All user roles are considered as roles permitted to attach files if one role has access

On the contact form, a check is made to see if the user has access to attach files (with at least one role having this permission) by using the user_access() function. When the number of attachments are to be figured out (and later the other settings in the form validation handler) settings for all roles are considered, even those that may no longer have permission to attach files.

Solution: Only use roles that the user has that are permitted to attach files. We need to add a call to user_roles() for this unfortunately, but I really can't see a better way. Also send this along to the form validation handler so we don't need to calculate this twice.