In the current implementation, the themable information about an attachment (link, title, snippet, etc.) only gets added to the $results array if user_access() returns true, so the list of results should only display entries for attachments that belong to nodes the user has access to. See excerpt from Dmitry's original patch above -- I've updated it to use permission strings from any driver file but the conditional logic remains the same. I don't have enough attachments populated in my test drupal to see what you are describing -- can you send along some screen caps so I can take a look?
Please send screen caps
In the current implementation, the themable information about an attachment (link, title, snippet, etc.) only gets added to the $results array if user_access() returns true, so the list of results should only display entries for attachments that belong to nodes the user has access to. See excerpt from Dmitry's original patch above -- I've updated it to use permission strings from any driver file but the conditional logic remains the same. I don't have enough attachments populated in my test drupal to see what you are describing -- can you send along some screen caps so I can take a look?