    private function sub_resource_download()
    {
        if (empty($this->response->meta->sub_resource_id)) {
            $this->response->meta->sub_resource_id = 0;
        }
        $attachment = $this->m_devices->read_sub_resource($this->response->meta->id, $this->response->meta->sub_resource, $this->response->meta->sub_resource_id, '*', '', '', '');
        $this->load->helper('file');
        if (php_uname('s') === 'Windows NT') {
            $temp = explode('\\', $attachment[0]->attributes->filename);
        } else {
            $temp = explode('/', $attachment[0]->attributes->filename);
        }
        $filename = $temp[count($temp)-1];
        $filename = preg_replace('/'.$this->response->meta->id.'_/', '', $filename, 1);
        header('Content-Type: '.get_mime_by_extension($attachment[0]->attributes->filename));
        header('Content-Disposition: attachment;filename="'.$filename.'"');
        header('Cache-Control: max-age=0');
        readfile($attachment[0]->attributes->filename);
    }
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.