diff --git a/app/controllers/attachments_controller.rb b/app/controllers/attachments_controller.rb
index 014262aea..8eb7ffebc 100644
--- a/app/controllers/attachments_controller.rb
+++ b/app/controllers/attachments_controller.rb
@@ -2,7 +2,7 @@
 #
 #  文件上传
 class AttachmentsController < ApplicationController
-  before_action :require_login, :check_auth
+  before_action :require_login, :check_auth, except: [:show]
   before_action :find_file, only: %i[show destroy]
 
   include ApplicationHelper
@@ -10,6 +10,8 @@ class AttachmentsController < ApplicationController
   def show
     # 1. 优先跳到cdn
     # 2. 如果没有cdn，send_file
+    candown = attachment_candown @file
+    tip_exception("您没有权限下载该附件") if !candown
     if @file.cloud_url.present?
       update_downloads(@file)
       redirect_to @file.cloud_url and return
@@ -157,4 +159,33 @@ class AttachmentsController < ApplicationController
     end
     edu_setting('public_cdn_host') + "/" + path
   end
+
+  def attachment_candown attachment
+    return true if current_user.admin? || current_user.business?
+    candown = false
+    if attachment.container && current_user.logged?
+      # 课堂资源、作业、毕设相关资源的权限判断
+      if attachment.container.is_a?(Course)
+        course = attachment.container
+        candown = current_user.member_of_course?(course) || attachment.is_public == 1
+      elsif attachment.container.is_a?(HomeworkCommon) || attachment.container.is_a?(GraduationTask) || attachment.container.is_a?(GraduationTopic)
+        course = attachment.container&.course
+      elsif attachment.container.is_a?(StudentWork)
+        course = attachment.container&.homework_common&.course
+      elsif attachment.container.is_a?(StudentWorksScore)
+        course = attachment.container&.student_work&.homework_common&.course
+      elsif attachment.container.is_a?(GraduationWork)
+        course = attachment.container&.graduation_task&.course
+      elsif attachment.container.is_a?(GraduationWorkScore)
+        course = attachment.container&.graduation_work&.graduation_task&.course
+      else
+        candown = true
+      end
+
+      candown = !candown && course.present? ? current_user.member_of_course?(course) : candown
+    else
+      candown = true
+    end
+    candown
+  end
 end
diff --git a/app/models/user.rb b/app/models/user.rb
index 03c97b9f3..34576db66 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -250,7 +250,7 @@ class User < ApplicationRecord
 
   # 课堂成员
   def member_of_course?(course)
-    course.course_members.exists?(user_id: id)
+    course&.course_members.exists?(user_id: id)
   end
 
   # 实训路径管理员：创建者或admin