  def get_attachment
    Log.add_info(request, params.inspect)

    attach = Attachment.find(params[:id])
    if attach.nil?
      redirect_to(THETIS_RELATIVE_URL_ROOT + '/404.html')
      return
    end

    parent_item = attach.item || ((attach.comment.nil?) ? nil : attach.comment.item)
    if parent_item.nil? or !parent_item.check_user_auth(@login_user, 'r', true)
      Log.add_check(request, '[Item.check_user_auth]'+request.to_s)
      redirect_to(:controller => 'frames', :action => 'http_error', :id => '401')
      return
    end

    attach_name = attach.name

    agent = request.env['HTTP_USER_AGENT']
    unless agent.nil?
      ie_ver = nil
      agent.scan(/\sMSIE\s?(\d+)[.](\d+)/){|m|
                  ie_ver = m[0].to_i + (0.1 * m[1].to_i)
                }
      attach_name = CGI::escape(attach_name) unless ie_ver.nil?
    end

    begin
      attach_location = attach.location
    rescue
      attach_location = Attachment::LOCATION_DB   # for lower versions
    end

    if attach_location == Attachment::LOCATION_DIR

      filepath = AttachmentsHelper.get_path(attach)

      send_file(filepath, :filename => attach_name, :stream => true, :disposition => 'attachment')
    else
      send_data(attach.content, :type => (attach.content_type || 'application/octet-stream')+';charset=UTF-8', :disposition => 'attachment;filename="'+attach_name+'"')
    end
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.