Method handleGetAttachment

rest/doc_api.go:243–347

HTTP handler for a GET of a specific doc attachment

()

// HTTP handler for a GET of a specific doc attachment
func (h *handler) handleGetAttachment() error {
	docid := h.PathVar("docid")
	attachmentName := h.PathVar("attach")
	revid := h.getQuery("rev")
	rev, err := h.collection.GetRev(h.ctx(), docid, revid, false, nil)
	if err != nil {
		return err
	}
	if rev.BodyBytes == nil {
		return kNotFoundError
	}

	meta, ok := rev.Attachments[attachmentName].(map[string]interface{})
	if !ok {
		return base.HTTPErrorf(http.StatusNotFound, "missing attachment %s", attachmentName)
	}
	digest := meta["digest"].(string)
	version, ok := db.GetAttachmentVersion(meta)
	if !ok {
		return db.ErrAttachmentVersion
	}
	attachmentKey := db.MakeAttachmentKey(version, docid, digest)
	data, err := h.collection.GetAttachment(attachmentKey)
	if err != nil {
		return err
	}

	metaOption := h.getBoolQuery("meta")
	if metaOption {
		meta["key"] = attachmentKey
		h.writeJSONStatus(http.StatusOK, meta)
		return nil
	}

	status, start, end := h.handleRange(uint64(len(data)))
	if status > 299 {
		return base.HTTPErrorf(status, "")
	} else if status == http.StatusPartialContent {
		data = data[start:end]
	}
	h.setHeader("Content-Length", strconv.FormatUint(uint64(len(data)), 10))

	// #720
	setContentDisposition := h.privs == adminPrivs

	h.setEtag(digest)

	// Request will be returned with the same content type as is set on the attachment. The caveat to this is if the
	// attachment has a content type which is vulnerable to a phishing attack. If this is the case we will return with
	// the Content Disposition header so that browsers will download the attachment rather than attempt to render it
	// unless overridden by config option. CBG-1004
	contentType, contentTypeSet := meta["content_type"].(string)
	if contentTypeSet {
		h.setHeader("Content-Type", contentType)
	}

	if !h.db.ServeInsecureAttachmentTypes {