Protected attachment urls and FileUpload don't go well together when attachOnUpload is false

[goldmont]

Winter CMS Build

1.2

PHP Version

8.2

Database engine

MySQL/MariaDB

Plugins installed

No response

Issue description

WinterCMS: v1.2.10

Hi,

Attaching a protected file via the FileUpload form widget and clicking directly on the attachment url before saving returns 404.

It doesn't happen using attachOnUpload: true. I think that's due to deferred bindings. Maybe the preview should be enabled once the form is saved.

Steps to replicate

1. Setup a protected attachment in your model.
2. Use FileUpload form widget to upload it.
3. Try to preview the uploaded file before saving.

Workaround

The workaround is to set attachOnUpload: true so that the file is immediately linked to the model after the upload.