Yes, we do have the setting enabled and we appreciate that Discourse no longer allows to download the attachment without logging in. But we are still having some confusion from users that get an email notice, click on the link to download the attachment and because they weren’t already logged in are confused about what their next step should be.
I upgraded last night and the Oops page is an improvement over the generic 404 we were getting before. However, I notice that if you do login from that page, you aren’t redirected to the attachment or the post with the attachment, instead you just land at the “root” of the site.
Has there been any thought to redirecting the user once they login to the URL that they were attempting to originally access? (I’m happy to open that as a separate feature request as I think that happens from other pages as well.)