  def get_mail_attachment
    Log.add_info(request, params.inspect)

    attached_id = params[:id].to_i
    mail_attach = MailAttachment.find_by_id(attached_id)

    if mail_attach.nil?
      redirect_to(THETIS_RELATIVE_URL_ROOT + '/404.html')
      return
    end

    email = Email.find_by_id(mail_attach.email_id)
    if email.nil? or email.user_id != @login_user.id
      render(:text => '')
      return
    end

    mail_attach_name = mail_attach.name

    agent = request.env['HTTP_USER_AGENT']
    unless agent.nil?
      ie_ver = nil
      agent.scan(/\sMSIE\s?(\d+)[.](\d+)/){|m|
                  ie_ver = m[0].to_i + (0.1 * m[1].to_i)
                }
      mail_attach_name = CGI::escape(mail_attach_name) unless ie_ver.nil?
    end

    filepath = mail_attach.get_path
    if FileTest.exist?(filepath)
      send_file(filepath, :filename => mail_attach_name, :stream => true, :disposition => 'attachment')
    else
      send_data('', :type => 'application/octet-stream;', :disposition => 'attachment;filename="'+mail_attach_name+'"')
    end
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.