diff --git a/server/AyaNova/resource/rpt/ay-report.js b/server/AyaNova/resource/rpt/ay-report.js
index dee04339..1030b6c7 100644
--- a/server/AyaNova/resource/rpt/ay-report.js
+++ b/server/AyaNova/resource/rpt/ay-report.js
@@ -8,11 +8,10 @@ async function ayPreRender(ayAllData) {
     PreParedReportDataObject = await ayPrepareData(ayAllData);
   } else {
     PreParedReportDataObject = ayAllData;
-  } 
+  }
   return true;
 }
 
-
 ///////////////////////////////////////
 // Set our stock handlebars helpers
 //
@@ -45,8 +44,13 @@ function ayRegisterHelpers() {
     if (ayValue == null) {
       return "";
     }
+
+    //replace attachment urls with tokenized local urls
+    let src = ayValue.replace(/\[ATTACH:(.*)\]/g, function (match, p1) {
+      return attachmentDownloadUrl(p1);
+    });
     return new Handlebars.SafeString(
-      DOMPurify.sanitize(marked(ayValue, { breaks: true }))
+      DOMPurify.sanitize(marked(src, { breaks: true }))
     );
   });
 
@@ -319,3 +323,24 @@ function ayPad(n, width, z) {
   n = n + "";
   return n.length >= width ? n : new Array(width - n.length + 1).join(z) + n;
 }
+
+/////////////////////////////
+// attachment download URL
+//
+function attachmentDownloadUrl(fileId, ctype) {
+  //http://localhost:7575/api/v8/attachment/download/100?t=sssss
+  //Ctype is optional and is the MIME content type, used to detect image urls at client for drag and drop ops
+  //in wiki but ignored by server
+
+  let url =
+    "attachment/download/" +
+    fileId +
+    "?t=" +
+    AYMETA.ayClientMetaData.DownloadToken;
+
+  if (ctype && ctype.includes("image")) {
+    url += "&i=1";
+  }
+
+  return AYMETA.ayServerMetaData.ayApiUrl + url;
+}