we need some kind of token between the front and the back to only allow axolotl front end to access those routes.

[Blackoverflow]

Yes, your are right. This fix just alleviates the problem, but the app needs a mechanism to prevent unauthorized access through the browser.