Hi,
seems like no access to change = no access to change's attachments.
You can try to enable access to Change Orders and disable chg form for specified role. Don't forget to cleanup notifictions, urls and other stuff that can navigate user to chg.
In our env we also do not allow customers to see Change's body, for that purposes I have added followed code that redirects user to assigned workflow from change form:
<PDM_LIST prefix=ztask factory=wf where="status='PEND' AND chg=$args.id AND assignee=U'$cst.id'">
<PDM_IF "$ztask.id" != "">
var url = cfgCgi +
"?SID=" + cfgSID +
"+FID=" + fid_generator() +
"+OP=SEARCH" +
"+FACTORY=wf" +
"+SKIPLIST=1" +
"+QBE.EQ.id=" + "$ztask.id";
display_new_page(url);
</PDM_IF>
</PDM_LIST>
Hope this helps.
Regards,
Timur Alimov