Fix security issues.

models/note.py

@@ -299,8 +299,9 @@ class Note(db.Model):
     @property
     def file_url(self):
         """Get the URL to access the uploaded file"""
-        if self.file_path:
-            return f'/uploads/notes/{self.file_path}'
+        if self.file_path and self.id:
+            from flask import url_for
+            return url_for('notes_api.serve_note_file', note_id=self.id)
         return None
     
     @property